darkcomet | 5e81b8edcf7b02450f9fbcfdcfe58e2cdc825211d033934d7aae50deff19bc0b

Processes:

05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\23312\\8842.exe"	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

8842.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	8842.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	8842.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	8842.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

8842.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8842.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2628 attrib.exe
3060 attrib.exe
Executes dropped EXE 1 IoCs

Processes:

8842.exe

pid process

2796 8842.exe
Loads dropped DLL 2 IoCs

Processes:

05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe

pid process

2116 05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
2116 05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

8842.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8842.exe

pid	process
2628	attrib.exe
3060	attrib.exe

pid	process
2796	8842.exe

pid	process
2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe8842.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\23312\\8842.exe"	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\23312\\8842.exe"	8842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\23312\\8842.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8842.exe

description pid process target process

PID 2796 set thread context of 2524 2796 8842.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2524 iexplore.exe

description	pid	process	target process
PID 2796 set thread context of 2524	2796	8842.exe	iexplore.exe

pid	process
2524	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe8842.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeSecurityPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeBackupPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeRestorePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeShutdownPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeDebugPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeUndockPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: 33	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: 34	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: 35	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2796	8842.exe
Token: SeSecurityPrivilege	2796	8842.exe
Token: SeTakeOwnershipPrivilege	2796	8842.exe
Token: SeLoadDriverPrivilege	2796	8842.exe
Token: SeSystemProfilePrivilege	2796	8842.exe
Token: SeSystemtimePrivilege	2796	8842.exe
Token: SeProfSingleProcessPrivilege	2796	8842.exe
Token: SeIncBasePriorityPrivilege	2796	8842.exe
Token: SeCreatePagefilePrivilege	2796	8842.exe
Token: SeBackupPrivilege	2796	8842.exe
Token: SeRestorePrivilege	2796	8842.exe
Token: SeShutdownPrivilege	2796	8842.exe
Token: SeDebugPrivilege	2796	8842.exe
Token: SeSystemEnvironmentPrivilege	2796	8842.exe
Token: SeChangeNotifyPrivilege	2796	8842.exe
Token: SeRemoteShutdownPrivilege	2796	8842.exe
Token: SeUndockPrivilege	2796	8842.exe
Token: SeManageVolumePrivilege	2796	8842.exe
Token: SeImpersonatePrivilege	2796	8842.exe
Token: SeCreateGlobalPrivilege	2796	8842.exe
Token: 33	2796	8842.exe
Token: 34	2796	8842.exe
Token: 35	2796	8842.exe
Token: SeIncreaseQuotaPrivilege	2524	iexplore.exe
Token: SeSecurityPrivilege	2524	iexplore.exe
Token: SeTakeOwnershipPrivilege	2524	iexplore.exe
Token: SeLoadDriverPrivilege	2524	iexplore.exe
Token: SeSystemProfilePrivilege	2524	iexplore.exe
Token: SeSystemtimePrivilege	2524	iexplore.exe
Token: SeProfSingleProcessPrivilege	2524	iexplore.exe
Token: SeIncBasePriorityPrivilege	2524	iexplore.exe
Token: SeCreatePagefilePrivilege	2524	iexplore.exe
Token: SeBackupPrivilege	2524	iexplore.exe
Token: SeRestorePrivilege	2524	iexplore.exe
Token: SeShutdownPrivilege	2524	iexplore.exe
Token: SeDebugPrivilege	2524	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2524	iexplore.exe
Token: SeChangeNotifyPrivilege	2524	iexplore.exe
Token: SeRemoteShutdownPrivilege	2524	iexplore.exe
Token: SeUndockPrivilege	2524	iexplore.exe
Token: SeManageVolumePrivilege	2524	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2524 iexplore.exe

pid	process
2524	iexplore.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.execmd.execmd.exe8842.exe

description	pid	process	target process
PID 2116 wrote to memory of 1524	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 1524	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 1524	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 1524	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 640	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 640	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 640	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 2116 wrote to memory of 640	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	cmd.exe
PID 640 wrote to memory of 3060	640	cmd.exe	attrib.exe
PID 640 wrote to memory of 3060	640	cmd.exe	attrib.exe
PID 640 wrote to memory of 3060	640	cmd.exe	attrib.exe
PID 640 wrote to memory of 3060	640	cmd.exe	attrib.exe
PID 1524 wrote to memory of 2628	1524	cmd.exe	attrib.exe
PID 1524 wrote to memory of 2628	1524	cmd.exe	attrib.exe
PID 1524 wrote to memory of 2628	1524	cmd.exe	attrib.exe
PID 1524 wrote to memory of 2628	1524	cmd.exe	attrib.exe
PID 2116 wrote to memory of 2796	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	8842.exe
PID 2116 wrote to memory of 2796	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	8842.exe
PID 2116 wrote to memory of 2796	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	8842.exe
PID 2116 wrote to memory of 2796	2116	05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe	8842.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe
PID 2796 wrote to memory of 2524	2796	8842.exe	iexplore.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2628 attrib.exe
3060 attrib.exe

pid	process
2628	attrib.exe
3060	attrib.exe

C:\Users\Admin\AppData\Local\Temp\05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\05f18d8e6dd716f114c21bc4115baac2_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3060

C:\Users\Admin\AppData\Roaming\23312\8842.exe
"C:\Users\Admin\AppData\Roaming\23312\8842.exe"
2⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies firewall policy service
- Windows security bypass
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

5

Impair Defenses

3

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery