darkcomet | 0c8bcb0016f30222a02051d413d8663eaf7298e8c7b0abbb1852a029a67357c9

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	explorer.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

explorer.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	explorer.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

Disables Task Manager via registry modification
evasion

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2836 notepad.exe

pid	process
2836	notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exenotepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe

Drops file in System32 directory 4 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exenotepad.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Windupdt\	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description pid process target process

PID 2348 set thread context of 2676 2348 07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe explorer.exe

description	pid	process	target process
PID 2348 set thread context of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2676 explorer.exe

pid	process
2676	explorer.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSecurityPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeBackupPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeRestorePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeShutdownPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeDebugPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeUndockPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 33	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 34	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 35	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2676	explorer.exe
Token: SeSecurityPrivilege	2676	explorer.exe
Token: SeTakeOwnershipPrivilege	2676	explorer.exe
Token: SeLoadDriverPrivilege	2676	explorer.exe
Token: SeSystemProfilePrivilege	2676	explorer.exe
Token: SeSystemtimePrivilege	2676	explorer.exe
Token: SeProfSingleProcessPrivilege	2676	explorer.exe
Token: SeIncBasePriorityPrivilege	2676	explorer.exe
Token: SeCreatePagefilePrivilege	2676	explorer.exe
Token: SeBackupPrivilege	2676	explorer.exe
Token: SeRestorePrivilege	2676	explorer.exe
Token: SeShutdownPrivilege	2676	explorer.exe
Token: SeDebugPrivilege	2676	explorer.exe
Token: SeSystemEnvironmentPrivilege	2676	explorer.exe
Token: SeChangeNotifyPrivilege	2676	explorer.exe
Token: SeRemoteShutdownPrivilege	2676	explorer.exe
Token: SeUndockPrivilege	2676	explorer.exe
Token: SeManageVolumePrivilege	2676	explorer.exe
Token: SeImpersonatePrivilege	2676	explorer.exe
Token: SeCreateGlobalPrivilege	2676	explorer.exe
Token: 33	2676	explorer.exe
Token: 34	2676	explorer.exe
Token: 35	2676	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

2676 explorer.exe

pid	process
2676	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2416	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2676	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2348 wrote to memory of 2836	2348	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe
PID 2676 wrote to memory of 2536	2676	explorer.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2416

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
3⤵
PID:2536

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
2⤵
- Deletes itself
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

5

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

3

System Information Discovery

3