darkcomet | 0c8bcb0016f30222a02051d413d8663eaf7298e8c7b0abbb1852a029a67357c9

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	explorer.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

explorer.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	explorer.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

Disables Task Manager via registry modification
evasion

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

3396 notepad.exe

pid	process
3396	notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exenotepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe

Drops file in System32 directory 4 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exenotepad.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description pid process target process

PID 4836 set thread context of 3976 4836 07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe explorer.exe

description	pid	process	target process
PID 4836 set thread context of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorer.exe07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3976 explorer.exe

pid	process
3976	explorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSecurityPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeBackupPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeRestorePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeShutdownPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeDebugPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeUndockPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 33	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 34	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 35	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: 36	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3976	explorer.exe
Token: SeSecurityPrivilege	3976	explorer.exe
Token: SeTakeOwnershipPrivilege	3976	explorer.exe
Token: SeLoadDriverPrivilege	3976	explorer.exe
Token: SeSystemProfilePrivilege	3976	explorer.exe
Token: SeSystemtimePrivilege	3976	explorer.exe
Token: SeProfSingleProcessPrivilege	3976	explorer.exe
Token: SeIncBasePriorityPrivilege	3976	explorer.exe
Token: SeCreatePagefilePrivilege	3976	explorer.exe
Token: SeBackupPrivilege	3976	explorer.exe
Token: SeRestorePrivilege	3976	explorer.exe
Token: SeShutdownPrivilege	3976	explorer.exe
Token: SeDebugPrivilege	3976	explorer.exe
Token: SeSystemEnvironmentPrivilege	3976	explorer.exe
Token: SeChangeNotifyPrivilege	3976	explorer.exe
Token: SeRemoteShutdownPrivilege	3976	explorer.exe
Token: SeUndockPrivilege	3976	explorer.exe
Token: SeManageVolumePrivilege	3976	explorer.exe
Token: SeImpersonatePrivilege	3976	explorer.exe
Token: SeCreateGlobalPrivilege	3976	explorer.exe
Token: 33	3976	explorer.exe
Token: 34	3976	explorer.exe
Token: 35	3976	explorer.exe
Token: 36	3976	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

3976 explorer.exe

pid	process
3976	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 1280	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 4836 wrote to memory of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 4836 wrote to memory of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 4836 wrote to memory of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 4836 wrote to memory of 3976	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	explorer.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 4836 wrote to memory of 3396	4836	07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe
PID 3976 wrote to memory of 4128	3976	explorer.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07333f628bd2373ed0dc2caa31650538_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1280

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
3⤵
PID:4128

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
2⤵
- Deletes itself
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

5

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

3

System Information Discovery

3