darkcomet | 1789998bb071465f1ecfe9b73e97474951215270818727a11783bdff1fa6f250

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2560 attrib.exe
2356 attrib.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2444 notepad.exe
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2452 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

pid process

2780 1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
2780 1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

pid	process
2560	attrib.exe
2356	attrib.exe

pid	process
2444	notepad.exe

pid	process
2452	msdcsc.exe

pid	process
2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSecurityPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeBackupPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeRestorePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeDebugPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeUndockPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 33	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 34	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 35	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2452	msdcsc.exe
Token: SeSecurityPrivilege	2452	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2452	msdcsc.exe
Token: SeLoadDriverPrivilege	2452	msdcsc.exe
Token: SeSystemProfilePrivilege	2452	msdcsc.exe
Token: SeSystemtimePrivilege	2452	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2452	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2452	msdcsc.exe
Token: SeCreatePagefilePrivilege	2452	msdcsc.exe
Token: SeBackupPrivilege	2452	msdcsc.exe
Token: SeRestorePrivilege	2452	msdcsc.exe
Token: SeShutdownPrivilege	2452	msdcsc.exe
Token: SeDebugPrivilege	2452	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2452	msdcsc.exe
Token: SeChangeNotifyPrivilege	2452	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2452	msdcsc.exe
Token: SeUndockPrivilege	2452	msdcsc.exe
Token: SeManageVolumePrivilege	2452	msdcsc.exe
Token: SeImpersonatePrivilege	2452	msdcsc.exe
Token: SeCreateGlobalPrivilege	2452	msdcsc.exe
Token: 33	2452	msdcsc.exe
Token: 34	2452	msdcsc.exe
Token: 35	2452	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2452 msdcsc.exe

pid	process
2452	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 2780 wrote to memory of 2092	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2092	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2092	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2092	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2948	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2948	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2948	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2948	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2444	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 2780 wrote to memory of 2452	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 2780 wrote to memory of 2452	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 2780 wrote to memory of 2452	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 2780 wrote to memory of 2452	2780	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 2092 wrote to memory of 2560	2092	cmd.exe	attrib.exe
PID 2092 wrote to memory of 2560	2092	cmd.exe	attrib.exe
PID 2092 wrote to memory of 2560	2092	cmd.exe	attrib.exe
PID 2092 wrote to memory of 2560	2092	cmd.exe	attrib.exe
PID 2948 wrote to memory of 2356	2948	cmd.exe	attrib.exe
PID 2948 wrote to memory of 2356	2948	cmd.exe	attrib.exe
PID 2948 wrote to memory of 2356	2948	cmd.exe	attrib.exe
PID 2948 wrote to memory of 2356	2948	cmd.exe	attrib.exe
PID 2452 wrote to memory of 2376	2452	msdcsc.exe	iexplore.exe
PID 2452 wrote to memory of 2376	2452	msdcsc.exe	iexplore.exe
PID 2452 wrote to memory of 2376	2452	msdcsc.exe	iexplore.exe
PID 2452 wrote to memory of 2376	2452	msdcsc.exe	iexplore.exe
PID 2452 wrote to memory of 2388	2452	msdcsc.exe	explorer.exe
PID 2452 wrote to memory of 2388	2452	msdcsc.exe	explorer.exe
PID 2452 wrote to memory of 2388	2452	msdcsc.exe	explorer.exe
PID 2452 wrote to memory of 2388	2452	msdcsc.exe	explorer.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe
PID 2452 wrote to memory of 1652	2452	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2560 attrib.exe
2356 attrib.exe

pid	process
2560	attrib.exe
2356	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2356

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:2444

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2452

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:2376

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:2388

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

6

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery