darkcomet | 1789998bb071465f1ecfe9b73e97474951215270818727a11783bdff1fa6f250

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

iexplore.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

964 attrib.exe
1464 attrib.exe

pid	process
964	attrib.exe
1464	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

4132 notepad.exe
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2844 msdcsc.exe

pid	process
4132	notepad.exe

pid	process
2844	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

msdcsc.exe

description pid process target process

PID 2844 set thread context of 1448 2844 msdcsc.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2844 set thread context of 1448	2844	msdcsc.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exemsdcsc.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSecurityPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeBackupPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeRestorePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeShutdownPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeDebugPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeUndockPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 33	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 34	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 35	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: 36	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2844	msdcsc.exe
Token: SeSecurityPrivilege	2844	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2844	msdcsc.exe
Token: SeLoadDriverPrivilege	2844	msdcsc.exe
Token: SeSystemProfilePrivilege	2844	msdcsc.exe
Token: SeSystemtimePrivilege	2844	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2844	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2844	msdcsc.exe
Token: SeCreatePagefilePrivilege	2844	msdcsc.exe
Token: SeBackupPrivilege	2844	msdcsc.exe
Token: SeRestorePrivilege	2844	msdcsc.exe
Token: SeShutdownPrivilege	2844	msdcsc.exe
Token: SeDebugPrivilege	2844	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2844	msdcsc.exe
Token: SeChangeNotifyPrivilege	2844	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2844	msdcsc.exe
Token: SeUndockPrivilege	2844	msdcsc.exe
Token: SeManageVolumePrivilege	2844	msdcsc.exe
Token: SeImpersonatePrivilege	2844	msdcsc.exe
Token: SeCreateGlobalPrivilege	2844	msdcsc.exe
Token: 33	2844	msdcsc.exe
Token: 34	2844	msdcsc.exe
Token: 35	2844	msdcsc.exe
Token: 36	2844	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1448	iexplore.exe
Token: SeSecurityPrivilege	1448	iexplore.exe
Token: SeTakeOwnershipPrivilege	1448	iexplore.exe
Token: SeLoadDriverPrivilege	1448	iexplore.exe
Token: SeSystemProfilePrivilege	1448	iexplore.exe
Token: SeSystemtimePrivilege	1448	iexplore.exe
Token: SeProfSingleProcessPrivilege	1448	iexplore.exe
Token: SeIncBasePriorityPrivilege	1448	iexplore.exe
Token: SeCreatePagefilePrivilege	1448	iexplore.exe
Token: SeBackupPrivilege	1448	iexplore.exe
Token: SeRestorePrivilege	1448	iexplore.exe
Token: SeShutdownPrivilege	1448	iexplore.exe
Token: SeDebugPrivilege	1448	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1448	iexplore.exe
Token: SeChangeNotifyPrivilege	1448	iexplore.exe
Token: SeRemoteShutdownPrivilege	1448	iexplore.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exemsdcsc.execmd.execmd.exe

description	pid	process	target process
PID 1852 wrote to memory of 3836	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 3836	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 3836	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 2708	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 2708	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 2708	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	cmd.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 4132	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	notepad.exe
PID 1852 wrote to memory of 2844	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 1852 wrote to memory of 2844	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 1852 wrote to memory of 2844	1852	1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe	msdcsc.exe
PID 2844 wrote to memory of 1448	2844	msdcsc.exe	iexplore.exe
PID 2844 wrote to memory of 1448	2844	msdcsc.exe	iexplore.exe
PID 2844 wrote to memory of 1448	2844	msdcsc.exe	iexplore.exe
PID 2844 wrote to memory of 1448	2844	msdcsc.exe	iexplore.exe
PID 2844 wrote to memory of 1448	2844	msdcsc.exe	iexplore.exe
PID 3836 wrote to memory of 964	3836	cmd.exe	attrib.exe
PID 3836 wrote to memory of 964	3836	cmd.exe	attrib.exe
PID 3836 wrote to memory of 964	3836	cmd.exe	attrib.exe
PID 2708 wrote to memory of 1464	2708	cmd.exe	attrib.exe
PID 2708 wrote to memory of 1464	2708	cmd.exe	attrib.exe
PID 2708 wrote to memory of 1464	2708	cmd.exe	attrib.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

964 attrib.exe
1464 attrib.exe

pid	process
964	attrib.exe
1464	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1a9312e9567b3b451f32ba3fd565ab7b_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1464

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:4132

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2844

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

6

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery