darkcomet | fa6ca82b40ad7f1cad6350c10b9b1aca038ed678ba4705465f5eca4a9604a844

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
Size

2.0MB
MD5

1a949339827c3534c314fc5cef076cfa
SHA1

8d171e83dcba6d417e1729061a35a3a94dd8a648
SHA256

fa6ca82b40ad7f1cad6350c10b9b1aca038ed678ba4705465f5eca4a9604a844
SHA512

97b87eb9a7b787923e7284a83a461bd24c2dac08fdc968364f8c3dfa937967af5b2ee4c524dc47a162942d16010e5cd67439222ac875aa9301769936400bfb64
SSDEEP

49152://CBhJF7gxl916Fy1xjK1egEVCa0cbKV:

Score

10^/10

darkcomet guest16 aspackv2 evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

192.168.178.27:1604

77.13.126.78:1604

Mutex

DC_MUTEX-H9FGMQM

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
S0syElonRqL0
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

DarkComet.exeservices.exeProRat.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	DarkComet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	ProRat.exe

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

iexplore.exemsdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ProRat.exeservices.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ProRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	ProRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

services.exeProRat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	ProRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	ProRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	ProRat.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2800 attrib.exe
1724 attrib.exe

pid	process
2800	attrib.exe
1724	attrib.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\winkey.dll	aspack_v212_v242

Executes dropped EXE 8 IoCs

Processes:

SubSeven.exePoisonIVY.exeBifrost.exeDarkComet.exeProRat.exefservice.exeservices.exemsdcsc.exe

pid process

2360 SubSeven.exe
2724 PoisonIVY.exe
2012 Bifrost.exe
2744 DarkComet.exe
2496 ProRat.exe
572 fservice.exe
3004 services.exe
1360 msdcsc.exe

pid	process
2360	SubSeven.exe
2724	PoisonIVY.exe
2012	Bifrost.exe
2744	DarkComet.exe
2496	ProRat.exe
572	fservice.exe
3004	services.exe
1360	msdcsc.exe

Loads dropped DLL 18 IoCs

Processes:

1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exeProRat.exeservices.exeDarkComet.exefservice.exe

pid	process
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
2496	ProRat.exe
2496	ProRat.exe
3004	services.exe
2744	DarkComet.exe
2744	DarkComet.exe
3004	services.exe
572	fservice.exe
2496	ProRat.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SubSeven.exe	upx
behavioral1/memory/2448-7-0x0000000005000000-0x000000000510C000-memory.dmp	upx
behavioral1/memory/2360-16-0x0000000000400000-0x000000000050C000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\ProRat.exe	upx
behavioral1/memory/2496-73-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/572-102-0x0000000002FE0000-0x00000000031DC000-memory.dmp	upx
behavioral1/memory/572-171-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/2496-174-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/2360-178-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/memory/3004-180-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/3004-183-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/3004-185-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/3004-186-0x0000000000400000-0x00000000005FC000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DarkComet.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	DarkComet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ProRat.exeservices.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	ProRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Drops file in System32 directory 7 IoCs

Processes:

ProRat.exefservice.exeservices.exe

description	ioc	process
File created	C:\Windows\SysWOW64\fservice.exe	ProRat.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	ProRat.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

msdcsc.exe

description pid process target process

PID 1360 set thread context of 1200 1360 msdcsc.exe iexplore.exe

description	pid	process	target process
PID 1360 set thread context of 1200	1360	msdcsc.exe	iexplore.exe

Drops file in Windows directory 8 IoCs

Processes:

ProRat.exefservice.exeservices.exe

description	ioc	process
File opened for modification	C:\Windows\system\sservice.exe	ProRat.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File opened for modification	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	ProRat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Bifrost.exeservices.exe

pid	process
2012	Bifrost.exe
2012	Bifrost.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe
3004	services.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DarkComet.exemsdcsc.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2744	DarkComet.exe
Token: SeSecurityPrivilege	2744	DarkComet.exe
Token: SeTakeOwnershipPrivilege	2744	DarkComet.exe
Token: SeLoadDriverPrivilege	2744	DarkComet.exe
Token: SeSystemProfilePrivilege	2744	DarkComet.exe
Token: SeSystemtimePrivilege	2744	DarkComet.exe
Token: SeProfSingleProcessPrivilege	2744	DarkComet.exe
Token: SeIncBasePriorityPrivilege	2744	DarkComet.exe
Token: SeCreatePagefilePrivilege	2744	DarkComet.exe
Token: SeBackupPrivilege	2744	DarkComet.exe
Token: SeRestorePrivilege	2744	DarkComet.exe
Token: SeShutdownPrivilege	2744	DarkComet.exe
Token: SeDebugPrivilege	2744	DarkComet.exe
Token: SeSystemEnvironmentPrivilege	2744	DarkComet.exe
Token: SeChangeNotifyPrivilege	2744	DarkComet.exe
Token: SeRemoteShutdownPrivilege	2744	DarkComet.exe
Token: SeUndockPrivilege	2744	DarkComet.exe
Token: SeManageVolumePrivilege	2744	DarkComet.exe
Token: SeImpersonatePrivilege	2744	DarkComet.exe
Token: SeCreateGlobalPrivilege	2744	DarkComet.exe
Token: 33	2744	DarkComet.exe
Token: 34	2744	DarkComet.exe
Token: 35	2744	DarkComet.exe
Token: SeIncreaseQuotaPrivilege	1360	msdcsc.exe
Token: SeSecurityPrivilege	1360	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1360	msdcsc.exe
Token: SeLoadDriverPrivilege	1360	msdcsc.exe
Token: SeSystemProfilePrivilege	1360	msdcsc.exe
Token: SeSystemtimePrivilege	1360	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1360	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1360	msdcsc.exe
Token: SeCreatePagefilePrivilege	1360	msdcsc.exe
Token: SeBackupPrivilege	1360	msdcsc.exe
Token: SeRestorePrivilege	1360	msdcsc.exe
Token: SeShutdownPrivilege	1360	msdcsc.exe
Token: SeDebugPrivilege	1360	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1360	msdcsc.exe
Token: SeChangeNotifyPrivilege	1360	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1360	msdcsc.exe
Token: SeUndockPrivilege	1360	msdcsc.exe
Token: SeManageVolumePrivilege	1360	msdcsc.exe
Token: SeImpersonatePrivilege	1360	msdcsc.exe
Token: SeCreateGlobalPrivilege	1360	msdcsc.exe
Token: 33	1360	msdcsc.exe
Token: 34	1360	msdcsc.exe
Token: 35	1360	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1200	iexplore.exe
Token: SeSecurityPrivilege	1200	iexplore.exe
Token: SeTakeOwnershipPrivilege	1200	iexplore.exe
Token: SeLoadDriverPrivilege	1200	iexplore.exe
Token: SeSystemProfilePrivilege	1200	iexplore.exe
Token: SeSystemtimePrivilege	1200	iexplore.exe
Token: SeProfSingleProcessPrivilege	1200	iexplore.exe
Token: SeIncBasePriorityPrivilege	1200	iexplore.exe
Token: SeCreatePagefilePrivilege	1200	iexplore.exe
Token: SeBackupPrivilege	1200	iexplore.exe
Token: SeRestorePrivilege	1200	iexplore.exe
Token: SeShutdownPrivilege	1200	iexplore.exe
Token: SeDebugPrivilege	1200	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1200	iexplore.exe
Token: SeChangeNotifyPrivilege	1200	iexplore.exe
Token: SeRemoteShutdownPrivilege	1200	iexplore.exe
Token: SeUndockPrivilege	1200	iexplore.exe
Token: SeManageVolumePrivilege	1200	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

services.exe

pid process

3004 services.exe
3004 services.exe

pid	process
3004	services.exe
3004	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exeBifrost.exeProRat.exefservice.exeDarkComet.execmd.exe

description	pid	process	target process
PID 2448 wrote to memory of 2360	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	SubSeven.exe
PID 2448 wrote to memory of 2360	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	SubSeven.exe
PID 2448 wrote to memory of 2360	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	SubSeven.exe
PID 2448 wrote to memory of 2360	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	SubSeven.exe
PID 2448 wrote to memory of 2724	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	PoisonIVY.exe
PID 2448 wrote to memory of 2724	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	PoisonIVY.exe
PID 2448 wrote to memory of 2724	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	PoisonIVY.exe
PID 2448 wrote to memory of 2724	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	PoisonIVY.exe
PID 2448 wrote to memory of 2012	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	Bifrost.exe
PID 2448 wrote to memory of 2012	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	Bifrost.exe
PID 2448 wrote to memory of 2012	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	Bifrost.exe
PID 2448 wrote to memory of 2012	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	Bifrost.exe
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2448 wrote to memory of 2744	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	DarkComet.exe
PID 2448 wrote to memory of 2744	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	DarkComet.exe
PID 2448 wrote to memory of 2744	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	DarkComet.exe
PID 2448 wrote to memory of 2744	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	DarkComet.exe
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2448 wrote to memory of 2496	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	ProRat.exe
PID 2448 wrote to memory of 2496	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	ProRat.exe
PID 2448 wrote to memory of 2496	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	ProRat.exe
PID 2448 wrote to memory of 2496	2448	1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe	ProRat.exe
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2012 wrote to memory of 1400	2012	Bifrost.exe	Explorer.EXE
PID 2496 wrote to memory of 572	2496	ProRat.exe	fservice.exe
PID 2496 wrote to memory of 572	2496	ProRat.exe	fservice.exe
PID 2496 wrote to memory of 572	2496	ProRat.exe	fservice.exe
PID 2496 wrote to memory of 572	2496	ProRat.exe	fservice.exe
PID 572 wrote to memory of 3004	572	fservice.exe	services.exe
PID 572 wrote to memory of 3004	572	fservice.exe	services.exe
PID 572 wrote to memory of 3004	572	fservice.exe	services.exe
PID 572 wrote to memory of 3004	572	fservice.exe	services.exe
PID 2744 wrote to memory of 1760	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1760	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1760	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1760	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1624	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1624	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1624	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 1624	2744	DarkComet.exe	cmd.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 2744 wrote to memory of 748	2744	DarkComet.exe	notepad.exe
PID 1624 wrote to memory of 2800	1624	cmd.exe	attrib.exe
PID 1624 wrote to memory of 2800	1624	cmd.exe	attrib.exe
PID 1624 wrote to memory of 2800	1624	cmd.exe	attrib.exe
PID 1624 wrote to memory of 2800	1624	cmd.exe	attrib.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2800 attrib.exe
1724 attrib.exe

pid	process
2800	attrib.exe
1724	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a949339827c3534c314fc5cef076cfa_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448

C:\Users\Admin\AppData\Local\Temp\SubSeven.exe
"C:\Users\Admin\AppData\Local\Temp\SubSeven.exe"
3⤵
- Executes dropped EXE
PID:2360

C:\Users\Admin\AppData\Local\Temp\PoisonIVY.exe
"C:\Users\Admin\AppData\Local\Temp\PoisonIVY.exe"
3⤵
- Executes dropped EXE
PID:2724

C:\Users\Admin\AppData\Local\Temp\Bifrost.exe
"C:\Users\Admin\AppData\Local\Temp\Bifrost.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\DarkComet.exe
"C:\Users\Admin\AppData\Local\Temp\DarkComet.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\DarkComet.exe" +s +h
4⤵
PID:1760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\DarkComet.exe" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2800

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:748

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1360

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Users\Admin\AppData\Local\Temp\ProRat.exe
"C:\Users\Admin\AppData\Local\Temp\ProRat.exe"
3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\SysWOW64\fservice.exe
C:\Windows\system32\fservice.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\services.exe
C:\Windows\services.exe -XP
5⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\SysWOW64\NET.exe
NET STOP srservice
6⤵
PID:2276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP srservice
7⤵
PID:2936

C:\Windows\SysWOW64\NET.exe
NET STOP navapsvc
6⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP navapsvc
7⤵
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProRat.exe.bat
4⤵
PID:928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bifrost.exe
Filesize
48KB

MD5
00eb83e1bbfa6aec6d1e781a78bc0454

SHA1
a8ccad37a9f10f1d8020cdbc98029795e316d869

SHA256
a8e6e03de4677be7e8f8cf48b42abb3661f206ef26c5986df90813fca101d899

SHA512
20e07ad6c3aab6320311cf30a5b766ecbaafc49b2f76a63d497ec5c5e30da9df440ca37841f6e4242581aece640afd500e70e04649a110451ef4c3e27b689daf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DarkComet.exe
Filesize
660KB

MD5
84df488c078e35518db1fd6c9aa9ba87

SHA1
7119a12be57f669ed9d936294eaa703a89398f48

SHA256
58bee144b8930d90edac006468e5aefa0ecc44319d39cb3a6c9cf7cf13f68ca8

SHA512
e09c90223d4215a44818c9a21aa897e0372dbd63119bd602d38818240bc040c1d93cebd794bb96fed01ff9055ca3a2b2e08c15a23490fc6c263d778f06003a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\PoisonIVY.exe
Filesize
9KB

MD5
2621bf0c4086f801874857ca07eeae8e

SHA1
32ee702ce14d148f58f9344e22a4b8e301e562c5

SHA256
67f4623acc3ff4c84c4456e6f97a66d9ee2a148ce6a1aa1157b0aa362a379765

SHA512
33aa74e279f628711347b6910a343f8aa3a8ed31ef4c3d2e9226f43a8b237e9162e37605d67d89c359c6448e657bb10b9d8defbccf0322a728043708a49fd544

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProRat.exe
Filesize
342KB

MD5
5ac46ad5d65132a31357942360786b2f

SHA1
d8ba1b566f6bd314211feec4c1e2b3c3a2b9cb0a

SHA256
17c96882c2196c97937a7d594c6a43bad447263fe1efb5933c9575361ff98ecb

SHA512
c16957796155dcf64e467f413bfa6b3015a162e6454dfb6628523c0c6bb97deff5703d8616c0c8208123a95739ee9128c96ddf2a7e237a1e05e3a8f6036b5d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProRat.exe.bat
Filesize
129B

MD5
0781898738882613a4fc080c5fd2e0fa

SHA1
189dd18c413f16e9bb91a7fea1418b1e38cf14cf

SHA256
82e7b490e2cac6acded0eb708f6f70d14d7aba0153482f7939b3e1c93fb9ad42

SHA512
31ec42a845ea8065c96d9b3aef81c65d4c5476fd8ecedcfadc18503ad0d2daadc461e9b9f160c4855e1969a2b182dbc12b1ca3190d2f2ee8b47e92fb409d2f35

Download Submit
\Users\Admin\AppData\Local\Temp\SubSeven.exe
Filesize
373KB

MD5
a1f91ceb13bd21061479d9716f63d42d

SHA1
e61ea5d2f230da5750235b1c7ea409393b8486e8

SHA256
cb834303994b8cbc637af4088e3329691581b635dbe78c4f2d4f3ed4cffd3b5e

SHA512
ad52194def19b51a4fd630fe50294b6d73aa0b523cf73f223d117c46af4d8e585eb703d335c826678a5ff87eea4b339469fec30f0f07f492837e98a69424d9b0

Download Submit
\Windows\SysWOW64\reginv.dll
Filesize
36KB

MD5
562e0d01d6571fa2251a1e9f54c6cc69

SHA1
83677ad3bc630aa6327253c7b3deffbd4a8ce905

SHA256
c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

SHA512
166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

Download Submit
\Windows\SysWOW64\winkey.dll
Filesize
13KB

MD5
b4c72da9fd1a0dcb0698b7da97daa0cd

SHA1
b25a79e8ea4c723c58caab83aed6ea48de7ed759

SHA256
45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

SHA512
f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

Download Submit
memory/572-107-0x0000000002FE0000-0x00000000031DC000-memory.dmp

Filesize
2.0MB

Download
memory/572-171-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/572-102-0x0000000002FE0000-0x00000000031DC000-memory.dmp

Filesize
2.0MB

Download
memory/748-144-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1200-155-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1360-156-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1400-43-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1400-58-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2012-80-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2012-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-34-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2012-38-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2360-178-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2360-16-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2448-36-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Filesize
32KB

Download
memory/2448-82-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/2448-35-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Filesize
32KB

Download
memory/2448-72-0x0000000005100000-0x00000000052FC000-memory.dmp

Filesize
2.0MB

Download
memory/2448-14-0x0000000005000000-0x000000000510C000-memory.dmp

Filesize
1.0MB

Download
memory/2448-0-0x00000000748C1000-0x00000000748C2000-memory.dmp

Filesize
4KB

Download
memory/2448-68-0x0000000005100000-0x00000000052FC000-memory.dmp

Filesize
2.0MB

Download
memory/2448-7-0x0000000005000000-0x000000000510C000-memory.dmp

Filesize
1.0MB

Download
memory/2448-2-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/2448-1-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/2496-90-0x00000000030D0000-0x00000000032CC000-memory.dmp

Filesize
2.0MB

Download
memory/2496-174-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2496-96-0x00000000030D0000-0x00000000032CC000-memory.dmp

Filesize
2.0MB

Download
memory/2496-73-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2744-153-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3004-111-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3004-180-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3004-181-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3004-183-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3004-185-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3004-186-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download