darkcomet | c633b3dbdbbc413271b097e9b653dcb090a3149554209380afb4d5b8f6c45a23

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\taskhost.exe"	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	taskhost.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	taskhost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhost.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

pid	Process
2860	attrib.exe
3344	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
4388	notepad.exe

Executes dropped EXE 2 IoCs

pid	Process
4544	taskhost.exe
2420	taskhost.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine	taskhost.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	taskhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskhost.exe"	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskhost.exe"	taskhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 4544 set thread context of 2420	4544	taskhost.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	taskhost.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeSecurityPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeBackupPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeRestorePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeShutdownPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeDebugPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeUndockPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: 33	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: 34	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: 35	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: 36	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2420	taskhost.exe
Token: SeSecurityPrivilege	2420	taskhost.exe
Token: SeTakeOwnershipPrivilege	2420	taskhost.exe
Token: SeLoadDriverPrivilege	2420	taskhost.exe
Token: SeSystemProfilePrivilege	2420	taskhost.exe
Token: SeSystemtimePrivilege	2420	taskhost.exe
Token: SeProfSingleProcessPrivilege	2420	taskhost.exe
Token: SeIncBasePriorityPrivilege	2420	taskhost.exe
Token: SeCreatePagefilePrivilege	2420	taskhost.exe
Token: SeBackupPrivilege	2420	taskhost.exe
Token: SeRestorePrivilege	2420	taskhost.exe
Token: SeShutdownPrivilege	2420	taskhost.exe
Token: SeDebugPrivilege	2420	taskhost.exe
Token: SeSystemEnvironmentPrivilege	2420	taskhost.exe
Token: SeChangeNotifyPrivilege	2420	taskhost.exe
Token: SeRemoteShutdownPrivilege	2420	taskhost.exe
Token: SeUndockPrivilege	2420	taskhost.exe
Token: SeManageVolumePrivilege	2420	taskhost.exe
Token: SeImpersonatePrivilege	2420	taskhost.exe
Token: SeCreateGlobalPrivilege	2420	taskhost.exe
Token: 33	2420	taskhost.exe
Token: 34	2420	taskhost.exe
Token: 35	2420	taskhost.exe
Token: 36	2420	taskhost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
4544	taskhost.exe
2420	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3768	1100	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	86
PID 3768 wrote to memory of 1328	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	87
PID 3768 wrote to memory of 1328	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	87
PID 3768 wrote to memory of 1328	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	87
PID 3768 wrote to memory of 2596	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	89
PID 3768 wrote to memory of 2596	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	89
PID 3768 wrote to memory of 2596	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	89
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 3768 wrote to memory of 4388	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	90
PID 1328 wrote to memory of 2860	1328	cmd.exe	93
PID 1328 wrote to memory of 2860	1328	cmd.exe	93
PID 1328 wrote to memory of 2860	1328	cmd.exe	93
PID 2596 wrote to memory of 3344	2596	cmd.exe	94
PID 2596 wrote to memory of 3344	2596	cmd.exe	94
PID 2596 wrote to memory of 3344	2596	cmd.exe	94
PID 3768 wrote to memory of 4544	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	96
PID 3768 wrote to memory of 4544	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	96
PID 3768 wrote to memory of 4544	3768	1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe	96
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 4544 wrote to memory of 2420	4544	taskhost.exe	97
PID 2420 wrote to memory of 1924	2420	taskhost.exe	98
PID 2420 wrote to memory of 1924	2420	taskhost.exe	98
PID 2420 wrote to memory of 1924	2420	taskhost.exe	98
PID 2420 wrote to memory of 1924	2420	taskhost.exe	98

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2860	attrib.exe
3344	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\1fcdd89d72733b81090ba61596f7f29a_JaffaCakes118.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3344
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Deletes itself
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
      C:\Users\Admin\AppData\Local\Temp\taskhost.exe
      4⤵
      Modifies firewall policy service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion