darkcomet | ad89e6e9a9b1c1be2de2e41fec4ac0b8ef10da7bd7bd083415f6b947b727401e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rsbot = "C:\\ProgramData\\rsbotinstall.exe"	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	vbc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	vbc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2564	vbc.exe
Token: SeSecurityPrivilege	2564	vbc.exe
Token: SeTakeOwnershipPrivilege	2564	vbc.exe
Token: SeLoadDriverPrivilege	2564	vbc.exe
Token: SeSystemProfilePrivilege	2564	vbc.exe
Token: SeSystemtimePrivilege	2564	vbc.exe
Token: SeProfSingleProcessPrivilege	2564	vbc.exe
Token: SeIncBasePriorityPrivilege	2564	vbc.exe
Token: SeCreatePagefilePrivilege	2564	vbc.exe
Token: SeBackupPrivilege	2564	vbc.exe
Token: SeRestorePrivilege	2564	vbc.exe
Token: SeShutdownPrivilege	2564	vbc.exe
Token: SeDebugPrivilege	2564	vbc.exe
Token: SeSystemEnvironmentPrivilege	2564	vbc.exe
Token: SeChangeNotifyPrivilege	2564	vbc.exe
Token: SeRemoteShutdownPrivilege	2564	vbc.exe
Token: SeUndockPrivilege	2564	vbc.exe
Token: SeManageVolumePrivilege	2564	vbc.exe
Token: SeImpersonatePrivilege	2564	vbc.exe
Token: SeCreateGlobalPrivilege	2564	vbc.exe
Token: 33	2564	vbc.exe
Token: 34	2564	vbc.exe
Token: 35	2564	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2564	2868	3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f2b4d9c79792ea67a420650f2d01d19_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Windows security bypass
  - Checks BIOS information in registry
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

3

System Information Discovery

3