darkcomet | 8b26857cc0e77a877d255f80ce1f88f57d9067f25895a8cc7783deb4e1d6b9b8

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupt\\winupdate.exe"	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winupdate.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winupdate.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Executes dropped EXE 2 IoCs

pid	Process
2116	winupdate.exe
2604	winupdate.exe

Loads dropped DLL 8 IoCs

pid	Process
2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
2116	winupdate.exe
2116	winupdate.exe
2116	winupdate.exe
2116	winupdate.exe
2604	winupdate.exe
2604	winupdate.exe
2604	winupdate.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupt\\winupdate.exe"	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1892 set thread context of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 2116 set thread context of 2604	2116	winupdate.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	winupdate.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeSecurityPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeBackupPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeRestorePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeShutdownPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeDebugPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeUndockPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: 33	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: 34	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: 35	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2604	winupdate.exe
Token: SeSecurityPrivilege	2604	winupdate.exe
Token: SeTakeOwnershipPrivilege	2604	winupdate.exe
Token: SeLoadDriverPrivilege	2604	winupdate.exe
Token: SeSystemProfilePrivilege	2604	winupdate.exe
Token: SeSystemtimePrivilege	2604	winupdate.exe
Token: SeProfSingleProcessPrivilege	2604	winupdate.exe
Token: SeIncBasePriorityPrivilege	2604	winupdate.exe
Token: SeCreatePagefilePrivilege	2604	winupdate.exe
Token: SeBackupPrivilege	2604	winupdate.exe
Token: SeRestorePrivilege	2604	winupdate.exe
Token: SeShutdownPrivilege	2604	winupdate.exe
Token: SeDebugPrivilege	2604	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2604	winupdate.exe
Token: SeChangeNotifyPrivilege	2604	winupdate.exe
Token: SeRemoteShutdownPrivilege	2604	winupdate.exe
Token: SeUndockPrivilege	2604	winupdate.exe
Token: SeManageVolumePrivilege	2604	winupdate.exe
Token: SeImpersonatePrivilege	2604	winupdate.exe
Token: SeCreateGlobalPrivilege	2604	winupdate.exe
Token: 33	2604	winupdate.exe
Token: 34	2604	winupdate.exe
Token: 35	2604	winupdate.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
2116	winupdate.exe
2604	winupdate.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 1892 wrote to memory of 2752	1892	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	30
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2116	2752	3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32
PID 2116 wrote to memory of 2604	2116	winupdate.exe	32

C:\Users\Admin\AppData\Local\Temp\3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windupt\winupdate.exe
    "C:\Windupt\winupdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windupt\winupdate.exe
      "C:\Windupt\winupdate.exe"
      4⤵
      Modifies security service
      Windows security bypass
      Disables RegEdit via registry modification
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery