darkcomet | ea5e639ef06bcff8254461d10f414b4431d946a419a9497ec793bbe0f3cf6c6b

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Windupdt\\winupdate2.exe"	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winupdate2.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate2.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winupdate2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4256	winupdate2.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater2 = "C:\\Windows\\Windupdt\\winupdate2.exe"	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Windupdt\winupdate2.exe	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
File opened for modification	C:\Windows\Windupdt\winupdate2.exe	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
File opened for modification	C:\Windows\Windupdt\	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2016	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeSecurityPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeBackupPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeRestorePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeShutdownPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeDebugPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeUndockPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: 33	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: 34	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: 35	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: 36	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4256	winupdate2.exe
Token: SeSecurityPrivilege	4256	winupdate2.exe
Token: SeTakeOwnershipPrivilege	4256	winupdate2.exe
Token: SeLoadDriverPrivilege	4256	winupdate2.exe
Token: SeSystemProfilePrivilege	4256	winupdate2.exe
Token: SeSystemtimePrivilege	4256	winupdate2.exe
Token: SeProfSingleProcessPrivilege	4256	winupdate2.exe
Token: SeIncBasePriorityPrivilege	4256	winupdate2.exe
Token: SeCreatePagefilePrivilege	4256	winupdate2.exe
Token: SeBackupPrivilege	4256	winupdate2.exe
Token: SeRestorePrivilege	4256	winupdate2.exe
Token: SeShutdownPrivilege	4256	winupdate2.exe
Token: SeDebugPrivilege	4256	winupdate2.exe
Token: SeSystemEnvironmentPrivilege	4256	winupdate2.exe
Token: SeChangeNotifyPrivilege	4256	winupdate2.exe
Token: SeRemoteShutdownPrivilege	4256	winupdate2.exe
Token: SeUndockPrivilege	4256	winupdate2.exe
Token: SeManageVolumePrivilege	4256	winupdate2.exe
Token: SeImpersonatePrivilege	4256	winupdate2.exe
Token: SeCreateGlobalPrivilege	4256	winupdate2.exe
Token: 33	4256	winupdate2.exe
Token: 34	4256	winupdate2.exe
Token: 35	4256	winupdate2.exe
Token: 36	4256	winupdate2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4256	winupdate2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4256	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	86
PID 4124 wrote to memory of 4256	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	86
PID 4124 wrote to memory of 4256	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	86
PID 4124 wrote to memory of 1976	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	87
PID 4124 wrote to memory of 1976	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	87
PID 4124 wrote to memory of 1976	4124	45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe	87
PID 1976 wrote to memory of 2016	1976	cmd.exe	89
PID 1976 wrote to memory of 2016	1976	cmd.exe	89
PID 1976 wrote to memory of 2016	1976	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45a1d786e18711b3892307b94c3ce170_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\Windupdt\winupdate2.exe
  "C:\Windows\Windupdt\winupdate2.exe"
  2⤵
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Windows security modification
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery