darkcomet | c715fe1061adba1e1737c8302cae544ee820925a5df49f906789b9a4ff86a582

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\svhost.exe"	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

Processes:

explorer.exesvhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	svhost.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

Processes:

svhost.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	explorer.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

svhost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

svhost.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	svhost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	svhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

2100 svhost.exe

pid	process
2100	svhost.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wow gold cheat engine = "C:\\svhost.exe"	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

svhost.exe

description pid process target process

PID 2100 set thread context of 2572 2100 svhost.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2100 set thread context of 2572	2100	svhost.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

explorer.exe873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorer.exe873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	svhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2572 explorer.exe

pid	process
2572	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exeexplorer.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeSecurityPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeBackupPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeRestorePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeShutdownPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeDebugPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeUndockPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: 33	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: 34	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: 35	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2100	svhost.exe
Token: SeSecurityPrivilege	2100	svhost.exe
Token: SeTakeOwnershipPrivilege	2100	svhost.exe
Token: SeLoadDriverPrivilege	2100	svhost.exe
Token: SeSystemProfilePrivilege	2100	svhost.exe
Token: SeSystemtimePrivilege	2100	svhost.exe
Token: SeProfSingleProcessPrivilege	2100	svhost.exe
Token: SeIncBasePriorityPrivilege	2100	svhost.exe
Token: SeCreatePagefilePrivilege	2100	svhost.exe
Token: SeBackupPrivilege	2100	svhost.exe
Token: SeRestorePrivilege	2100	svhost.exe
Token: SeShutdownPrivilege	2100	svhost.exe
Token: SeDebugPrivilege	2100	svhost.exe
Token: SeSystemEnvironmentPrivilege	2100	svhost.exe
Token: SeChangeNotifyPrivilege	2100	svhost.exe
Token: SeRemoteShutdownPrivilege	2100	svhost.exe
Token: SeUndockPrivilege	2100	svhost.exe
Token: SeManageVolumePrivilege	2100	svhost.exe
Token: SeImpersonatePrivilege	2100	svhost.exe
Token: SeCreateGlobalPrivilege	2100	svhost.exe
Token: 33	2100	svhost.exe
Token: 34	2100	svhost.exe
Token: 35	2100	svhost.exe
Token: SeIncreaseQuotaPrivilege	2572	explorer.exe
Token: SeSecurityPrivilege	2572	explorer.exe
Token: SeTakeOwnershipPrivilege	2572	explorer.exe
Token: SeLoadDriverPrivilege	2572	explorer.exe
Token: SeSystemProfilePrivilege	2572	explorer.exe
Token: SeSystemtimePrivilege	2572	explorer.exe
Token: SeProfSingleProcessPrivilege	2572	explorer.exe
Token: SeIncBasePriorityPrivilege	2572	explorer.exe
Token: SeCreatePagefilePrivilege	2572	explorer.exe
Token: SeBackupPrivilege	2572	explorer.exe
Token: SeRestorePrivilege	2572	explorer.exe
Token: SeShutdownPrivilege	2572	explorer.exe
Token: SeDebugPrivilege	2572	explorer.exe
Token: SeSystemEnvironmentPrivilege	2572	explorer.exe
Token: SeChangeNotifyPrivilege	2572	explorer.exe
Token: SeRemoteShutdownPrivilege	2572	explorer.exe
Token: SeUndockPrivilege	2572	explorer.exe
Token: SeManageVolumePrivilege	2572	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

2572 explorer.exe

pid	process
2572	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exesvhost.exe

description	pid	process	target process
PID 2696 wrote to memory of 2768	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	explorer.exe
PID 2696 wrote to memory of 2768	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	explorer.exe
PID 2696 wrote to memory of 2768	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	explorer.exe
PID 2696 wrote to memory of 2768	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	explorer.exe
PID 2696 wrote to memory of 2100	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	svhost.exe
PID 2696 wrote to memory of 2100	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	svhost.exe
PID 2696 wrote to memory of 2100	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	svhost.exe
PID 2696 wrote to memory of 2100	2696	873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe	svhost.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe
PID 2100 wrote to memory of 2572	2100	svhost.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\873bb868e840d34dee619ca7e9026e4c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:2768
- C:\svhost.exe
  "C:\svhost.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Checks BIOS information in registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

3

System Information Discovery

4

System Location Discovery

T1614

System Language Discovery