darkcomet | bb14ef332f01f1db8ce7a225adc9fe5f6ee5c4a6ffd2038478065e270080abad

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe"	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winupdate.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	explorer.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winupdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Executes dropped EXE 4 IoCs

pid	Process
1248	CCSETUP305.EXE
2236	winupdate.exe
2456	winupdate.exe
1768	CCSETUP305.EXE

Loads dropped DLL 28 IoCs

pid	Process
2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
1248	CCSETUP305.EXE
1248	CCSETUP305.EXE
1248	CCSETUP305.EXE
1248	CCSETUP305.EXE
2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
2236	winupdate.exe
2236	winupdate.exe
2236	winupdate.exe
2236	winupdate.exe
2456	winupdate.exe
2456	winupdate.exe
2456	winupdate.exe
304	explorer.exe
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1248	CCSETUP305.EXE
1768	CCSETUP305.EXE
1248	CCSETUP305.EXE
1768	CCSETUP305.EXE
1768	CCSETUP305.EXE
1248	CCSETUP305.EXE
1248	CCSETUP305.EXE

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe"	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 2236 set thread context of 2456	2236	winupdate.exe	35
PID 2456 set thread context of 660	2456	winupdate.exe	36
PID 660 set thread context of 304	660	explorer.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCSETUP305.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCSETUP305.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000016c66-72.dat	nsis_installer_1
behavioral1/files/0x0008000000016c66-72.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
304	explorer.exe
1248	CCSETUP305.EXE
1768	CCSETUP305.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeSecurityPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeBackupPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeRestorePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeDebugPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeUndockPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: 33	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: 34	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: 35	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
Token: SeDebugPrivilege	2236	winupdate.exe
Token: SeIncreaseQuotaPrivilege	2456	winupdate.exe
Token: SeSecurityPrivilege	2456	winupdate.exe
Token: SeTakeOwnershipPrivilege	2456	winupdate.exe
Token: SeLoadDriverPrivilege	2456	winupdate.exe
Token: SeSystemProfilePrivilege	2456	winupdate.exe
Token: SeSystemtimePrivilege	2456	winupdate.exe
Token: SeProfSingleProcessPrivilege	2456	winupdate.exe
Token: SeIncBasePriorityPrivilege	2456	winupdate.exe
Token: SeCreatePagefilePrivilege	2456	winupdate.exe
Token: SeBackupPrivilege	2456	winupdate.exe
Token: SeRestorePrivilege	2456	winupdate.exe
Token: SeShutdownPrivilege	2456	winupdate.exe
Token: SeDebugPrivilege	2456	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2456	winupdate.exe
Token: SeChangeNotifyPrivilege	2456	winupdate.exe
Token: SeRemoteShutdownPrivilege	2456	winupdate.exe
Token: SeUndockPrivilege	2456	winupdate.exe
Token: SeManageVolumePrivilege	2456	winupdate.exe
Token: SeImpersonatePrivilege	2456	winupdate.exe
Token: SeCreateGlobalPrivilege	2456	winupdate.exe
Token: 33	2456	winupdate.exe
Token: 34	2456	winupdate.exe
Token: 35	2456	winupdate.exe
Token: SeRestorePrivilege	2456	winupdate.exe
Token: SeBackupPrivilege	2456	winupdate.exe
Token: SeDebugPrivilege	660	explorer.exe
Token: SeIncreaseQuotaPrivilege	304	explorer.exe
Token: SeSecurityPrivilege	304	explorer.exe
Token: SeTakeOwnershipPrivilege	304	explorer.exe
Token: SeLoadDriverPrivilege	304	explorer.exe
Token: SeSystemProfilePrivilege	304	explorer.exe
Token: SeSystemtimePrivilege	304	explorer.exe
Token: SeProfSingleProcessPrivilege	304	explorer.exe
Token: SeIncBasePriorityPrivilege	304	explorer.exe
Token: SeCreatePagefilePrivilege	304	explorer.exe
Token: SeBackupPrivilege	304	explorer.exe
Token: SeRestorePrivilege	304	explorer.exe
Token: SeShutdownPrivilege	304	explorer.exe
Token: SeDebugPrivilege	304	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
304	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2828	1972	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	30
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 1248	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2336	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	32
PID 2828 wrote to memory of 2336	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	32
PID 2828 wrote to memory of 2336	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	32
PID 2828 wrote to memory of 2336	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	32
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2236	2828	99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe	33
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2236 wrote to memory of 2456	2236	winupdate.exe	35
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 2456 wrote to memory of 660	2456	winupdate.exe	36
PID 660 wrote to memory of 304	660	explorer.exe	37
PID 660 wrote to memory of 304	660	explorer.exe	37
PID 660 wrote to memory of 304	660	explorer.exe	37
PID 660 wrote to memory of 304	660	explorer.exe	37

C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE
    "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1248
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:2336
- - C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
    "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
      "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
      4⤵
      Modifies security service
      Windows security bypass
      Disables RegEdit via registry modification
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:660
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        Modifies security service
        Windows security bypass
        Disables RegEdit via registry modification
        Checks BIOS information in registry
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery