darkcomet | 1f4a44b25d0d5200e61ca5dcf37f001e1b3be5a240943b9f8d4f0f702872d272

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-2-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-3-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-6-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-4-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-8-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-7-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-9-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-10-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-12-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-13-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-14-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-15-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-16-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-17-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-18-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-19-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-20-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-21-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-22-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-23-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2900-24-0x0000000000400000-0x00000000004E5000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeSecurityPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeTakeOwnershipPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeLoadDriverPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeSystemProfilePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeSystemtimePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeProfSingleProcessPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeIncBasePriorityPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeCreatePagefilePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeBackupPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeRestorePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeShutdownPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeDebugPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeSystemEnvironmentPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeChangeNotifyPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeRemoteShutdownPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeUndockPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeManageVolumePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeImpersonatePrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: SeCreateGlobalPrivilege	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: 33	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: 34	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: 35	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
Token: 36	2900	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89
PID 3564 wrote to memory of 2900	3564	JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b.exe"
  2⤵
  - Modifies firewall policy service
  - Checks BIOS information in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

3

System Information Discovery

3

System Location Discovery

T1614

System Language Discovery