darkcomet | 420aac924ab38220b5cab5fe6eb895a82efae97eab224b79881677c1bdf9dae0

Processes:

img5221.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	img5221.exe

Modifies firewall policy service 3 TTPs 6 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	img5221.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	img5221.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	img5221.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	img5221.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	img5221.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	img5221.exe

Disables RegEdit via registry modification 2 IoCs

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	img5221.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2704 attrib.exe
2724 attrib.exe
Executes dropped EXE 3 IoCs

Processes:

img5221.exemsdcsc.exeimg5221.exe

pid process

2308 img5221.exe
2592 msdcsc.exe
852 img5221.exe
Loads dropped DLL 2 IoCs

Processes:

img5221.exe

pid process

2308 img5221.exe
2308 img5221.exe

pid	process
2704	attrib.exe
2724	attrib.exe

pid	process
2308	img5221.exe
2592	msdcsc.exe
852	img5221.exe

pid	process
2308	img5221.exe
2308	img5221.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	img5221.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	img5221.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exeimg5221.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Live Messenger = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	img5221.exe

Drops file in System32 directory 3 IoCs

Processes:

img5221.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	img5221.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	img5221.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	img5221.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2592 msdcsc.exe

pid	process
2592	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

img5221.exemsdcsc.exeimg5221.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2308	img5221.exe
Token: SeSecurityPrivilege	2308	img5221.exe
Token: SeTakeOwnershipPrivilege	2308	img5221.exe
Token: SeLoadDriverPrivilege	2308	img5221.exe
Token: SeSystemProfilePrivilege	2308	img5221.exe
Token: SeSystemtimePrivilege	2308	img5221.exe
Token: SeProfSingleProcessPrivilege	2308	img5221.exe
Token: SeIncBasePriorityPrivilege	2308	img5221.exe
Token: SeCreatePagefilePrivilege	2308	img5221.exe
Token: SeBackupPrivilege	2308	img5221.exe
Token: SeRestorePrivilege	2308	img5221.exe
Token: SeShutdownPrivilege	2308	img5221.exe
Token: SeDebugPrivilege	2308	img5221.exe
Token: SeSystemEnvironmentPrivilege	2308	img5221.exe
Token: SeChangeNotifyPrivilege	2308	img5221.exe
Token: SeRemoteShutdownPrivilege	2308	img5221.exe
Token: SeUndockPrivilege	2308	img5221.exe
Token: SeManageVolumePrivilege	2308	img5221.exe
Token: SeImpersonatePrivilege	2308	img5221.exe
Token: SeCreateGlobalPrivilege	2308	img5221.exe
Token: 33	2308	img5221.exe
Token: 34	2308	img5221.exe
Token: 35	2308	img5221.exe
Token: SeIncreaseQuotaPrivilege	2592	msdcsc.exe
Token: SeSecurityPrivilege	2592	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2592	msdcsc.exe
Token: SeLoadDriverPrivilege	2592	msdcsc.exe
Token: SeSystemProfilePrivilege	2592	msdcsc.exe
Token: SeSystemtimePrivilege	2592	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2592	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2592	msdcsc.exe
Token: SeCreatePagefilePrivilege	2592	msdcsc.exe
Token: SeBackupPrivilege	2592	msdcsc.exe
Token: SeRestorePrivilege	2592	msdcsc.exe
Token: SeShutdownPrivilege	2592	msdcsc.exe
Token: SeDebugPrivilege	2592	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2592	msdcsc.exe
Token: SeChangeNotifyPrivilege	2592	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2592	msdcsc.exe
Token: SeUndockPrivilege	2592	msdcsc.exe
Token: SeManageVolumePrivilege	2592	msdcsc.exe
Token: SeImpersonatePrivilege	2592	msdcsc.exe
Token: SeCreateGlobalPrivilege	2592	msdcsc.exe
Token: 33	2592	msdcsc.exe
Token: 34	2592	msdcsc.exe
Token: 35	2592	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	852	img5221.exe
Token: SeSecurityPrivilege	852	img5221.exe
Token: SeTakeOwnershipPrivilege	852	img5221.exe
Token: SeLoadDriverPrivilege	852	img5221.exe
Token: SeSystemProfilePrivilege	852	img5221.exe
Token: SeSystemtimePrivilege	852	img5221.exe
Token: SeProfSingleProcessPrivilege	852	img5221.exe
Token: SeIncBasePriorityPrivilege	852	img5221.exe
Token: SeCreatePagefilePrivilege	852	img5221.exe
Token: SeBackupPrivilege	852	img5221.exe
Token: SeRestorePrivilege	852	img5221.exe
Token: SeShutdownPrivilege	852	img5221.exe
Token: SeDebugPrivilege	852	img5221.exe
Token: SeSystemEnvironmentPrivilege	852	img5221.exe
Token: SeChangeNotifyPrivilege	852	img5221.exe
Token: SeRemoteShutdownPrivilege	852	img5221.exe
Token: SeUndockPrivilege	852	img5221.exe
Token: SeManageVolumePrivilege	852	img5221.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2592 msdcsc.exe

pid	process
2592	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exeimg5221.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 2536 wrote to memory of 2308	2536	1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe	img5221.exe
PID 2536 wrote to memory of 2308	2536	1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe	img5221.exe
PID 2536 wrote to memory of 2308	2536	1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe	img5221.exe
PID 2536 wrote to memory of 2308	2536	1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe	img5221.exe
PID 2308 wrote to memory of 2928	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 2928	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 2928	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 2928	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 3012	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 3012	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 3012	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 3012	2308	img5221.exe	cmd.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 2308 wrote to memory of 1272	2308	img5221.exe	notepad.exe
PID 3012 wrote to memory of 2704	3012	cmd.exe	attrib.exe
PID 3012 wrote to memory of 2704	3012	cmd.exe	attrib.exe
PID 3012 wrote to memory of 2704	3012	cmd.exe	attrib.exe
PID 3012 wrote to memory of 2704	3012	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2724	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2724	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2724	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2724	2928	cmd.exe	attrib.exe
PID 2308 wrote to memory of 2592	2308	img5221.exe	msdcsc.exe
PID 2308 wrote to memory of 2592	2308	img5221.exe	msdcsc.exe
PID 2308 wrote to memory of 2592	2308	img5221.exe	msdcsc.exe
PID 2308 wrote to memory of 2592	2308	img5221.exe	msdcsc.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe
PID 2592 wrote to memory of 2468	2592	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 6 IoCs

Modify Registry

Processes:

msdcsc.exeimg5221.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	img5221.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	img5221.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	img5221.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2704 attrib.exe
2724 attrib.exe

pid	process
2704	attrib.exe
2724	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a6031959d62cc35e0c9d95a8eadfa38_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2704

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1272

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2592

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\img5221.exe
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Modify Registry