toxiceye | 2aebd9a1bc61ad562d8f8e1115cf21247281b3f5e5ab41305406c5bdc7c4b0ff

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	eb65763fbd4c28c3afac6d08ab63c318.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	eb65763fbd4c28c3afac6d08ab63c318.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb65763fbd4c28c3afac6d08ab63c318.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb65763fbd4c28c3afac6d08ab63c318.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	eb65763fbd4c28c3afac6d08ab63c318.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	eb65763fbd4c28c3afac6d08ab63c318.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4464	schtasks.exe
2208	schtasks.exe
4876	schtasks.exe
2052	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2944	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4084	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe
"C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
PID:2876
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4735.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe
  "{path}"
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5186.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5186.tmp.bat
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\find.exe
      find ":"
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\tasklist.exe
      Tasklist /fi "PID eq 2436"
      4⤵
      Enumerates processes with tasklist
      PID:4084
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2944
  - - C:\Users\ToxicEye\rat.exe
      "rat.exe"
      4⤵
      PID:3324
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:4876
    - - C:\Users\ToxicEye\rat.exe
        
        "{path}"
        5⤵
        
        PID:444
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2052
    - - C:\Users\ToxicEye\rat.exe
        
        "{path}"
        5⤵
        
        PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

Persistence

Scheduled Task/Job

1

Privilege Escalation

Scheduled Task/Job

1

Defense Evasion

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2