toxiceye | 2aebd9a1bc61ad562d8f8e1115cf21247281b3f5e5ab41305406c5bdc7c4b0ff

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	eb65763fbd4c28c3afac6d08ab63c318.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	eb65763fbd4c28c3afac6d08ab63c318.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb65763fbd4c28c3afac6d08ab63c318.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb65763fbd4c28c3afac6d08ab63c318.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	eb65763fbd4c28c3afac6d08ab63c318.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	eb65763fbd4c28c3afac6d08ab63c318.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	564	WerFault.exe	44

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
540	schtasks.exe
1776	schtasks.exe
1568	schtasks.exe
2636	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1756	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1328	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe
"C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
PID:1404
- C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318.exe
  "{path}"
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB70F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpB70F.tmp.bat
    3⤵
    PID:2832
  - - C:\Users\ToxicEye\rat.exe
      "rat.exe"
      4⤵
      PID:1824
    - - C:\Users\ToxicEye\rat.exe
        
        "{path}"
        5⤵
        
        PID:564
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1680
        6⤵
        Program crash
        
        PID:1012
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F01.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:540
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2DB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1568

C:\Windows\SysWOW64\find.exe
find ":"
1⤵
PID:1072

C:\Windows\SysWOW64\timeout.exe
Timeout /T 1 /Nobreak
1⤵
- Delays execution with timeout.exe
PID:1756

C:\Windows\SysWOW64\tasklist.exe
Tasklist /fi "PID eq 2744"
1⤵
- Enumerates processes with tasklist
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

Persistence

Scheduled Task/Job

1

Privilege Escalation

Scheduled Task/Job

1

Defense Evasion

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2