toxiceye | 2aebd9a1bc61ad562d8f8e1115cf21247281b3f5e5ab41305406c5bdc7c4b0ff

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	rat.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	rat.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rat.exe

Deletes itself 1 IoCs

pid	Process
1368	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2768	rat.exe
588	rat.exe

Loads dropped DLL 6 IoCs

pid	Process
1368	cmd.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	rat.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2768 set thread context of 588	2768	rat.exe	45

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	588	WerFault.exe	45

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2900	schtasks.exe
2700	schtasks.exe
1416	schtasks.exe
1676	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2788	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2268	tasklist.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
588	rat.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
2768	rat.exe
588	rat.exe
588	rat.exe
588	rat.exe
588	rat.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Token: SeDebugPrivilege	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	2768	rat.exe
Token: SeDebugPrivilege	588	rat.exe
Token: SeDebugPrivilege	588	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
588	rat.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2900	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2900	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2900	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2900	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	31
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 2184 wrote to memory of 1660	2184	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2700	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2700	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2700	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2700	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	35
PID 1660 wrote to memory of 1368	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	37
PID 1660 wrote to memory of 1368	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	37
PID 1660 wrote to memory of 1368	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	37
PID 1660 wrote to memory of 1368	1660	eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2268	1368	cmd.exe	39
PID 1368 wrote to memory of 2268	1368	cmd.exe	39
PID 1368 wrote to memory of 2268	1368	cmd.exe	39
PID 1368 wrote to memory of 2268	1368	cmd.exe	39
PID 1368 wrote to memory of 2696	1368	cmd.exe	40
PID 1368 wrote to memory of 2696	1368	cmd.exe	40
PID 1368 wrote to memory of 2696	1368	cmd.exe	40
PID 1368 wrote to memory of 2696	1368	cmd.exe	40
PID 1368 wrote to memory of 2788	1368	cmd.exe	41
PID 1368 wrote to memory of 2788	1368	cmd.exe	41
PID 1368 wrote to memory of 2788	1368	cmd.exe	41
PID 1368 wrote to memory of 2788	1368	cmd.exe	41
PID 1368 wrote to memory of 2768	1368	cmd.exe	42
PID 1368 wrote to memory of 2768	1368	cmd.exe	42
PID 1368 wrote to memory of 2768	1368	cmd.exe	42
PID 1368 wrote to memory of 2768	1368	cmd.exe	42
PID 2768 wrote to memory of 1416	2768	rat.exe	43
PID 2768 wrote to memory of 1416	2768	rat.exe	43
PID 2768 wrote to memory of 1416	2768	rat.exe	43
PID 2768 wrote to memory of 1416	2768	rat.exe	43
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 2768 wrote to memory of 588	2768	rat.exe	45
PID 588 wrote to memory of 1676	588	rat.exe	47
PID 588 wrote to memory of 1676	588	rat.exe	47
PID 588 wrote to memory of 1676	588	rat.exe	47
PID 588 wrote to memory of 1676	588	rat.exe	47
PID 588 wrote to memory of 748	588	rat.exe	49
PID 588 wrote to memory of 748	588	rat.exe	49
PID 588 wrote to memory of 748	588	rat.exe	49
PID 588 wrote to memory of 748	588	rat.exe	49

C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC0D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\eb65763fbd4c28c3afac6d08ab63c318_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF6BE.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF6BE.tmp.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\SysWOW64\tasklist.exe
      Tasklist /fi "PID eq 1660"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\SysWOW64\find.exe
      find ":"
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2788
  - - C:\Users\ToxicEye\rat.exe
      "rat.exe"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Checks BIOS information in registry
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgQtVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA1FA.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:1416
    - - C:\Users\ToxicEye\rat.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:588
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 1736
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion