ratonrat | bb16f0869b3244e5d9963accd9bcf2e19bf2f64aa5a946c817138dc5e159fc9f

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware	HELLA TUFF COMBLOX SCRIPT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	HELLA TUFF COMBLOX SCRIPT.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4"	HELLA TUFF COMBLOX SCRIPT.exe

Renames multiple (136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
256	powershell.exe
256	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1992	HELLA TUFF COMBLOX SCRIPT.exe
3000	HELLA TUFF COMBLOX SCRIPT.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4"	HELLA TUFF COMBLOX SCRIPT.exe

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe
File created	C:\Users\Admin\Documents\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe
File created	C:\Users\Admin\Downloads\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe
File created	C:\Users\Admin\Music\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe
File created	C:\Users\Admin\Pictures\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe
File created	C:\Users\Admin\Videos\desktop.ini	HELLA TUFF COMBLOX SCRIPT.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\wallpaper.jpg"	HELLA TUFF COMBLOX SCRIPT.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c520-10.dat	costura

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4356	cmd.exe
3024	cmd.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2408	timeout.exe
3336	timeout.exe
5308	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
256	powershell.exe
256	powershell.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe
1992	HELLA TUFF COMBLOX SCRIPT.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	HELLA TUFF COMBLOX SCRIPT.exe
Token: SeDebugPrivilege	1992	HELLA TUFF COMBLOX SCRIPT.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeIncreaseQuotaPrivilege	256	powershell.exe
Token: SeSecurityPrivilege	256	powershell.exe
Token: SeTakeOwnershipPrivilege	256	powershell.exe
Token: SeLoadDriverPrivilege	256	powershell.exe
Token: SeSystemProfilePrivilege	256	powershell.exe
Token: SeSystemtimePrivilege	256	powershell.exe
Token: SeProfSingleProcessPrivilege	256	powershell.exe
Token: SeIncBasePriorityPrivilege	256	powershell.exe
Token: SeCreatePagefilePrivilege	256	powershell.exe
Token: SeBackupPrivilege	256	powershell.exe
Token: SeRestorePrivilege	256	powershell.exe
Token: SeShutdownPrivilege	256	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeSystemEnvironmentPrivilege	256	powershell.exe
Token: SeRemoteShutdownPrivilege	256	powershell.exe
Token: SeUndockPrivilege	256	powershell.exe
Token: SeManageVolumePrivilege	256	powershell.exe
Token: 33	256	powershell.exe
Token: 34	256	powershell.exe
Token: 35	256	powershell.exe
Token: 36	256	powershell.exe
Token: SeTakeOwnershipPrivilege	1992	HELLA TUFF COMBLOX SCRIPT.exe
Token: SeRestorePrivilege	1992	HELLA TUFF COMBLOX SCRIPT.exe
Token: SeSecurityPrivilege	1992	HELLA TUFF COMBLOX SCRIPT.exe
Token: 33	5716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5716	AUDIODG.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4356	824	HELLA TUFF COMBLOX SCRIPT.exe	89
PID 4356 wrote to memory of 1072	4356	cmd.exe	91
PID 4356 wrote to memory of 2408	4356	cmd.exe	92
PID 4356 wrote to memory of 1992	4356	cmd.exe	93
PID 4356 wrote to memory of 3336	4356	cmd.exe	94
PID 1992 wrote to memory of 1180	1992	HELLA TUFF COMBLOX SCRIPT.exe	95
PID 1992 wrote to memory of 256	1992	HELLA TUFF COMBLOX SCRIPT.exe	99
PID 1992 wrote to memory of 3024	1992	HELLA TUFF COMBLOX SCRIPT.exe	107
PID 3024 wrote to memory of 5308	3024	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HELLA TUFF COMBLOX SCRIPT.exe
"C:\Users\Admin\AppData\Local\Temp\HELLA TUFF COMBLOX SCRIPT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_Gqq4EjUcFWcD2gdC911BOzZZ7Gl71q.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1072
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2408
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender TamperProtection settings
    - Executes dropped EXE
    - Windows security modification
    - Drops desktop.ini file(s)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "HELLA TUFF COMBLOX SCRIPT" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C81.tmp.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5308
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3336

C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe"
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004A8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry