# T1564.006 - Run Virtual Instance

## Description from ATT&CK

> Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.(Citation: CyberCX Akira Ransomware) Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)
> 
> Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).(Citation: Securonix CronTrap 2024) After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020)
> 
> Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of `.wsb` configuration files for defining execution parameters. For example, the `<MappedFolder>` property supports the creation of a shared folder, while the `<LogonCommand>` property allows the specification of a payload.(Citation: ESET MirrorFace 2025)(Citation: ITOCHU Hack the Sandbox)(Citation: ITOCHU Sandbox PPT)
> 
> In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid `.vmx` file with the `/bin/vmx` utility. Adding this command to `/etc/rc.local.d/local.sh` (i.e., [RC Scripts](https://attack.mitre.org/techniques/T1037/004)) will cause the VM to persistently restart.(Citation: vNinja Rogue VMs 2024) Creating a VM this way prevents it from appearing in the vCenter console or in the output to the `vim-cmd vmsvc/getallvms` command on the ESXi server, thereby hiding it from typical administrative activities.(Citation: MITRE VMware Abuse 2024)

[Source](https://attack.mitre.org/techniques/T1564/006)

## Atomic Tests

- [Atomic Test #1: Register Portable Virtualbox](#atomic-test-1-register-portable-virtualbox)
- [Atomic Test #2: Create and start VirtualBox virtual machine](#atomic-test-2-create-and-start-virtualbox-virtual-machine)
- [Atomic Test #3: Create and start Hyper-V virtual machine](#atomic-test-3-create-and-start-hyper-v-virtual-machine)

### Atomic Test #1: Register Portable Virtualbox

ransomware payloads via virtual machines (VM). 
[Maze ransomware](https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/)

**Supported Platforms:** Windows

**auto_generated_guid:** `c59f246a-34f8-4e4d-9276-c295ef9ba0dd`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| msi_file_path | Path to the MSI file | path | PathToAtomicsFolder&#92;T1564.006&#92;bin&#92;Virtualbox_52.msi|
| cab_file_path | Path to the CAB file | path | PathToAtomicsFolder&#92;T1564.006&#92;bin&#92;common.cab|

#### Attack Commands: Run with `command_prompt`!

```cmd
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" /reregserver
regsvr32 /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll"
rundll32 "C:\Program Files\Oracle\VirtualBox\VBoxRT.dll,RTR3Init"
sc create VBoxDRV binpath= "C:\Program Files\Oracle\VirtualBox\drivers\VboxDrv.sys" type= kernel start= auto error= normal displayname= PortableVBoxDRV
sc start VBoxDRV
```

#### Cleanup Commands

```cmd
sc stop VBoxDRV
sc delete VBoxDRV
regsvr32 /u /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll"
msiexec /x "#{msi_file_path}" /qn
```

#### Dependencies: Run with `powershell`!

##### Description: MSI file must exist on disk at specified location (#{msi_file_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{msi_file_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{msi_file_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1564.006/bin/Virtualbox_52.msi" -OutFile "#{msi_file_path}"
```

##### Description: CAB file must exist on disk at specified location (#{cab_file_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{cab_file_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{cab_file_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1564.006/bin/common.cab" -OutFile "#{cab_file_path}"
```

##### Description: Old version of Virtualbox must be installed

###### Check Prereq Commands

```powershell
if (Test-Path "C:\Program Files\Oracle\VirtualBox\VboxC.dll") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
msiexec /i "#{msi_file_path}" /qn
```

### Atomic Test #2: Create and start VirtualBox virtual machine

Create a simple VirtualBox VM and start up the machine
Cleanup command stops and deletes the newly created VM and associated files
https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm
https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
https://attack.mitre.org/techniques/T1564/006/

**Supported Platforms:** Windows

**auto_generated_guid:** `88b81702-a1c0-49a9-95b2-2dd53d755767`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| vm_name | Name of the new virtual machine | string | Atomic VM|
| virtualbox_exe | Path to the VirtualBox executable | path | C:&#92;Program Files&#92;Oracle&#92;VirtualBox&#92;VirtualBox.exe|
| vboxmanage_exe | Path to the executable for VBoxManage, the command-line interface to VirtualBox | path | C:&#92;Program Files&#92;Oracle&#92;VirtualBox&#92;VBoxManage.exe|
| virtualbox_download | URL for the current installer for the Windows version of VirtualBox, as of March 2022 | url | https://download.virtualbox.org/virtualbox/6.1.32/VirtualBox-6.1.32-149290-Win.exe|
| virtualbox_installer | Executable for the Virtualbox installer | string | VirtualBox-6.1.32-149290-Win.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
"#{vboxmanage_exe}" createvm --name "#{vm_name}" --register
"#{vboxmanage_exe}" modifyvm "#{vm_name}" --firmware efi
"#{vboxmanage_exe}" startvm "#{vm_name}"
```

#### Cleanup Commands

```cmd
"#{vboxmanage_exe}" controlvm "#{vm_name}" poweroff
"#{vboxmanage_exe}" unregistervm "#{vm_name}" --delete
```

#### Dependencies: Run with `powershell`!

##### Description: Vi