Huntress Details Raspberry Robin’s USB Infection Chain and Persistence
Summary
Huntress describes Raspberry Robin’s USB-based infection chain, command variations, and RunOnce persistence, drawing on an August 2023 infection attempt that Microsoft Defender detected and removed before it completed.
Key points
- Raspberry Robin is delivered through an infected USB device; a user must open its Windows shortcut to start the observed infection chain.
- The shortcut launches a command processor and MSIExec, which downloads a remote file. Huntress observed mixed-case commands and whitespace that may be intended to evade detection.
- The malware establishes persistence by recreating a value under the user’s RunOnce Registry key and temporarily renaming the key while writing to it.
- In an August 2023 attempt, Huntress EDR detected the execution pattern, and Microsoft Defender detected and removed the downloaded file as Trojan:Win32/Wacatac.H!ml.
- Huntress found no evidence in endpoint telemetry that RunOnce.exe executed the malware in that attempt; the MSI installation subsequently failed.
- Huntress says the USB device had previously triggered detections for its shortcut file, and the user’s interaction with that shortcut supports USB access as the activation method.
Article Details
- Attack Vectors
- An infected USB device delivers Raspberry Robin; infection requires the user to double-click a Windows shortcut/LNK file.
- The LNK launches a command processor that pipes the contents of a junk file into a command, which launches msiexec.exe to download a remote file.
- Commands have included substantial whitespace, carriage returns, and tabs, which Huntress considered likely intended to evade detection.
- Defensive Notes
- Huntress reports that combining human-managed EDR and antivirus provides detection and response capabilities against Raspberry Robin infections.
- In the reported August 2023 attempt, Huntress EDR telemetry and Microsoft Defender alerts detected the activity; Defender identified and removed the downloaded file before the infection completed.
- Analysts can pivot from antivirus detections to related endpoint events and review the surrounding timeline for additional infection-chain evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 5g7[.]at | Raspberry Robin msiexec command example used to access a remote resource over port 8080. |
| DOMAIN | ejk[.]bz | Raspberry Robin msiexec command example used to access a remote resource over port 8080. |
| DOMAIN | fxb[.]tw | Raspberry Robin msiexec command example used to access a remote resource over port 8080. |
| DOMAIN | jrx[.]fr | Raspberry Robin msiexec command example used to access a remote resource over port 8080. |
| DOMAIN | zjc[.]bz | Raspberry Robin remote download host; Huntress observed the infected USB shortcut use it to download a file. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationHuntress observed commands containing substantial whitespace, carriage returns, and tabs, likely intended to evade detection.T1036 · MasqueradingThe malware temporarily renamed the RunOnce key while writing to it to evade detections.T1059.003 · Windows Command ShellThe LNK command piped junk-file contents into the Windows command processor using cmd or ComSpec.T1091 · Replication Through Removable MediaRaspberry Robin was delivered through an infected USB device connected to the endpoint.T1204.002 · Malicious FileThe infection required the user to double-click a Windows shortcut/LNK file on the USB device.T1218.007 · MsiexecThe infection chain used msiexec.exe to download and install a remote file.T1547.001 · Registry Run Keys / Startup FolderRaspberry Robin established persistence by recreating a value beneath the user's RunOnce Registry key.
Malware
Vendors
HuntressDue to our extensive and diverse customer base, Huntress “sees” a good bit of the same malicious activity others are seeing, albeit often from a slightly different perspective.MicrosoftWhen the “junk” file is processed by the command processor, a Microsoft Installer Executable (MSIExec) command is launched, which downloads a remote file to the endpoint.
Products
Microsoft Defender Antimalware Platformof the infection attempt was observed via detections based on Huntress EDR telemetry and Managed Microsoft Defender alerts. The following table illustrates a timeline excerpt of the events as the infection attemptMicrosoft Windowsfollows what has previously been shared; the user connects the infected USB device and double-clicks the Windows shortcut/LNK file, causing an apparent “junk” file containing an MSIExec command to be launched.