HALFBAKED

Executive Summary

HALFBAKED is a Windows‑based RAT used by the FIN7 group to establish persistent footholds through registry run keys, scheduled tasks, and hidden services. The malware provides a full post‑exploitation toolkit—including keylogging, credential dumping, and lateral movement—while communicating over a custom HTTP/HTTPS C2 channel.

HALFBAKED is a modular Windows‑based malware family first identified in an April 2017 report by FireEye as part of the FIN7 campaign. The family contains several components that work together to establish and maintain persistence on compromised networks. A lightweight loader infects target machines and then installs hidden services or creates disguised processes to remain active after reboots. Persistence is achieved through multiple classic Windows techniques, including registry Run keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run), scheduled tasks, and the creation of system-level services that register themselves on startup. The malware communicates with threat‑actors over a custom HTTP/HTTPS C2 channel, often embedding commands within seemingly benign traffic to avoid detection. The payload is designed for full post‑exploitation functionality: it logs keystrokes and captures screenshots, performs credential dumping (often via bundled Mimikatz modules), and can exploit SMB or pass‑the‑hash techniques to move laterally across domains. Collected data—including credentials, files, and system information—is exfiltrated over encrypted tunnels back to the operator’s infrastructure. Each installation is often customized with additional modules tailored to its target environment. In sum, HALFBAKED represents a sophisticated, modular tool in FIN7’s offensive arsenal that blends persistence, reconnaissance, credential theft, and lateral movement into a single, stealthy package.

Key Capabilities

• Creates or modifies registry Run keys for persistence
• Utilizes Windows scheduled tasks to maintain presence
• Installs hidden or disguised system services to avoid detection
• Communicates with threat actors via custom HTTPS C2 channels
• Provides remote command execution capabilities
• Logs keystrokes and captures screenshots
• Integrates Mimikatz for credential dumping
• Performs lateral movement across domains using SMB and pass‑the‑hash techniques
• Exfiltrates collected data through encrypted tunnels

ATT&CK Techniques

Recommended Actions

• Block outbound traffic to known HALFBAKED C2 IPs and domains
• Monitor registry Run key changes (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled task creation
• Deploy host‑based intrusion detection for anomalous PowerShell or hidden service activity
• Implement least privilege by restricting admin account usage, enforce multi‑factor authentication
• Regularly patch Windows components to mitigate exploitation of known vulnerabilities
• Analyze network traffic for patterns consistent with custom HTTPS C2 commands
• Utilize endpoint detection & response solutions capable of detecting keylogging and credential dumping

Suggested Tags