QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL, depending on the malware sample. Then the service is created for the service dll. Service names also can differ from version to version; we discovered the following names — DriverManage, WebService and WebClientManager. These functions assure malware persistence in a compromised OS between system reboots.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1543: Create or Modify System Process
- T1569.002: System Services - Service Execution
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: 
After executing all the commands given by the server, the bot sends a new request to the server. This request contains a complete log of executed commands. If any of the commands require the bot to send data to the server (i.e., SONIA), they are sent in separate HTTP requests preceding the log request. These requests can also be redirected do a different C&C, if specified in the command parameters.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
- T1071: Application Layer Protocol
- T1071.001: Application Layer Protocol - Web Protocols
- T1008: Fallback Channels
- T1020: Automated Exfiltration
- T1119: Automated Collection
Threat description: 
In a 2021 campaign, two weeks after PROPHET SPIDER ceased interactive operations, an unattributed actor downloaded a Cobalt Strike stager DLL from a remote IP address. When run with the argument 11985756, the DLL downloaded a Cobalt Strike payload. The adversary used ADFind to enumerate Active Directory, then moved laterally, using a compromised administrative account, and downloading additional Cobalt Strike Beacon payloads onto some systems, or using PSExec to run Cobalt Strike. The adversary further used PowerSploit to enumerate the victim environment. Before deploying ransomware, the adversary staged data in ZIP archives and likely exfiltrated these archives. Batch scripts subsequently deployed MountLocker across the victim environment.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1570: Lateral Tool Transfer
- T1074: Data Staged
- T1059: Command and Scripting Interpreter
- T1005: Data from Local System
- T1078.002: Valid Accounts - Domain Accounts
Threat description: 
On April 24, 2017, a fourth IP address, this one apparently in the United States, issued 61 commands to the TwoFace webshell. Like the previous set of commands issued in March 2017 from France, this IP address issued the command to obtain objects in the Exchange Trusted Subsystem group, and it appears the actor copied over yet another webshell named “global.aspx” and set the file’s attributes to be hidden using the following command:
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
- T1105: Ingress Tool Transfer
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: 
Out of all the modules used in this attack, Filesystem.dll might be the only one whose code was actually written by the attackers themselves. The purpose of this module is to enumerate drives, folders and files on the infected system and write the final results to two text files: Drives.txt and Files.txt.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
- T1074.001: Data Staged - Local Data Staging
Threat description: 
The hooking of IofCallDriver is implemented in a relatively unconventional way. The hook unwinds the execution stack; if it finds any driver in the stack which is not in the rootkit’s allowlist, and that driver attempts to read certain files, a fake “reading successful” status is returned. However, the file is not actually read.
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1014: Rootkit
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
This attacker utilized an additional keylogging utility named C:\ProgramData\psh\console.exe. The keylogging utility was configured to capture and record keystrokes to C:\ProgramData\psh\System32Log.txt.
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1056.001: Input Capture - Keylogging
- T1074.001: Data Staged - Local Data Staging
- T1074: Data Staged
Threat description: 
Our Ramnit sample exploits both CVE-2013-3660 (by PlayBit) and CVE-2014-4113 (using the same exploit code originally found as a 0-Day). The original exploit for CVE-2014-4113 was part of an exploit framework in which the API passes a command-line argument, and that command is executed as SYSTEM. As that wasn’t the original API for PlayBit’s exploit, some adjustments were made and PlayBit’s exploits were re-adjusted to receive a command-line argument to be executed once elevated.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1203: Exploitation for Client Execution
Threat description: 
This attack consisted of maldocs masquerading as internal government or military documents. For example, some of the maldocs discovered by Talos masquerade as Indian Air Publications (IAP) documents dictating safeguard procedures for the IT infrastructure of the Indian Air Force (IAF). These documents are aptly named:
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
Mandiant observed this attacker dump the LSASS process using Task Manager to a file named lsass.DMP, and later, zip the dump into two files named lsass.zip and lsass2.zip located in the C:\ProgramData\psh\ directory.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
- T1560: Archive Collected Data
- T1003: OS Credential Dumping
- T1074.001: Data Staged - Local Data Staging
- T1074: Data Staged
- T1560.001: Archive Collected Data - Archive via Utility
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: 
The main payload is encrypted and packed inside the .tls section of the second stage injector. It first gets decrypted and then unpacked with the aPLib compression library. As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it. The second stage injector injects the main payload inside a x86 instance of svchost and patches its API function calls with an obfuscation technique to make static and dynamic analysis of the malware more difficult.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1027.002: Obfuscated Files or Information - Software Packing
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1055: Process Injection
- T1036: Masquerading
- T1055.012: Process Injection - Process Hollowing
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
After the bootstrap is finished, the exploit triggers a call to the NtGdiBitBlt syscall. This initiates a chain of events in the Windows kernel and eventually passes the flow back to our user-mode callback (DrvBitBlt()) registered by our UMPD. Here lies the heart of the exploit.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1106: Native API
Threat description: 
The smartpss.exe file contained metadata describing itself as MSHTA.exe from Microsoft, a legitimate operating system component, but the MD5 hash was unknown. Disassembly analysis of the program showed it was a small application that loaded the IE COM object and launched the function RunHTMLApplication() against the command line argument provided. This functionality matched the behavior of the legitimate MSHTA.exe despite the hash discrepancy. Further analysis showed that the malware was based on a 2018 version of the binary (original hash: 5ced5d5b469724d9992f5e8117ecefb5) with only six bytes of data appended, as shown in Figure 4.
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1218.005: System Binary Proxy Execution - Mshta
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: 
In this sense, APT3 crafted its own exploit from other exploits – a tactic very similar to one used by the Equation group. As this threat group also uses the name UPS team, we decided to name their version of the exploit bundle UPSynergy.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1588.005: Obtain Capabilities - Exploits
- T1587.004: Develop Capabilities - Exploits
Threat description: 
When initiated, the Python code attempts to retrieve and use SOCKS/HTTP proxy settings from the victim’s computer. The Python code then tries to initiate a reverse connection to the C2 server (139.59.46[.]154:3543) using a TCP protocol with RSA+AES traffic encryption and obfs3 transport using default keys from Pupy sources.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1095: Non-Application Layer Protocol
- T1090: Proxy
- T1573.001: Encrypted Channel - Symmetric Cryptography
- T1571: Non-Standard Port
- T1090.001: Proxy - Internal Proxy
- T1001: Data Obfuscation
Threat description: 
Ryuk uses a rather basic injection technique, whereby it first gets a handle on the target process using OpenProcess and allocates a buffer in its address space using VirtualAllocEx. The allocated buffer would have the size of the malware’s image and would be required to be positioned at the same base address.
MITRE ATT&CK techniques:
- T1106: Native API
- T1055: Process Injection
- T1055.002: Process Injection - Portable Executable Injection
Threat description: 
The most recent change to the argos-tracking.co[.]uk domain was on the 22nd February 2017 to suspend it. This example highlights the lengths the actors will go to in their reconnaissance of their victims in order to increase their changes of successful compromise.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: 
When Gauss infects an USB memory stick, it sets a certain flag to 30. This TTL (time to live) flag is decremented every time the payload is executed from the stick. Once it reaches 0, the data stealing payload cleans itself from the USB stick. This makes sure that sticks with Gauss infections do not survive ItW for long enough to results in detection.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
- T1070.004: Indicator Removal - File Deletion
- T1052.001: Exfiltration Over Physical Medium - Exfiltration over USB
- T1052: Exfiltration Over Physical Medium
Threat description: 
Remcos is a RAT that is offered for sale by a company called Breaking Security. While the company says it will only sell the software for legitimate uses as described in comments in response to the article here and will revoke the licenses for users not following their EULA, the sale of the RAT gives attackers everything they need to establish and run a potentially illegal botnet. Remcos has the functionalities that are typical of a RAT. It is capable of hiding in the system and using malware techniques that make it difficult for the typical user to detect the existence of Remcos. It is written in C++ and is relatively small for the rich functionality it contains. The Remcos payload included by the PowerShell loader is the latest version 2.5.0. Talos has created a decoder that allows simple extraction of Remcos configurations. Cisco Umbrella shows an increase in requests for the default C2 domain dfgdgertdvdf.xyz of the sample around the time we found the initial PowerShell loader. DNS activity for the default C2 domain of the Remcos payload.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
USB Worm -> this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
- T1105: Ingress Tool Transfer
- T1025: Data from Removable Media
- T1570: Lateral Tool Transfer
- T1005: Data from Local System
Threat description: 
The second file is downloaded from hxxp://checkin.travelsanignacio[.]com/static/20160204.jpg. The C2 response is RC5 decrypted with the key “wsprintfA” and then XORed with 0x74, before it is saved as C:\Windows\System32\wcnapi.mui.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1573: Encrypted Channel
- T1036: Masquerading
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1001: Data Obfuscation
Threat description: 
The embedded SWF decrypted contains ActionScript that attempts to exploit a vulnerability. The purpose of aforementioned version check is to make sure that the correct malicious ActionScript is executed to exploit a vulnerability that the Flash player is vulnerable to. Table 1 shows the range of Flash player versions within DealersChoice.A, the embedded SWF file loaded and the associated vulnerability exploited by the loaded SWF.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: 
The cheat sheet includes examples of commands needed for persistence, network reconnaissance, pivoting, credential dumping, general system and network data gathering, as well as data exfiltration and commands to configure the system to allow remote desktop protocol (RDP) sessions. The commands provide insight into the techniques the actors will use after compromising a system, as well as the tools used to achieve their objectives. The commands also suggest that the threat group heavily relies on RDP to interact with compromised hosts, likely using secure shell (SSH) tunnels created with the Plink tool between the infected system and an actor-controlled domain. Also, the command examples show the threat group seeks to move across an infiltrated network to target additional devices, making it a greater threat to organizations once infected. According to these commands, the actor would likely make these pivots to other systems by performing credential dumping from the Windows registry and process memory.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1021.001: Remote Services - Remote Desktop Protocol
- T1570: Lateral Tool Transfer
- T1018: Remote System Discovery
- T1021: Remote Services
- T1049: System Network Connections Discovery
- T1041: Exfiltration Over C2 Channel
- T1021.004: Remote Services - SSH
- T1016: System Network Configuration Discovery
Threat description: 
Cisco Talos has observed a new malware campaign operated by the Kimsuky APT group since June 2021. Kimsuky, also known as Thallium and Black Banshee, is a North Korean state-sponsored advanced persistent threat (APT) group active since 2012. This campaign utilizes malicious blogs hosted on Blogspot to deliver three types of preliminary malicious content: beacons, file exfiltrators and implant deployment scripts. The implant deployment scripts, in turn, can infect the endpoint with additional implants such as system information-stealers, keyloggers and credential stealers. These implants are derivatives of the Gold Dragon/Brave Prince family of malware operated by Kimsuky since at least 2017 — now forked into three separate modules. This campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1189: Drive-by Compromise
Threat description: 
Nemucod malware is mostly deployed using weaponized documents where the malicious VBA macro code is responsible for constructing and executing a malicious encoded JScript file that carries out further activities including registering victims with the actors before downloading payloads, which in this case included a credential stealing Trojan executable component.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1059: Command and Scripting Interpreter
- T1204.002: User Execution - Malicious File
- T1059.005: Command and Scripting Interpreter - Visual Basic
- T1059.007: Command and Scripting Interpreter - JavaScript
- T1587.001: Develop Capabilities - Malware
Threat description: 
Unlike previously identified RedDelta PlugX samples, this one uses a legitimate Avast Proxy executable for the second DLL side-loading phase rather than the legitimate Adobe executable used in previously analyzed samples. When loaded into memory, the PlugX payload uses www.systeminfor[.]com for command and control — the same domain used across the Catholic church-themed PlugX samples. Across all four newly analyzed samples, the first stage DLL loader files share an identical, uncommon import hash and rich header with previously observed first stage RedDelta PlugX DLLs. The loaded PlugX payload also matches the custom RedDelta PlugX variant previously described, using RC4 encryption for C2 communications with the same hardcoded RC4 passphrase and configuration block decoding function.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1036: Masquerading
- T1104: Multi-Stage Channels
Threat description: 
The TwoFace loader parses the HTTP POST requests issued by the actor and references data at specific locations, more specifically at certain indexes within the posted data (C# “Request.Forms”) that the shell will use to determine the functionality the actor wishes to execute. While we did not have logs of HTTP requests for the loader shell, we were able to determine some of the indexes that the webshell will specifically access within the data. Table 2 shows the known indexes within the HTTP POST data that TwoFace references.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1071.001: Application Layer Protocol - Web Protocols
- T1105: Ingress Tool Transfer
Threat description: 
The attack itself is performed in an infinite loop. The IP addresses used for scanning are generated randomly using the rand() function and the GetTickCount() results as a random seed. The only filter rule for an IP address is that it cannot start with 127, 172 or 192. A separate thread is created to communicate with each IP address.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
- T1106: Native API
Threat description: 
In addition, DoppelPaymer is designed to run only after a specific command line argument is provided. The malware computes a CRC32 checksum of the first argument passed on the command line and adds it with a constant value that is hard-coded in the binary. The malware then adds the instruction pointer address to this result, which becomes the destination for a jmp used to continue the malware execution. The hard-coded constant value is unique to each build. In the sampled analyzed, this value was 0x672e6eb7, as shown below in Figure 6.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: 
In February 2019, Unit 42 found that a yet-to-be-known threat actor — unbeknownst to the infosec community — discovered that the second unpatched vulnerability can not only exploit VirtualBox VBoxDrv.sys driver v1.6.2, but also all other versions up to v3.0.0. Furthermore, our research shows that this unknown actor exploited VirtualBox driver version 2.2.0 to target at least two different Russian organizations in 2017, which we are revealing for the first time. We anticipate this was done because the driver version 2.2.0 wasn’t known to be vulnerable and thus most likely is not on the radar of security companies being exploited. Since no other victims have been found, we believe this is a very rare malware used in targeted attacks only.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1203: Exploitation for Client Execution
- T1588.006: Obtain Capabilities - Vulnerabilities
- T1211: Exploitation for Defense Evasion
- T1588.005: Obtain Capabilities - Exploits
Threat description: 
2.      The “set key” handler is used for accepting the victim ID, a random string with six characters, assigned by the C&C server. It will be attached in each of commands sent from the server and will also be used as the folder name on a cloud storage service to save the stolen data. The victim ID will be stored in the “bps.key” file.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
Threat description: 
The ultimate purpose of the aforementioned components is to install and execute the Komplex payload. The dropper component saves the payload to “/Users/Shared/.local/kextd” (SHA256: 227b7fe495ad9951aebf0aae3c317c1ac526cdd255953f111341b0b11be3bbc5) and ultimately executes the payload. The payload begins by conducting an anti-debugging check to see if it is being debugged before proceeding with executing its main functionality, which can be seen in the “AmIBeingDebugged” function in Figure 6. The “AmIBeingDebugged” function uses the “sysctl” function to check to see if a specific “P_TRACED” flag is set, which signifies that the process is being debugged. A particularly interesting part of this function is that it is very similar to the function provided by Apple to its developers in a guide created in 2004 titled “Detecting the Debugger”. This is not the first time the Sofacy group’s malware authors have obtained techniques from publicly available sources, as demonstrated in the use of the Office Test Persistence Method that they obtained from a blog posted in 2014.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
- T1622: Debugger Evasion
Threat description: 
Afterwards, it uses CreateServiceA to add svchost.exe as a service named “EYService”, and it will then start the service and exit. This service, as we will explain soon, is the core component in the flow and is responsible for processing the commands sent by the attacker.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
- T1106: Native API
- T1543: Create or Modify System Process
- T1569: System Services
Threat description: 
In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme. The campaign appears highly targeted and delivers a backdoor we have called ‘Helminth’. Over the course of the attack campaign, we have observed two different variations of the Helminth backdoor, one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1566.002: Phishing - Spearphishing Link
- T1566: Phishing
- T1566.001: Phishing - Spearphishing Attachment
- T1598.001: Phishing for Information - Spearphishing Service
- T1036: Masquerading
Threat description: 
Aro.dat is, in fact, an encrypted and compressed PlugX payload. The decryption routine within Aro.dat closely resembles that of older PlugX variants (see Figure 3 below) in that it involves multiple decryption keys and bit shift operations. Once decrypted, it gets decompressed via the Windows API RtlDecompressBuffer into a Windows module (DLL). The compression algorithm is LZ compression (COMPRESSION_FORMAT_LZNT1).
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1106: Native API
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
The two variants of Helminth do require different delivery methods, with the script variant relying on an Excel spreadsheet for delivery, while the executable variant is more traditional in the fact that it can be installed without a delivery document. We speculate that the executable variant involves threat actors socially engineering the victim into running the payload, rather than installing the payload as the result of successful exploitation of a vulnerability. The multiple delivery methods suggest this threat group is capable of adapting their procedures to suit the current operation in the overarching campaign.
MITRE ATT&CK techniques:
- T1204: User Execution
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: 
We observed another campaign targeting an organisation located in Lebanon. While our first case describes a targeted campaign with the goal to exfiltrate data affecting internal servers, this one is the opposite: an auxiliary public web site compromised by several attackers for different purposes. We identified actors trying to deploy ransomware on the vulnerable server using China Chopper. The first attempt was Sodinokibi ransomware:
MITRE ATT&CK techniques:
- T1102: Web Service
- T1584.006: Compromise Infrastructure - Web Services
- T1584.004: Compromise Infrastructure - Server
Threat description: 
While investigating the activity, we found a CASHY200 PowerShell-based payload that communicated with windows64x[.]com. We analyzed this PowerShell script and found that its DNS tunneling protocol matched the outbound DNS requests at the Kuwait organization which were blocked by DNS Security. We will provide an analysis of CASHY200 and its DNS tunneling protocol in a later section of this blog.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
- T1572: Protocol Tunneling
- T1583.002: Acquire Infrastructure - DNS Server
- T1059: Command and Scripting Interpreter
Threat description: 
While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: 
This artifact is interesting as the shellcode executed relies on Windows APIs and the payload installed is a Windows DLL that would not run on OSX. This flag does suggest that the threat actors do consider the OSX operating system when developing their malicious exploit code in cross platform file types, such as Flash SWF files. While we cannot confirm this, it is possible that the threat actors could use DealersChoice.A to exploit and load an OSX Trojan if prepared with the appropriate shellcode.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: 
Since PROPHET SPIDER gains access via web servers or other public-facing servers, they will often initially compromise a Linux-based system. Once initial access is obtained on a Linux system, PROPHET SPIDER typically deploys a webshell, reverse shell binary or a perl reverse shell script (commonly named bc.pl) as their initial persistence mechanism.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
- T1059: Command and Scripting Interpreter
- T1059.004: Command and Scripting Interpreter - Unix Shell
- T1190: Exploit Public-Facing Application
Threat description: 
The execution of the modified Mshta file resulted in the creation of a HTM file called loubSi78Vgb9[1].htm that was written to a temporary INetCache directory. Mandiant was not able to acquire this file at the time of writing; however, Mandiant was able to recover partial contents of the file.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: 
In this blog we show that CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access. “EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1587.004: Develop Capabilities - Exploits
- T1588.005: Obtain Capabilities - Exploits
Threat description: 
Now that we have the decrypted AES key, we can decrypt the actual payload. The Flash downloader uses a custom initialization vector (IV) for the AES algorithm which can be found at offset 0x44 in the encrypted blob and is 16 bytes long:
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
The BackConfig custom trojan has a flexible plug-in architecture for components offering various features, including the ability to gather system and keylog information and to upload and execute additional payloads.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1082: System Information Discovery
- T1119: Automated Collection
Threat description: 
Managed Defense, utilizing FireEye Endpoint Security technology, detected and responded to the threat activity identified within the customer’s environment. The subsequent investigation revealed FIN6 was in the initial phase of an intrusion using stolen credentials, Cobalt Strike, Metasploit, and publicly available tools such as Adfind and 7-Zip to conduct internal reconnaissance, compress data, and aid their overall mission.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1078: Valid Accounts
Threat description: 
Once the decrypted payload runs in memory, it exhibits the same behaviors as previous PlugX implant variants. It starts by decrypting the embedded PlugX hardcoded configuration settings. The decryption algorithm and XOR keys are fairly consistent across multiple PlugX implants. Code behavior closely resembles that of the RedDelta PlugX that’s been reported by Insikt Group. One noticeable difference with this sample compared to all the other known PlugX malware families is the magic number check performed during the initialization of the PlugX plugins. Historically, that number has always been 0x504C5547, which corresponds to the PLUG value in ASCII encoding. In this sample, the magic number is 0x54484F52, corresponding to the THOR value in ASCII encoding.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
DeathStalker hides strings in Word embedded shape and object (OLE packages) properties, like the “hyperlink” property, to obfuscate the malicious execution workflow, as well as reconstruct and execute commands or scripts.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1036: Masquerading
Threat description: 
We confirmed RGDoor installed correctly into IIS by checking the HTTP Modules display in IIS Manager. Figure 2 shows the RGDoor DLL (HTTPParser.dll) was loaded into IIS using the module name HTTPParser.
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1505.004: Server Software Component - IIS Components
Threat description: 
Unlike the common ransomware, systematically distributed via massive spam campaigns and exploit kits, Ryuk is used exclusively for tailored attacks. In fact, its encryption scheme is intentionally built for small-scale operations, such that only crucial assets and resources are infected in each targeted network with its infection and distribution carried out manually by the attackers.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: 
But these are not the only differences between the two versions: while the Filesystem.dll module was dropped by all the known variants of gpUpdates.exe, it was not always used in the same manner.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
Later payloads would write batch scripts to disk as well as wget binaries. The batch scripts would use the wget binaries to download and execute additional executables. The scripts would also use wget to send POST requests to command and control (C2) servers that would contain information about the compromised system. Some of these payloads included decoy documents that would open when the malware is executed.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1059: Command and Scripting Interpreter
- T1041: Exfiltration Over C2 Channel
- T1082: System Information Discovery
Threat description: 
The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059: Command and Scripting Interpreter
- T1219: Remote Access Software
- T1021: Remote Services
- T1083: File and Directory Discovery
- T1057: Process Discovery
- T1082: System Information Discovery
- T1003.001: OS Credential Dumping - LSASS Memory
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 
Each target country is assigned its own operator, who is able to take advantage of local cultural features – for example, the tendency to use personal email accounts for work. They also made use of a specific proxy server within a country’s borders, to manage connections to infected computers and transfer data to the attackers’ Command-and-Control (C2) servers.
MITRE ATT&CK techniques:
- T1090: Proxy
- T1090.002: Proxy - External Proxy
Threat description: 
The exploit also contains an additional check that ATMFD.dll is of the exact version “5.0.2.227”. As the Houston Disk exploit supported additional versions, we aren’t fully sure why the version range was narrowed down in DanderSpritz. Compared to ElEi, there is no indicative patch check, which may be because the DanderSpritz files are dated to mid-2013, which is prior to the patch that was identified by Kaspersky and is dated to October 2013.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1518: Software Discovery
Threat description: 
In several instances, UNC215 used the same exact file against multiple victims and frequently shared infrastructure across victims. This lack of compartmentalization is not uncommon, but does show that UNC215 is relatively less concerned about the ability for their compromises to be linked to each other. C2 servers used by UNC215 frequently reuse the same SSL certificate, as described in Team Cymru’s research in 2020. On one network, between April 2019 and April 2020, an operator repeatedly and infrequently revisited a compromised network whenever an Endpoint Detection and Response (EDR) tool detected or quarantined tools like HYPERBRO and Mimikatz. After several months of repeated detections, UNC215 deployed an updated version of HYPERBRO and a tool called “anti.exe” to stop Windows Update service and terminate EDR and Antivirus related services.
MITRE ATT&CK techniques:
- T1102: Web Service
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
In order to terminate some of these processes and services, DopplePaymer uses an interesting technique that leverages ProcessHacker, a legitimate open-source administrative utility. This application is bundled with a kernel driver that can be used to terminate processes and services. DoppelPaymer is bundled with six portable executable (PE) files that are encrypted and compressed in the malware’s sdata section. These PE files contain 32-bit and 64-bit versions of the following:
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1489: Service Stop
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: 
We were able to link most of the decoy contents back to the original contents published on the internet by their initial authors, meaning DeathStalker did not craft them, but instead picked out appropriate ready-made material that was available on the internet. One of the decoy components impersonated a legitimate travel agent but included altered contact details.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
Threat description: 
It also searches for directories with names “.Backup0D” – “.Backup0M”, and for each directory, removes contained files named “target.lnk” and “desktop.ini” and the directory itself. These directories are also created during the Gauss USB infection.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
“Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka “Excel Featheader Record Memory Corruption Vulnerability.”  .
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
8. Copy “winrestore.dll” to the directory set in step 6 or 7a with the filename “MSO1234.win” .
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: 
Assuming the weaponized document’s macro code has executed the encoded, heavily obfuscated JScript code will be saved to disk and executed. One of the first behaviours observed is that of a fake error message box, such as the example in Figure 25. Message text varies but follows a theme of reporting something seemingly legitimate failed to run – another false sense of security for the victim.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1036: Masquerading
- T1204.002: User Execution - Malicious File
- T1204: User Execution
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: 
DeathStalker has leveraged several malware strains and delivery chains over the years, from the Python- and VisualBasic-based Janicab to the PowerShell-based Powersing and the JavaScript-based Evilnum. The actor consistently used what we call “dead-drop resolvers” (DDRs), which is obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware this content reveals a command-and-control (C2) server address. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains that drop lots of files to the target’s filesystems. To kick-start an infection, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file sharing services, as well as script execution based on Windows shortcuts. We have identified how DeathStalker’s malware compromises in clusters or targets various types of entities in all parts of the world, with a possible focus on law and consultancy offices, as well as FINTECH companies, but without a clearly identifiable or consistent interest. The targeting does not seem to be politically or strategically defined and doesn’t appear to be the usual financially motived crime. Because of this, we conclude that DeathStalker is a cyber-mercenary organization.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1102: Web Service
- T1566.001: Phishing - Spearphishing Attachment
- T1059: Command and Scripting Interpreter
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1598.003: Phishing for Information - Spearphishing Link
- T1566.002: Phishing - Spearphishing Link
- T1059.005: Command and Scripting Interpreter - Visual Basic
- T1204.002: User Execution - Malicious File
- T1059.007: Command and Scripting Interpreter - JavaScript
- T1204.001: User Execution - Malicious Link
- T1204: User Execution
- T1566.003: Phishing - Spearphishing via Service
- T1059.006: Command and Scripting Interpreter - Python
- T1566: Phishing
- T1588.001: Obtain Capabilities - Malware
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1587.001: Develop Capabilities - Malware
Threat description: 
To make sure the malware is executed after reboot, Ryuk uses a straight forward persistence technique, whereby it writes itself to the Run registry key using the following command:
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1112: Modify Registry
- T1547: Boot or Logon Autostart Execution
Threat description: 
The services simply call mshta.exe to download an HTML application that downloads and runs the same cryptominer loader.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
- T1105: Ingress Tool Transfer
Threat description: 
The remainder of this section focuses largely on Object Linking and Embedding (OLE) Microsoft Excel documents, as they are most commonly used by the Hangover group, at least when it comes to the BackConfig malware. Through infrastructure analysis however, Unit 42 was able to find a BackConfig PE sample (SHA256: e28f1bc0b0910757b25b2146ad02798ee6b206a5fe66ce68a28f4ab1538d6a1f; first seen 10/24/2019) using the C2 domain matissues[.]com and dropped by the weaponised Rich Text Format (RTF) file (SHA256: 752c173555edb49a2e1f18141859f22e39155f33f78ea70a3fbe9e2599af3d3f) from the same day. The RTF used the CVE-2017-11882 exploit against equation editor vulnerabilities in Office applications to execute the PE sample which was a unique exploitation method compared to all other samples analyzed.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: 
Gauss highly modular architecture reminds us of Duqu — it uses an encrypted registry setting to store information on which plugins to load; is designed to stay under the radar, avoid security and monitoring programs and performs highly detailed system monitoring functions. In addition, Gauss contains a 64-bit payload, together with Firefox-compatible browser plugins designed to steal and monitor data from the clients of several Lebanese banks: Bank of Beirut, EBLF, BlomBank, ByblosBank, FransaBank and Credit Libanais. In addition, it targets users of Citibank and PayPal.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1005: Data from Local System
- T1033: System Owner/User Discovery
- T1119: Automated Collection
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1176: Browser Extensions
Threat description: 
In the initial versions of the earlier exploits, such as the exploit for CVE-2013-3660 and some versions of CVE-2015-0057, the exploit caused the kernel to execute a token-swapping shellcode stored in user-mode.
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
- T1134.002: Access Token Manipulation - Create Process with Token
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: 
The next program sent to victims enumerates all the drives on the infected system and executes the following command on them:
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1135: Network Share Discovery
- T1105: Ingress Tool Transfer
Threat description: 
The back door program used in the APT-C-06 organization's early APT operation was Lucker. It is a set of self-developed and customized modular Trojans. The set of Trojans is powerful, with keyboard recording, voice recording, screen capture, file capture and U disk operation functions, etc. The Lucker ‘s name comes from the PDB path of this type of Trojan, because most of the backdoor's function use the LK abbreviation. In the middle to late period we have discovered its evolution and two different types of backdoor programs. We have named them Retro and Collector by the PDB path extracted from the program. The Retro backdoor is an evolution of the Lucker backdoor and it actives in a series of attacks from 2016 till now. The name comes from the pdb path of this type of Trojan with the label Retro, and also has the word Retro in the initial installer.
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1083: File and Directory Discovery
- T1005: Data from Local System
- T1123: Audio Capture
Threat description: 
This investigation illustrates an attacker using multiple tools and techniques to implement their full attack chain. A variety of infection artifacts are utilized ranging from bespoke tools (IndigoDrop) to customizable adversarial tools (Cobalt Strike beacons). The attackers also use a combination of public and private servers to host their malicious payloads with a growing trend towards the sole usage of public servers. The use of military-themed maldocs (lures) indicates that government and military organizations in South Asia may be the targets of this threat actor. The maldocs contain bonafide content and are most likely weaponized copies of benign documents known to peek the interests of their targets. The attack variants discovered over time show us that the threat actor can evolve their TTPs in a short period of time. The earliest observable campaigns of this actor date back to April 2018 and continue to operate today along with the most recent evolutions of the attacks. Evidence of rapid ideation, testing and production of new and diversified modules and IndigoDrop iterations indicates highly motivated and agile adversaries. The use of adversarial frameworks like Cobalt Strike suggests that the attackers are looking to expand their malicious arsenal at a significant rate with self-authored and customizable artifacts. Modern-day malware attack chains consist of multiple stages and operational entities. These artifacts and entities may be hosted locally or on remote servers. For example, this attack consists of multiple shellcodes hosted on remote locations downloaded by a local component (IndigoDrop) during runtime to instrument the attack chain. Thus, while network-based detection is important, it should be complemented with system behavior analysis and endpoint protections.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1036: Masquerading
- T1587.001: Develop Capabilities - Malware
Threat description: 
The execution flow of GandCrab 2 is inherited from GandCrab 1 (pictured), and can be roughly divided into three parts: housekeeping (appears in the diagram as teal), C&C Communication (green), actual encryption (yellow) and final housekeeping (teal again). This execution flow proceeds as follows:
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact