QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
A module in  collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
can start, stop, or delete services.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: 
If running in a Windows environment,  saves a DLL to disk that is injected into the explorer.exe process to execute the payload.  can also be configured to inject and execute within specific processes.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
After collecting documents from removable media,  compresses the collected files.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
has the capability to gather the OS version and computer name.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: 
has used watering holes to deliver files with exploits to initial victims.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: 
When opened and then executed, the key components of the HTA file downloads and executes further malware from a remote URLand loads a decoy image hosted externally (Figure 3)
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
All subsequent messages are encrypted with AES in CBC mode
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
Threat description: 
encrypts C2 data with AES256 in ECB mode.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
We recently mentioned this tool in another report on April 16, as this variant of the BONDUPDATER tool used DNS tunneling to communicate with its C2, specifically using TXT queries to receive information from the C2 server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
is capable of modifying the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: 
gathers computer name and information using the systeminfo command.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: 
runs the command net start on a victim.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1083: File and Directory Discovery
- T1064: Scripting
- T1105: Ingress Tool Transfer
Threat description: 
can obtain information about network parameters.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
enumerates running processes to search for Wireshark and Windows Sysinternals suite.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
MS\d{2}-\d{3}
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: 
is a Web shell that appears to be exclusively used by . It is installed as an ISAPI filter on Exchange servers and shares characteristics with the  Web shell.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: 
drops and executes a malicious CPL file as its payload.
MITRE ATT&CK techniques:
- T1218.002: System Binary Proxy Execution - Control Panel
Threat description: 
The  malware platform uses Extended Attributes to store encrypted executables.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: 
writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: 
The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: 
Navigating to the web page manually to view:source reveals the code, which at the time of writing happened to not be obfuscated in any significant way
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
has created scheduled tasks that run a VBScript to execute a payload on victim machines.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: 
FakeRun’s PDB string (D:\Work\Project\VS\house\Apple\Apple_20180115\Release\FakeRun.pdb) indicates the loader will execute dllhost.exe and inject one malicious DLL file, which is the backdoor, into this process
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
deobfuscates its code.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
When macros are enabled and run, the macro within the Word document searches the sections of the document to get the contents of the header using the following piece of code:       Set rng = ActiveDocument.Sections(intSection).Headers(1).Range     The code above obtains the contents of the header, which the macro will write to a file at C:\programdata\Office365DCOMCheck.ps1
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1083: File and Directory Discovery
- T1204: User Execution
Threat description: 
can use base64 encoded C2 communications.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: 
has downloaded and executed additional plugins.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
One  variant connected to its C2 server over port 8080.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1105: Ingress Tool Transfer
Threat description: 
Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483  In our research we found at least one attack against a company leveraging a Microsoft Office Excel document with an embedded macro to launch the malware
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
Freenki malware lists running processes using the Microsoft Windows API.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
gathers information about the OS architecture, OS name, and OS version/Service pack.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: 
has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: 
is capable of downloading a file from a specified URL.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
We analyzed the command handler and found that it provided the necessary commands for a fully functional backdoor, as seen in Table 1
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
adds the setuid flag to a binary so it can easily elevate in the future.
MITRE ATT&CK techniques:
- T1548.001: Abuse Elevation Control Mechanism - Setuid and Setgid
Threat description: 
decrypts and executes shellcode from a file called Stars.jps.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
Some  variants use port 8088 for C2.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: 
This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data("POST”, random_string & "=" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1041: Exfiltration Over C2 Channel
Threat description: 
Encrypted backdoor configuration    Description Decryption Strings   Check code MDDEFGEGETGIZ   Addr1: tel.qpoe[.]com   Addr2: elderscrolls.wikaba[.]com   Addr3: tel.qpoe[.]com   Port1: 443   Port2: 443   Port3: 53   LoginPasswd: someone   HostMark: mark   Proxy: 0    Figure 12
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1043: Commonly Used Port
Threat description: 
The config file provides download instructions for the loader
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: 
For instance, when using this string we observed DNS queries for “apple-search.infoclose”, as the string “close” was supposed to be the next portion of the C2 URL
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: 
Use of PowerShell to download additional tools
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
collects information on local user accounts from the victim.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
MITRE ATT&CK techniques:
- T1052: Exfiltration Over Physical Medium
Threat description: 
An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1486: Data Encrypted for Impact
Threat description: 
actors deleted tools and batch files from victim systems.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
The encoded payload was a Cobalt Strike httpsstager that was injected into the PowerShell process that ran the command
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
Russia Ukraine Poland Lithuania Belarus Azerbaijan Kyrgyzstan Kazakhstan Iran Israel Turkey Libya Kuwait Taiwan Vietnam India Croatia Germany Belgium Sweden  Victim profiles point to an expansive interest in ICS:  power generation site owners power facilities construction power generation operators large suppliers and manufacturers of heavy power related materials investors  However, we also noticed that the target list includes government, property holding, and technology organizations as well:  high level government other ICS construction federal land holding agencies municipal offices federal emergency services space and earth measurement and assessment labs national standards body banks high-tech transportation academic research  Victim cases We gained insight into significant BE2 victim profiles over the summer of 2014
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1083: File and Directory Discovery
Threat description: 
used spearphishing with Microsoft Office attachments to target victims.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
can download and execute a file from given URL.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
lists the running processes on the system.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
collects user credentials, including passwords, for various programs and browsers, including popular instant messaging applications, Web browsers, and email clients. Windows account hashes, domain accounts, and LSA secrets are also collected, as are WLAN keys.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Buckeye has been known to exploit zero-day vulnerabilities in the past, such as CVE-2010-3962 in an campaign in 2010 and CVE-2014-1776 in 2014
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1203: Exploitation for Client Execution
Threat description: 
Analysis of the domains and IP address infrastructure used by APT15 identified a number of similar possible domains, shown at the bottom of the post
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1070.006: Indicator Removal - Timestomp
- T1036: Masquerading
- T1083: File and Directory Discovery
- T1074: Data Staged
- T1486: Data Encrypted for Impact
Threat description: 
infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
These requests are encrypted using the RC4 algorithm
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Once encrypted, the system information is sent in the body of an HTTP POST
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: 
malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1486: Data Encrypted for Impact
- T1074: Data Staged
Threat description: 
After finding the process id, the shellcode uses standard functions to allocate and write memory within Explorer and then uses low-level API RtlCreateUserThread for thread injection.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
used a proxy server between victims and the C2 server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
The payload (abbad7acd…) is an executable that appears to have been created by a VBScript to Executable tool and further obfuscated with a cryptor
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Open directory listing of hxxp://stevemike-fireforce[.]info/ Based on the contents and structure of the initial identified open directories, it was possible to find several infrastructure patterns in use
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
Comnie, first named by Sophos seemingly after the Windows LNK file name it created, is a custom malware family that is used in targeted attacks, and has been observed in the wild since at least April 2013
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
MISC::AddSid module can appended any SID or user/group account to a user's SID-History.  also utilizes  to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.
MITRE ATT&CK techniques:
- T1134.005: Access Token Manipulation - SID-History Injection
Threat description: 
DEL Deletes a specified file
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
The majority of ActiveX Objects created with Wscript.Shell and Shell.Application are used to run programs, create shortcuts, manipulate the contents of the registry, or access system folders
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Two of them are MacOS X User-Agents and the third is a hashed string:  Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/BADDAD Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405   E9BC3BD76216AFA560BFB5ACAF5731A3   Figure 5: SpeakUp `s requests are encrypted with the salted base64 and include the unique User-Agent At the moment SpeakUp serves XMRig miners to its listening infected servers
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
harvests plain-text credentials as a password filter registered on domain controllers.
MITRE ATT&CK techniques:
- T1556.002: Modify Authentication Process - Password Filter DLL
Threat description: 
TRINITY malware used by  encodes data gathered from the victim with a simple substitution cipher and single-byte XOR using the OxAA key.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: 
used a signed credential-dumping tool to obtain victim account credentials.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: 
It also deletes Windows Event Logs : Application, Security, Setup, System
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: 
collects a list of available servers with the command net view.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: 
This information allows a threat actor to determine if their messages were delivered, which users are more susceptible to opening them, and basic information regarding the target’s operating system and e-mail client (or browser)
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can enumerate registry keys.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
has gathered a process list by using .exe.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
checks its directory location in an attempt to avoid launching in a sandbox.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
Some  strings are base64 encoded, such as the embedded DLL known as MockDll.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
is capable of spawning a reverse shell on a victim.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
can use  to execute a payload on a remote host. It can also use Service Control Manager to start new services.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: 
2 Downloads a file to the system
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
After writing to this file, the Trojan will enter a loop to continually to check for changes to the modification time of this file, effectively waiting for the actor to make modifications to the file
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: 
uses raw sockets to communicate with its C2 server.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: 
has a command named $screenshot that may be responsible for taking screenshots of the victim machine.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
downloads and uploads files to and from the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Building a client    Build configuration Usage scenario Description     Debug configuration Testing The pre-defined Settings.cs will be used, so edit this file before compiling the client
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1027: Obfuscated Files or Information
Threat description: 
Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Regular Expressions   ([^r-v\\s])[r-v]([\\w\\d+\\/=]+)-\\w+.(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   Address:\\s+(([a-fA-F0-9]{0,4}:{1,2}){1,8})   ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   (\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(\\d+.\\d+.\\d+.\\d+)    Table 3 Regular expressions used by RogueRobin The C# variant, like its PowerShell relative, will issue DNS queries to determine which query types can successfully communicate with its C2 servers
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
has used WMI for execution.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
Figure 1: Code from 29[.]html scheduling the first task to run a script from pastebin The second task (“MSOFFICEER”) in Figure 2 runs the script contents of a different page of the same blog, blog-page[.]html, every 100 minutes
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: 
collects information on programs and services on the victim that are configured to automatically run at startup.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
"Are you Happy?" campaign."FreeMilk" campaign."North Korean Human Rights" campaign."Evil New Year 2018" campaign.On January 2nd of 2018, the "Evil New Year 2018" was started
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
The time of the observed attacker activity coincides with Iran’s Daylight Time, which is +0430 UTC
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: 
used legitimate programs such as AmmyAdmin and Team Viewer for remote interactive C2 to target systems.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: 
Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
All subsequent interaction with the C2 server uses the same SOAP web service, so we will not show all of the generated HTTP requests
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
checks for anti-malware products and processes.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
Cyber threat groups’ access to the media organization’s networks could potentially provide the government advance warning on upcoming protests, information on pro-democracy group leaders, and insights needed to disrupt activity on the Internet, such as what occurred in mid-2014 when several websites were brought down in denial of service attacks.[8] Threat Actors Use Spear Phishing Written in Traditional Chinese Script in Attempted Intrusions In August 2015, the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations, including newspapers, radio, and television
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
After compromising a victim,  discovers all running services.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
uses macOS' .command file type to script actions.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: 
has batch files that modify the system service COMSysApp to load a malicious DLL.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
The code comparison specifically shows the HighShell code including a salt variable containing di2zag7wZHTK9YR0NGq, which is not present within the TwoFace code on the left
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
has sent spearphising emails with malicious links to potential victims.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
can download files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
has used RAR to compress files before moving them outside of the victim network.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
can retrieve an additional payload from its C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Figure 7: Property list file in LaunchAgents directory To camouflage the location of the malicious file, Keydnap replaces argv[0] with /usr/libexec/icloudsyncd –launchd netlogon.bundle
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
hooks processes by modifying IAT pointers to CreateWindowEx.
MITRE ATT&CK techniques:
- T1056.004: Input Capture - Credential API Hooking
Threat description: 
The most interesting part is the decrypted C&C configuration, as can be seen in the image below
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
A  variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
encrypts data using Base64 before being sent to the command and control server.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: 
adds permissions and remote logins to all users.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: 
may collect user account information by running net user /domain or a series of other commands on a victim.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
gathers the local IP address.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
is capable of capturing keystrokes on victims.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
performs code injection injecting its own functions to browser processes.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: 
C:\Windows\System32\utilman.exe
MITRE ATT&CK techniques:
- T1546.008: Event Triggered Execution - Accessibility Features
Threat description: 
It is created as a separate process instead of child process of Office applications
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
Figure 2: APT39 attack lifecycle There are some indications that APT39 demonstrated a penchant for operational security to bypass detection efforts by network defenders, including the use of a modified version of Mimikatz that was repacked to thwart anti-virus detection in one case, as well as another instance when after gaining initial access APT39 performed credential harvesting outside of a compromised entity's environment to avoid detection
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
obtains the target's IP address and local network segment.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
has a hard-coded primary and backup C2 string.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: 
We are not sure if this works, but the command name would suggest it is meant to take a screenshot   $command Runs a PowerShell command and sends the output to the C2   slp:\d+ Sets the sleep interval between C2 beacons   $testmode Issues DNS queries of A, AAAA, AC, CNAME, MX, TXT, SRV and SOA types to the C2 servers attempting to determine which DNS query types were successful
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1571: Non-Standard Port
- T1008: Fallback Channels
- T1043: Commonly Used Port
Threat description: 
Some  variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
Analyzing Gold Dragon As part of its initialization, Gold Dragon:  Builds its imports by dynamically loading multiple APIs from multiple libraries Gains debug privileges (“SeDebugPrivilege”) for its own process to read remote memory residing in other processes  The malware does not establish persistence for itself but for another component (if it is found) on the system:  The malware begins by looking for an instance of the Hangul word processor (HWP) running on the system
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1057: Process Discovery
Threat description: 
Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: 
In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1036: Masquerading
Threat description: 
surveys a system upon check-in to discover running processes using the tasklist /v command.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
installer uses WMI to search for antivirus display names.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
has a tool that can obtain information about the local system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
uses AES to encrypt C2 traffic.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
prompts the user for credentials.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
performs local network configuration discovery using ipconfig.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: 
The code is obfuscated in order to hide any malicious activity on the remote server
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
A version of  uses the MPRESS packer.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
queried the Registry to identify victim information.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
/user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser cmd /c <command>: Executes command on infected endpoint   Conclusion  The actor behind Honeybee has been operating with new implants since at least November 2017 with the first known version of NTWDBLIB installer
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
DHS and FBI are distributing these IP addresses to enable network defense activities and reduce exposure to the DDoS command-and-control network
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
Additionally, some of this early activity shares a similarity with current FIN7 operations – the use of Power Admin PAExec for lateral movement
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
UAC bypass via DLL hijacking requires:  A Windows executable with the auto-elevate property in its manifest A Windows executable in a secure directory (%systemroot%\system32)  The malicious NTWDBLIB DLL performs the simple task of setting up the malicious ipnet.dll as a service by running one of the two batch files contained in the CAB file (which is also dropped to %systemroot%\system32):  NTWDBLIB executing the installer batch files under the context of cliconfg.exe.  The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: 
There was a slight deviation in the November grouping, where the three samples we collected still used the Joohn author name for the last modified field but reverted to a default USER/user author name for the creator field
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
This version injects a malicious module into one of Avast's processes, whereas early versions of the campaign detected Avast and quit
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
terminates antimalware processes.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: 
uses basic obfuscation in the form of spaghetti code.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Exploit Analysis  Despite being an older vulnerability, many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1203: Exploitation for Client Execution
Threat description: 
Keep security software up-to-date with the latest definitions  Protection Norton Security, Symantec Endpoint Protection, and other Symantec security products protect users against these threats through the following detections: AV  Backdoor.Cadelspy Backdoor.Remexi Backdoor.Remexi.B  IPS  System Infected: Backdoor.Cadelspy Activity 2 System Infected: Backdoor.Remexi Activity  Indicators of compromise We have also compiled an indicators-of-compromise document containing further details which can be used to help identify the threats if they are present in your environment
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
uses tasklist /svc to display running tasks.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
The launcher module, obfuscated with the notorious Metasploit’s shikata_ga_nai encoder, is the same for all the droppers
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: 
has has extensively used strategic Web compromises to target victims.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: 
used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: 
can use a WMI script to achieve persistence.
MITRE ATT&CK techniques:
- T1546.003: Event Triggered Execution - Windows Management Instrumentation Event Subscription
Threat description: 
The dropped files are either in the root of the “ProgramData” folder or in a subdirectory
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
is capable of providing Meterpreter shell access.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
captures images from the webcam.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: 
The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
presents an input prompt asking for the user's login and password.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
achieves persistence by creating a shortcut in the Startup folder.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
checks for ant-sandboxing software such as virtual PC, sandboxie, and VMware.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
can bypass UAC and create an elevated COM object to escalate privileges.
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: 
can gather information about the victim proxy server.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
can gather the username from the victim’s machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
This is consistent with most espionage-motivated adversaries, as once the adversary gains access via legitimate credentials, they are able to masquerade as a legitimate user and essentially become an insider threat
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
will delete files on the system.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
can execute shell commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
lists local users and session information.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
uses an XOR 0x1 loop to encrypt its C2 domain.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
exfiltrates data over its C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 
installs VNC server software that executes through rundll32.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: 
stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: 
has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
MITRE ATT&CK techniques:
- T1011: Exfiltration Over Other Network Medium
Threat description: 
contains a module to collect data from removable drives.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: 
obfuscates C2 traffic with an altered version of base64.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
has a tool that creates a new service for persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
These platforms may not be well maintained and may break intermittently
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
MAGIC HOUND TOOLSET The Magic Hound attacks did not rely on exploit code to compromise targeted systems, instead relying on executables and Microsoft Office documents, specifically Excel and Word documents containing malicious macros
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: 
has a plugin for VNC and Ammyy Admin Tool.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: 
can sleep for a given number of seconds.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: 
USBS Deletes the file created by the USB command to reverse the effect
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
creates a backdoor through which remote attackers can list contents of drives and search for files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
checks the running processes on the victim’s machine.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
Several Mandiant investigations revealed that, after gaining access, APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1027: Obfuscated Files or Information
Threat description: 
places scripts in the startup folder for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
can create a link to itself in the Startup folder to automatically start itself upon system restart.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment