QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453. Whitelists files, folders and extensions from encryption. Encrypts files on local and network storage. Customizes the name and body of the ransom note, and the contents of the background image. Exfiltrates encrypted information on the infected host to remote controllers. REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit. After the first thread determines the local network subnet, the SMB worm scans local addresses beginning at the start of the netblock and increasing by one to the end of the netblock
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Encryption is definitely the simplest method to hide the C&amp;C server. We have encountered cases where the port has been stored in the data section, in the Delphi form data, or randomly chosen from a range
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: 1) The malicious macro scans the victim’s Outlook inbox and looks for the strings “$$cpte” and “$$ecpte”. 2) Then the macro will open a CMD shell that will execute whatever instruction / command is in between the strings. 4) The macro searches for the special strings in the “Deleted Items” folder to find the attacker’s email address and sends the data back to the attackers via email. 5) Lastly, the macro will delete any evidence of the emails received or sent by the attackers
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: There are three types of URLs present in the decrypted configuration. The first type of URL listed in the configuration data is used for the plain HTTP (that is, non-Tor) communication with C&amp;C servers. The bot reports to the C&amp;C server using the typical request pattern: for example, the initial checkin to the C&amp;C server is in the form of: cfg_url + “/images/” + encoded_data + (.jpeg||.gif||.bmp
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: Similar to many other ransomware operators, CARBON SPIDER not only encrypted victim files using Darkside, but also exfiltrated data for publication on a dedicated leak site (DLS) hosted on Tor. For exfiltration, CARBON SPIDER primarily leveraged the MEGASync client for hosting provider MEGA but also employed GoToAssist
MITRE ATT&CK techniques:
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
Threat description: Kimsuky is a highly motivated APT that has traditionally targeted entities in South Korea. The APT group has used a variety of malware such as Gold Dragon, Babyshark and Appleseed to target entities ranging from defense to education and think tanks. Some file enumerators will exfiltrate all files with specific extensions. What's interesting here, however, is that the attackers knew exactly which files they were looking for
MITRE ATT&CK techniques:
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
Threat description: The Trojan obfuscates its executable code prior to compilation, rather than packing it like most other ransomware, making it harder for researchers to reverse engineer and analyze the malicious code. It also obscures the links to the necessary API function, and stores hashes to strings rather than the actual strings. Upon installation, the Trojan reviews the directory its executable is started from, and if it spots an attempt to launch it from an ‘incorrect’ directory – such as a potential automated sandbox – it exits. Before encrypting files on a victim device, SynAck checks the hashes of all running processes and services against its own hard coded list. If it finds a match, it tries to kill the process
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1083: File and Directory Discovery
Threat description: When the backdoor is configured to use HTTPS to communicate with the C2, the functionality is largely the same as when in HTTP mode. The differences are that it lacks the options to update a session key due to encryption being handled by the TLS layer and it also does not have the option to send data to and from the C2 in the chunking mode previously described. In addition, only one transmission is made to the C2 when the malware is establishing a connection as there is no exchange of an AES session key. The hello message that is sent contains the same plaintext data as the HTTP mode
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method, specifically attempting to load either the Pupy RAT or meterpreter which we have called MagicHound.Rollover. The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server. We discovered two different techniques used in the PowerShell scripts, the first being a straightforward execute command of a string retrieved from the remote server. The second technique appeared to be from a tool called Magic Unicorn, an open source module for meterpreter. Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Throughout the year, Volexity identified multiple Vietnamese-language news websites that appeared to be compromised, as they were being used to load an OceanLotus web profiling framework. The exact functionality varied from site to site, but the goal of these frameworks was to gather information about site visitors and, in some cases, deliver malware. This code appears to be a variation of what Volexity has previously described as Framework A
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: For example, here is a folder and a list of files created by picking the C:\Windows\system32\TCPSVCS.exe executable as a source of data
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting. Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver”. As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3. Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication. The flow for Reaver is as shown
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1095: Non-Application Layer Protocol
Threat description: Another payload of the Ecipekac loader, which we call SodaMaster (a.k.a DelfsCake), is also a new fileless malware. In our research we found more than 10 samples of SodaMaster. The only differences were in the configuration data, including a hardcoded C2, an encoded RSA key and additional data for calculating a mutex value
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
- T1105: Ingress Tool Transfer
Threat description: When executed, the DLL drops and launches using a WinExec API call. This stage of the Valak malware uses a malicious JavaScript file with a random name that changes per execution
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: The script modifies Windows Defender settings to exclude the target logical drive it is going to wipe from scheduled and real-time scanning
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. NICKEL actors created and deployed custom malware that allowed them to maintain persistence on victim networks over extended periods of time. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1078: Valid Accounts
- T1119: Automated Collection
- T1587.001: Develop Capabilities - Malware
Threat description: To load the driver, a new service is created using the API CreateServiceW. The name and display name for this service is the 4-character name used for the file name. Next, StartServiceW is called in a loop five times to ensure the driver is loaded. Immediately after the driver is loaded, the service is removed by deleting the entire registry key
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1106: Native API
Threat description: Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. The URL constructed had the following format:http://&lt;attacker_controlled_domain/&gt;report.php
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering, in addition to the active development of attacks, infrastructure and the use of new methods and techniques
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This tactic uses public web services to host content that contains encoded commands that are decoded by the malware
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: As we can see, it simply downloads a file from secure.dropinbox[.]pw using HTTP on port 443 (not HTTPS), and proceeds to decrypt the file using AES-128 prior to executing it. At this point, Cardinal RAT has been downloaded and executed, and execution is directed to this sample. Of course, the Carp Downloader is not required to download Cardinal RAT, however, based on our visibility, it has exclusively done so
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1105: Ingress Tool Transfer
Threat description: The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module. The WINDOWSTEMP.ps1 script is a dropper that decodes an embedded executable using base64 and decompresses it with the System.IO.Compression.GzipStream object. The WindowsTemplate.exe executable is a new variant of RogueRobin written in C
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1218.010: System Binary Proxy Execution - Regsvr32
- T1140: Deobfuscate/Decode Files or Information
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Juniper Threat Labs has been monitoring a campaign that pushes a new IcedID banking trojan. This new campaign changes tactics by injecting into msiexec.exe to conceal itself and use full steganography for downloading its modules and configurations. Previous versions of IcedID injected into svchost.exe and downloaded encrypted modules and config as “.dat” files. IcedID is a banking malware that performs Man-in-the-Browser attacks to steal financial information
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Execution through API (Batch file for example). - Application processes discovery with some procedures as the hashes of the name, and directly for the name of the process. File and directory discovery: to search files to encrypt. Encrypt files. Create files
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: The malware uses at least three separate encryption methods for its traffic, depending on the type of message. The first method, implemented within HTTPDLL.dll, is used for the decryption of values and traffic relating to the HTTP GET requests (i) and (ii) discussed above. It appears to use an implementation of AES to encrypt the data which is then transmitted in its encrypted format. The key (shown in the image below) is apparently static, at least among the samples tested, and generated by drawing byte values from multiple parts of the binary and performing a number of bitwise operations on them
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: "Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Using legitimate tools like PsExec will save the adversary time from writing their own tooling. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony. Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: SOMBRAT evades forensic analysis by patching the process memory used to record command line arguments. It replaces the initial command line with the base filename of the program executable, removing any arguments. This means that investigators that inspect a process listing via memory forensics will see the innocuous-looking command line `powershell.exe` rather than references to the uncommon filename such as `WwanSvc.c
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1564.010: Hide Artifacts - Process Argument Spoofing
Threat description: POWRUNER may also receive batch commands from the C2 server to collect host information from the system
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
- T1047: Windows Management Instrumentation
- T1033: System Owner/User Discovery
- T1057: Process Discovery
- T1083: File and Directory Discovery
- T1016: System Network Configuration Discovery
- T1082: System Information Discovery
Threat description: The 0x1 bit in the control flags is used in this module to specify if the download should be done via HTTPS
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: TeamTNT targets exposed Docker API to deploy malicious images. Docker images containing TeamTNT malware are being hosted in public Docker repos via account takeovers. TeamTNT leverages exposed Docker hub secrets within GitHub to stage malicious Docker images. The following MITRE ATT&amp;CK techniques were observed: Deploy Container (T1610), User Execution: Malicious Image (T1204.003), Unsecured Credentials: Credentials In Files (T1552.002), Implant Internal Image (T1525), and Valid Accounts: Cloud Accounts (T1078.004
MITRE ATT&CK techniques:
- T1204.003: User Execution - Malicious Image
Threat description: Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: "Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: The dropper then decrypts the ciphertext by using an XOR cipher and a specific base64 encode string that is decoded and used as the key. Before accessing the ciphertext, the dropper subtracts 14 from the specified offset, which is the same as previous Disttrack samples delivered in Shamoon 2 attacks. Tables 1, 2, and 3 include the resources, the information used to extract them, and the resulting module
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Regarding to downloading and executing a tool, Flagpro stores the downloaded file in file path “%Temp%\~MY[0-9A-F].tmp” first. Then, Flagpro adds extension “.exe” to the name of stored file and executes the file
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Because TA505 is such a significant part of the email threat landscape, this blog provides a retrospective on the shifting malware, payloads, and campaigns associated with this actor. We examine their use malware such as Jaff, Bart, and Rockloader that appear to be exclusive to this group as well as more widely distributed malware like Dridex and Pony. Where possible, we detail the affiliate models with which they are involved and outline the current state of TA505 campaigns
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response. As the response is a random number that ends with ‘0’, POWRUNER sends another random GET request to receive an additional command string. The C2 server sends back Base64 encoded response
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Using valid credentials, CARBON SPIDER moves laterally through victim environments using RDP and occasionally SSH. The adversary typically uses PS to run Cobalt Strike but occasionally writes Cobalt Strike stagers or KillACK backdoors to disk. Occasionally, CARBON SPIDER has deployed the legitimate GoToAssist or TightVNC tools to provide redundant control of hosts
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
- T1021.004: Remote Services - SSH
- T1021.005: Remote Services - VNC
Threat description: The test plugin attempts to connect to a provided address to check access to the network. Meanwhile, the reverse P2P plugin creates a proxy server to bridge the C&amp;C and the client. This creates another connection to another C&amp;C specified in the commands to act as a proxy, redirecting traffic from the infected machine to the real C&amp;C server
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: The notes also contain a threat to leak private information that has been collected from the target if the ransom is not paid
MITRE ATT&CK techniques:
- T1484.001: Domain or Tenant Policy Modification - Group Policy Modification
- T1078.002: Valid Accounts - Domain Accounts
Threat description: AT&amp;T Alien Labs™ has discovered a new campaign by threat group TeamTNT that is targeting multiple operating systems and applications. The campaign uses multiple shell/batch scripts, new open source tools, a cryptocurrency miner, the TeamTNT IRC bot, and more
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: To do this, Tick uses a number of publicly available hacktools such as Mimikatz, GSecdump, and Windows Credential Editor. The tools are downloaded and deployed to the original install directory previously created by the malware
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Throughout our StellarParticle investigations, CrowdStrike identified what appeared to be a VBScript-based Active Directory enumeration toolkit. While the script’s contents have not been recovered to date, CrowdStrike has observed identical artifacts across multiple StellarParticle engagements that suggest the same or similar tool was used
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: If it is executed with the "help" parameter, it will install a service to execute itself as a service. This parameter is used by the trojanized installer. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Consequently, the execution won't do anything and the dynamic analysis will be skewed. The second main feature is the service. This service has two features. First, it will launch the winprint32.exe executable (C2 contact module) and then it will wait for an event. This event is the mechanism used by the C2 contact module to alert the service executable to perform the cleaning of all components
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Network Reconnaissance – gathering information from machines on the network. Credential Theft – stealing user names and passwords, potentially to provide them with further access to the victim network. RAR archiving – files are transferred to staging servers before exfiltration. Csvde – can be used to extract Active Directory files and data. WMIExec – can be used for lateral movement and to execute commands remotely. PowerShell - a powerful interactive command-line interface and scripting environment included in the Windows operating system
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: On balance, the fall campaigns diverged from Bulgarian themed NetWire campaigns in the early summer in scope and scale. These campaigns distributed NetWire variants which used Bulgarian email lures, leveraged geofencing, and downloading EXEs through certutils. The NetWire malware has been around since at least 2002 and has been consistently in use by various actors across the threat landscape. This analysis shows groupings of similar campaigns distributing NetWire based on message attributes, email lures and language, Office document metadata, VBA Macro code, and malware configuration
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: This thread searches for for files with the following extensions on removable drives and copies them to ‘c:\system’ every 5 seconds
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
- T1025: Data from Removable Media
- T1005: Data from Local System
- T1119: Automated Collection
- T1083: File and Directory Discovery
Threat description: The FTP account information used in the malware can expose the C&amp;C server to attacks. The string ‘victory’ used in the password has also been found in the b374k webshell used by the Kimsuky group
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
- T1027: Obfuscated Files or Information
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The January 2022 version of PlugX malware utilizes RC4 encryption along with a hardcoded key that is built dynamically. For communications, the data is compressed then encrypted before sending to the command and control (C2) server and the same process in reverse is implemented for data received from the C2 server. e@T#L$PH%" as it is being passed along with the encrypted data. During the January 2022 campaigns, the delivered PlugX malware samples communicated with the C2 server 92.118.188[.]78 over port 187. In the February 2022 campaign, Proofpoint researchers observed a variation in which PlugX malware used an RC4 key that was sent to the bot in the first HTTP response which was then used to encrypt data going to the C2 server
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Stage 2 is also .NET DLL file that downloads a third file from parinari[.]xyz, converts it from ASCII to binary, and then creates a scheduled task to load it
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The plugin is designed to migrate the loader to the address space of another process. Injection parameters are set in the Lizar client configuration file. It should be noted that this plugin can be used not only to inject the loader, but also to execute other PE files in the address space of the specified process
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1055.002: Process Injection - Portable Executable Injection
Threat description: This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. For example, if I’m in a user context, I might set explorer.exe as my parent with something plausible (e.g, iexplore.exe) for my temporary processes. If I’m in a SYSTEM context, I might use services.exe as my parent process and ask Beacon to use svchost.exe for its temporary processes. Beacon’s runu command runs an arbitrary command as a child of another parent. These commands offer means to spawn a payload, in another desktop session, without remote process injection. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: It does so by monitoring the content of the clipboard and if the data seem to be a cryptocurrency wallet, it replaces them with the attacker’s own. This technique is not new; it has been used by other malware in the past – even the infamous BackSwap banking trojan implemented it in its earliest stages
MITRE ATT&CK techniques:
- T1565.002: Data Manipulation - Transmitted Data Manipulation
Threat description: The data exchanged between the module and the C&amp;C is encrypted with a proprietary algorithm and then encoded as readable latin characters
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: It eventually downloads a PowerShell module from an Amazon S3 bucket URL hxxps://s3[.]amazonaws[.]com/doclibrarysales/test[.]txt and then executes it
MITRE ATT&CK techniques:
- T1102: Web Service
- T1583.006: Acquire Infrastructure - Web Services
Threat description: The script variant of the Helminth Trojan consists of a VBScript and PowerShell script named update.vbs and dns.ps1. We aptly named this variant the script version, as we found another version of this Trojan that we will discuss later in this Appendix
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Once installed, JSSLoader provides the threat group with a backdoor to the victim’s computer and the organization
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1204.002: User Execution - Malicious File
Threat description: To do so, this malware attempts to spread to other systems on network using what are likely stolen administrator credentials. This is again similar to the 2012 Shamoon attacks, where compromised but legitimate credentials obtained in advance of the attacks were also hard coded into the malware to aid in its propagation. Disttrack also has the ability to download and execute additional applications to the system, as well as remotely set the date to start wiping systems
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them, depending on a set of rules defined by the attackers. The stolen data is copied into a hidden directory as “%MYPICTURES%\%volume serial number%“, from where it can be exfiltrated by the attackers using one of the AZZY implants
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
- T1025: Data from Removable Media
Threat description: The implant consists of a modified Cisco IOS image that allows the attacker to load different functional modules from the anonymity of the internet. Each of the modules are enabled via the HTTP protocol (not HTTPS), using a specifically crafted TCP packets sent to the routers interface. The packets have a nonstandard sequence and corresponding acknowledgment numbers. The modules can manifest themselves as independent executable code or hooks within the routers IOS that provide functionality similar to the backdoor password
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: Collects information about the infected system, network, drives, and installed applications. Saves the collected information to a file named “info” in “%appdata%\Micorosoft\Templates” and sends it to the C2
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: As can be seen from the Table 2 above, Kazuar has an extensive command set, many of which are similar in functionality as other backdoor Trojans. However, a few commands specific to Kazuar appear to be unique and are worth further discussion
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: Adversaries aiming to exfiltrate large amounts of data will often use one or more systems or storage locations for intermittent storage of the collected data. This process is called staging and is one of the of the activities that NCC Group and Fox-IT has observed in the analysed C2 traffic
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
- T1074.002: Data Staged - Remote Data Staging
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: FANCY BEAR adversary used different tradecraft, deploying X-Agent malware with capabilities to do remote command execution, file transmission and keylogging. It was executed via rundll32 commands such as
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1218.011: System Binary Proxy Execution - Rundll32
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Lucifer is quite powerful in its capabilities. Not only is it capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing. Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: The execution chain ensures that persistence is set on the affected system using a .lnk file in the Startup directory. The .lnk file shown in Figure 17 opens the malicious VBS dropped on the system
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: If that configuration is not available, it utilizes a hardcoded configuration in the binary. The tool uses a custom binary protocol over sockets for its command and control communication with the GUP Proxy Tool and all transferred data is encrypted using a modified version of RC4 encryption
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: The implant receives HTTP-based commands from a control server and parses the HTTP Content-Type and Content-Length from the HTTP header. If the HTTP Content-Type matches the following value, then the implant executes the command specified by the control server
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The compressed_data field is compressed using the common ZLIB compression algorithm. Additionally, in the event data is being sent via HTTP rather than HTTPS, the following additional encryption algorithm is applied to the POST data
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: The very narrow and specific set of email identifiers and organizations observed by CTU researchers strongly indicate that the campaign is focused on U.S. Based on the identified targets, CTU researchers assess with low confidence that a Russian government-sponsored threat group may be responsible for this campaign. Third-party researchers attribute this campaign to the Russia-based IRON RITUAL threat group (also known as NOBELIUM and APT29). IRON RITUAL has been linked to the SUNBURST malware used in the SolarWinds supply chain attack
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Then the article describes how, since the beginning of 2019, the group has been leveraging self-extracting archives to run code
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1218.010: System Binary Proxy Execution - Regsvr32
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Finally, the loader spawns cmd.exe to perform a series of reconnaissance commands to obtain information about the network and domain
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\Excel.Application\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: It also creates a folder in C:\SDRSMLINK\ and shares this folder with the rest of the network
MITRE ATT&CK techniques:
- T1564.006: Hide Artifacts - Run Virtual Instance
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: In october 2016 Group-IB published the report about the Cobalt group. Now, a year later, this group is continuing to attack banks, which is reported monthly by Group-IB's Threat Intelligence team. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. The former module is installed on a system that has access to the Internet and provides interaction with the C&amp;C server using HTTP/HTTPS/DNS protocols. Another module is installed even in systems that do not have Internet access, as, using SMB protocol (which is typically used within a local network), the SMB module is controlled via infected computers running the HTTP/HTTPS/DNS module. For interaction on HTTPS protocol, HTTP protocol profiles may be used with an indicated SSL certificate, but for data exchange on the DNS protocol, it requires DNS A, AAAA, and TXT records. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Most of the infected sites use the TYPO3 CMS (see: https://typo3.org/), which could indicate the attackers are abusing a specific vulnerability in this publishing platform
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: In the past, Emissary Panda has used many ways to target their victims, with the most notable being the exploits from the Hacking Team leak. Usually, the delivered payload is either the well-known ‘PlugX’ or ‘HttpBrowser’ RAT, a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: A copy of the initial EXE for GuLoader is made persistent, then the original is deleted from the infected user’s AppData\Local\Temp directory where it was originally saved. The GuLoader EXE is persistent through the Windows Registry under the following key
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: And, of course, the attackers added the ability to control the infected machine. The code receives a binary blob official M.E.Doc server, decrypts it using the Triple DES algorithm, and, afterwards, decompresses it using GZip. The result is an XML file that could contain several commands at once. This remote control feature makes the backdoor a fully-featured cyberespionage and cybersabotage platform at the same time
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: mailsearcher32 module This module searches the infected system’s files to gather email addresses for information-stealing purposes. Emotet, according to previous research by Brad Duncan, is also responsible for delivering this password-grabbing Trickbot variant, as well as Azorult, to users
MITRE ATT&CK techniques:
- T1087.003: Account Discovery - Email Account
- T1083: File and Directory Discovery
Threat description: The persistence mechanisms also change, offering the options to use XDG Autostart Entries and crontabs for persistence. We’ve waxed lyrical about crontabs before, but we haven’t explored XDG Autostart Entries in detail
MITRE ATT&CK techniques:
- T1547.013: Boot or Logon Autostart Execution - XDG Autostart Entries
Threat description: browser history from Firefox, Google Chrome, Microsoft Edge and Internet Explorer; - usernames and passwords stored in the listed browsers; - email accounts from Microsoft Outlook and Mozilla Thunderbird
MITRE ATT&CK techniques:
- T1087.003: Account Discovery - Email Account
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: After using RTF files, the group started using self-extracting (SFX) archives that use common document icons in an attempt to further mislead their victims. It was briefly documented by Threatbook (in Chinese). When run, these self-extracting RAR files drop and execute DLL files (with a .ocx extension) with the final payload being the previously documented {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll. This section will describe the technique and what they have altered to achieve their goal
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Attempted to blend in with a file name that matched the system name it resided on - Configured for persistence via a crontab entry with a @reboot line - Used likely compromised infrastructure for C2
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: RAR archiving – files are transferred to staging servers before exfiltration. They may be encrypted or compressed, to make them easier to extract. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. It can be used to find information and execute code, and is frequently abused by malicious actors
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: In order to collect even more information, from time to time the Zebrocy operators upload and use dumpers on victims’ machines. The current dumpers have some similarities with those previously used by the group. In this case, Yandex Browser, Chromium, 7Star Browser (a Chromium-based browser), and CentBrowser are targeted, as well as versions of Microsoft Outlook from 1997 through 2016
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. China Chopper: a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands. This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Then, the malware loads an executable file from WM_DSP resource and runs a shellcode that contains approximately1500 bytes (after decrypting it with XOR 0x45
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Kimsuky uses memory dump programs instead of using well-known malicious software and performs the credential extraction offline. It can be used as a general process dump utility that actors can embed in other scripts, as seen by Kimsuky’s inclusion of ProcDump in the BabyShark malware. The victim is then redirected to the official Chrome Web Store page to install a Chrome extension, which has the ability to steal cookies and site passwords and loads a JavaScript file, named jQuery.js, from a separate site (see figure 3).[51(link is external
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1204.002: User Execution - Malicious File
Threat description: The impact of finding this implant on your network is severe and most likely indicates the presence of other footholds or compromised systems. This backdoor provides ample capability for the attacker to propagate and compromise other hosts and critical data using this as a very stealthy beachhead
MITRE ATT&CK techniques:
- T1556.004: Modify Authentication Process - Network Device Authentication
Threat description: InvisiMole is capable of scanning enabled wireless networks on the compromised system. It records information such as the SSID and MAC address of the visible Wi-Fi access points
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: The implant has the capability of gathering data from the victim’s system. The following information will be gathered and sent to the command and control server
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: The threat actors also collected the files “ntds.dit” and the “SYSTEM” registry hive. DHS observed the threat actors compress all of these files into archives named “SYSTEM.zip” and “comps.zip
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1189: Drive-by Compromise
Threat description: Quickly after the initial compromise, the operator deploys a tool named "dog.exe. This malware is written in .NET and its purpose is to monitor hard drive paths and to exfiltrate the information via an email account or an FTP, depending on the configuration. The configuration file is named dconf.json
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol