QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The macros are different. In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. It also does not use FTP for exfiltration
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: When the attackers need to send a file or command to the victim machine, they place them to the folder named d in the victim’s Dropbox folder. The malware retrieves this folder and downloads all its contents to the working folder
MITRE ATT&CK techniques:
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
- T1074.001: Data Staged - Local Data Staging
Threat description: The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data. In Windows, Chrome cookies and saved passwords are encrypted using DPAPI
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: This time, the text is from the novel "The Brothers Karamazov" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. Secondly, the author split the malware in a couple of different files. For example, the variables are stored in a "Constant.py" file containing the C2 server and the configuration. The most notable change is the protocol used to download and upload files
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Next, the loader fingerprints the Windows architecture. This is a crucial step because the loader needs to know what version of the backdoor to download (32-bit or 64-bit). Once the Windows architecture has been identified, the loader carries out the download
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 - Same author appeared in these recent malicious documents that also appeared back in Lazarus 2017 campaigns - Uses the same malicious document structure and similar job recruitment ads as what we observed in past Lazarus campaigns - The techniques, tactics and procedures align with Lazarus group’s interest in crypto currency theft
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: Check the email sender, subject, and body for anything suspicious before downloading and opening email attachments. Check the file extension of the attached file and make sure it is the intended file format. Avoid activating macro for any attached Microsoft Office files, especially for emails that request macro activation using an image of the body of the opened file or those that don’t show anything. Subtle changes to a popular URL can be one indicator of malicious content
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: 1) Checks if the user has Administrator privilege 2) Drops the Cobalt Strike Stager in debug or “%TEMP%” directory as “tmp_FlVnNI.dat” depending on the user privilege 3) Opens the decoy Word document 4) Locates the InstallUtil.exe and its installed version 5) Copies “schtasks.exe” to “%TEMP%” directory and renames it to “wtask.exe” 6) Creates Scheduled tasks with the name “Security Script kb00855787” 7) Renames “wscript.exe” into “winwsh.exe” 8) Runs the scheduled task to execute the Cobalt Strike Stager 9) C2 communication
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are
MITRE ATT&CK techniques:
- T1030: Data Transfer Size Limits
- T1105: Ingress Tool Transfer
Threat description: Update the RAT and Keylogger remotely - Set an autostart JavaScript to run on RAT startup - A Domain Generation Algorithm (DGA) for C2 resiliency - If the user has admin permissions, it deletes shadow copies using vssadmin.exe
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: The wiper is relatively small in size and dynamically resolves most of the APIs it uses. Before starting any file destruction, it checks to ensure that the machine is not a domain controller. If the machine is a domain controller, it stops execution. Pseudo-code: CaddyWiper checking for the Domain Controller role of the machine. If the system is not a domain controller, the wiper will destroy files on "C:\Users," followed by wiping of all files in the next drive letter until it reaches the "Z" drive. This means that the wiper will also attempt to wipe any network mapped drive attached to the system
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2. We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog. QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT. The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers. When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order. For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request. If that HTTPS request is not successful, the downloader will issue an HTTP request. Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications. The downloader will use the filename of the script (ex
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Note that .hwp is the extension used by Hangul Word Processor from Hangul Office, which is very popular in South Korea
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: We believe that the source of all these stolen certificates could be the same Winnti group. Either this group has close contacts with other Chinese hacker gangs, or it sells the certificates on the black market in China
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Summary . The following knowledgebase will explain the uses of Net commands in Windows Operating Systems. More information . Net Commands On Windows Operating Systems . The following Net Commands can be used to perform operations on Groups, users, account policies, shares, and so on. NET . The "Net Accounts" command is used to set the policy settings on local computer, such as Account policies and password policies. This command can't be used on domain controller. When you type Net Accounts, you will see the default settings of the Account Lockout policy and Password Policy in local computer show as: The above settings displayed as per the role of the computer. Community Solutions Content Disclaimer . Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. User Account Control and remote restrictions - Windows Server Describes User Account Control (UAC) and remote restrictions in Windows Vista. auditpol get Reference article for the auditpol get command, which retrieves the system policy, per-user policy, auditing options, and audit security descriptor object. wevtutil Reference article for wevtutil, which lets you retrieve information about event logs and publishers. Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022 - Summary - More information - - - - Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: In this blog, we described how Redaman has become more effective by hiding dynamic C&amp;C server addresses inside the Bitcoin blockchain
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: Email* - - * I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. When opening the document, the user must click on the "Enable content" button, which enables macros (fig. 5 Example of an email message with a Word document, which, when opened, requires the user to click on the "Enable content" button to enable a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. In addition, Cobalt Strike enables users not to expose a fragment of memory allocated in the context of another process, the RWX (Read, Write, Execute) attributes, which often reveal injected code
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Recently, after looking at the difference between 0vercl0ck’s proof of concept and the real deal, a friend asked me “Why does PowerLoader go to all the trouble of using ROP chains instead of just executing the shellcode like 0vercl0ck does. PowerLoader gets the malicious code into the process by opening an existing, shared section already mapped into explorer, removing the need to allocate heap space or overwrite process memory. By opening “Shell_TrayWnd” and calling SetWindowLong, PowerLoader is able to set a variable used by the window procedure to point to a specific address in its shellcode. The read part won’t trigger DEP (Data Execution Prevention), if the section is not executable (in later versions of windows it is execute-protected), however if EAX points to an address inside the section, DEP will be triggered. Well how does one get from KiUserApcDispatcher to code execution, without executing the non-executable shellcode, I hear you ask. Next it pops the return address into the EAX and then calls it, this results in execution being transferred back to the Window Procedure. The sequences are instruction within the executable regions of explorer’s memory, their purpose is to perform certain operations as PowerLoader can’t execute any of its own code yet, due to the section being execute-protected. 00100E28 points to some code in explorer that executes the instruction “STD” followed by “RET”, As a result the instruction underlined in red will result in the direction flag being set and execution being returned to the Window Procedure. Well these bytes were found, in this case inside some random shell32 function (it doesn’t matter). Now the pointer doesn’t point to the start of the function, it points somewhere in the middle, as a result, only the bytes in the red box are executed. Remember: because all addresses points to executable code within explorer address space, and they are called using a pointer, no code in the shellcode is actually executed, thus resulting in no nasty DEP errors
MITRE ATT&CK techniques:
- T1055.011: Process Injection - Extra Window Memory Injection
Threat description: Then calls the fcL4qOb4 function to set the scheduled task and disguise as the one used by Google
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Once in the folder, this property list (plist) file will launch the CrashReporter program with the Maintain parameter on system load as Root for every user. Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches CrashReporter with the Maintain parameter and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004
MITRE ATT&CK techniques:
- T1569.001: System Services - Launchctl
Threat description: Researchers also observed that the backdoor downloads and executes the Cobalt Strike pentesting and post-exploitation toolkit on the victim's machine within some period of time after the infection. By deploying Cobalt Strike, it is clear that this stealthy backdoor is being used to gain a foothold in corporate networks so that ransomware can be deployed, data can be stolen, or network access could be sold to other threat actors
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Stop the running xmlprov service - Copy dropped xmlprov.dll and xmlrov.ini into the system32 directory and delete them from the current directory - Check if xmlProv service is installed or not and if it is not installed create the service through svchost.exe - Modify the xmlProv service values including type and binpath - Add xmlProv to the list of the services to be loaded by svchost - add xmlProv to the xmlProv registry key - Start the xmlProv service
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA
MITRE ATT&CK techniques:
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
Threat description: In this campaign, Earth Vetala threat actors used spearphishing emails and lure documents against organizations within the United Arab Emirates, Saudi Arabia, Israel, and Azerbaijan. The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Capabilities of the NETWIRE backdoor include key logging, reverse shell, and password theft. The backdoor uses a custom encryption algorithm to encrypt data and then writes it to a file created in the ./LOGS directory
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
- T1074.001: Data Staged - Local Data Staging
Threat description: If the ‘-p’ parameter has been passed into the command line, the loader proceeds to download the Team9 backdoor directly from the command and control server. One notable addition is the process injection (hollow process injection) when the backdoor has been successfully downloaded and decrypted. The loader injects the backdoor to one of the following processes
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1055.013: Process Injection - Process Doppelgänging
Threat description: The UprotectData() method treats the first two bytes of the Base64 decoded value as a two-byte XOR key
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network. These observations come from system log data, CrowdStrike Falcon® sensor telemetry, and the output of the Falcon Forensic Collector (a customized version of CrowdStrike’s freely distributed community tool, CrowdResponse
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name. They then identify the Exchange server and attempt to install the OwaAuth web shell. If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells. Within six hours of entering the environment, the threat actors compromised multiple systems and stole credentials for the entire domain
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.001: OS Credential Dumping - LSASS Memory
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Displays and modifies entries in the Address Resolution Protocol (ARP) cache, which contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. Used without parameters, arp displays help
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: We found that a domain admin account was compromised and the Active Directory audit tool PingCastle was run. Using the domain admin, the actor was able to compromise several other accounts and execute malicious services and persistence mechanisms, namely SDBbot RAT Loaders
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: KillDisk is designed to run with high privileges, this time it registers itself as a service under Plug-And-Play Support name
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Static Kitten is distributing at least two URLs that deliver two different ZIP files that are themed to be relevant to government agency employees. The URLs are distributed through phishing emails with lure and decoy documents. An example lure is shown in Figure 2 below
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: The attackers also used a malicious tool that they named BCS-server. This tool allows them to open a tunnel into an internal network and then this tunnel can be used to send and receive data between the C&amp;C server and even non-infected computers in the network. The main idea of this tool is based on the same principles as the XTUNNEL malware used by the Sednit group
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: PowerStallion is a lightweight PowerShell backdoor using Microsoft OneDrive, a storage service in the cloud, as C&amp;C server
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: 26, 2018) used a macro-based document that dropped a VBS file and an INI file. The INI file contains the Base64 encoded PowerShell command, which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: Emails dating more than three years prior to malware execution have been included in the collected EmailStorage folder, meaning that there may not be a date limit for the email enumerator. There is a lack of keywords or other limiting pattern by which specific email messages in local mailboxes were targeted for exfiltration. Kroll has identified instances where specific email messages were deleted within the EmailStorage folder. In some instances, the entire EmailStorage folder is deleted once messages have all been exfiltrated. Based on observed cases, there was no evidence that attachments were included in the collected data. Kroll collaborators at the National Cyber Forensics Training Alliance (NCFTA) observed Qakbot samples sending SMTP traffic indicative of outbound spam thread hijackings
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess
MITRE ATT&CK techniques:
- T1110.001: Brute Force - Password Guessing
Threat description: In the past we have seen others techniques that used Bitcoin blockchain to hide their C&amp;C server IP address, but in this blog we will share an analysis of the new technique
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: The first stage logic is performed by ‘mklgsecondary’ which serves the purpose of downloading a file named ‘chrome.txt’ from a C2 server using the BITS utility. The downloader modifies the Chrome shortcut using the same method previously described for the Telegram variant. The downloaded PE file (‘chrome.txt’/’mklgchrome’) gets executed each time the user starts Chrome, thereby running the real Chrome application as well as executing the MarkiRAT payload
MITRE ATT&CK techniques:
- T1197: BITS Jobs
- T1105: Ingress Tool Transfer
Threat description: Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system. The first named scheduled task launched an application whitelisting script protection bypass to execute a COM scriptlet that dynamically downloaded the first backdoor from APT32’s infrastructure and injected it into memory. The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script. In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file. Unit 42 has observed a total of two variants of Comnie. One of the ways the variants differ is in how they obtain their command and control (C2) information. Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: To inject the OpenSSH server configuration directly into memory, Ebury parses the sshd binary’s code section mapped in the same process looking for two different functions. If it fails, it downgrades security features by disabling SELinux Role-Based Access Control and deactivating PAM modules. When one of the functions is successfully resolved, Ebury will use this when the backdoor is used to tamper with sshd‘s configuration
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1556.003: Modify Authentication Process - Pluggable Authentication Modules
Threat description: The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members. 360 and Tuisec already identified some Gorgon Group members. In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group. While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas. fudpages One member of Gorgon Group- we're calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure. We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members. Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The main code is run in a separate thread: every 10 minutes, the application contacts the C&amp;C server motivation[.]neighboring[.]site and passes it the computer's identifier in the User-Agent string. The identifier is a SuperFastHash of the system volume serial number and the name of the computer
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
- T1082: System Information Discovery
Threat description: One significant change between DEATHRANSOM and FIVEHANDS is the use of a memory-only dropper, which upon execution, expects a command line switch of -key followed by the key value necessary to perform decryption of its payload. The payload is stored and encrypted with AES-128 using an IV of “85471kayecaxaubv”. The decrypted FIVEHANDS payload is immediately executed after decryption. To date, Mandiant has only observed encrypted droppers with a common imphash of 8517cf209c905e801241690648f36a97
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Before executing the main payload, the QakBot loader will first test the infected system to see if it is a good candidate for infection. Figure 5 below shows a high-level execution flow of the QakBot loader
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1. In this case, the malware attempts to identify other hosts on the network by checking the compromised system’s IP physical address mapping table. Next, it scans for other systems that are vulnerable to the SMB exploit and installs the malicious payload. Refer to the malware report, MIFR-10130295, for more details on these methods
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Tracing the origin of the hidden .mina file showed that it is a copy of an included resource, renamed SubMenu.nib, from the application bundle and where the main backdoor functions were contained. It also has the same links to Lazarus’ Windows and Linux predecessors: the presence of the hardcoded strings c_2910.cls and k_3872.cls. Both strings were previously used during C&amp;C communication to the domain thevagabondsatchel[.]com as the sample storage of the cybercriminal group, as reported by 360 Netlab researchers
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1027: Obfuscated Files or Information
Threat description: The threat actor in this case hosted the MSI file on GitHub using a spoofed file extension to look like a PDF
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The most common ports used are, 80, 1985, 1986, and 443. 1985 is the default port for the malware, 1986 is the lazy variation of that port. Port 80 and 443 are the default ports for HTTP and HTTPS traffic. The next most common is port 53. This is used in some of the newer 3.22 and 3.39 samples. After that, the count for each port starts declining sharply
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Then, it encrypts it with 3DES before sending it (figure 28). The _P.Y ("0295A. 1618C") method in figure 26 creates the MD5 hash of the string. This hash is used as secret for the 3DES encryption
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. This persistence file is also set to hidden with a randomly generated file date and time
MITRE ATT&CK techniques:
- T1543.004: Create or Modify System Process - Launch Daemon
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: Extract the encoded payload. Decrypt the extracted payload. This uses the AES algorithm in CBC mode. Decompress the decrypted payload. This uses the LZMA algorithm. Decrypt the decompressed payload. This is simple XOR with byte key and as such does not impact compression ratio. Execute the decrypted payload as shellcode
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: This function will either bind the calling process to a port or has the calling process connect to a remote host. The function is called in the following manner
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: Emotet is one of the most widely distributed and actively developed malware families on the crimeware landscape today. Emotet began purely as a banking trojan, but over the years, has continued to evolve and more recently, has been associated with some larger-scale targeted Ryuk ransomware infections. Emotet is commonly delivered via both macro-laden office documents, as well as URL-based spam messages that lead to an eventual infection. It's not uncommon to see Emotet reuse of some of the command and control (C2) servers over more extended periods. The goal of Emotet, as is the case with crimeware-based threats, is monetary. Attackers use Emotet to deliver modular payloads it can use to monetize infections
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services. Then the attacker looks for all administrator accounts on both the local machine and the network. This reflects the Poseidon Group’s familiarity with Windows network administration
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1057: Process Discovery
Threat description: The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. According to Group-IB researchers, APT41 usually parks their domains for some time at 127.0.0.1 after their campaigns are over. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers. In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry. The contents of the file "install.bat" from APT41's This is Not a Test campaign
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Among infostealers used by the Kimsuky group, some samples have been found that use FTP to download additional malware after logging infected targets to the C&amp;C [14, 15
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Win32CmDll.dll first tries to inject the ManagerMain and GuardClient modules into a process with one of the following names: lsass.exe, wininit.exe or lsm.exe. If that fails, it tries to inject into one of the registered windows services processes, excluding processes named spoolsv.exe, ekrn.exe (ESET), avp.exe (Kaspersky) or dllhost.exe. As a last option, if everything else failed, it tries to use the processes taskhost.exe, taskhostw.exe or explorer.exe
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: We have most definitely observed Kimsuky targeting specific individuals — in fact, up to the present moment — even going as far as registering Internet domains containing the individual targets' names, the PwC analyst said
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript file is given a name that impersonates legitimate Windows tasks and is either stored in the registry of the compromised system or in an obfuscated format on disk
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: In order to discover potential targets and locate the information it needs to authenticate against, the script passively collects data from /.ssh/config, .bash_history, /.ssh/known_hosts, and the likes. We did not identify any active scanning techniques used to identify additional targets
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. It also modifies several registry keys, including setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1562.006: Impair Defenses - Indicator Blocking
Threat description: TClient will use SSL to connect to Tropic Trooper’s C&amp;C server. This allows Tropic Trooper’s operators to easily change/update the C&amp;C server and configure other values
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: Each targeted file is opened, read, encrypted in memory, and then written to a new file in the malware’s working directory using the filename format &lt;random number&gt;.WNCRYT. The files are then renamed to their original filename followed by the .WINCRY extension and moved to their original directory. The taskdl.exe process launched by the malware periodically deletes the remaining WINCRYT temporary files. The encryption process does not directly overwrite file data, so forensic recovery of file contents may be possible depending on the environment. The entire contents of the file are encrypted and saved with a custom header (see Figure 7
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Next, BoomBox AES-encrypts the host information string above using the hardcoded encryption key “123do3y4r378o5t34onf7t3o573tfo73” and initialization vector (IV) value “1233t04p7jn3n4rg”. To masquerade the data as contents of a PDF file, BoomBox prepends and appends the magic markers for PDF to the AES-encrypted host information string above
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1036: Masquerading
Threat description: For example, Monash University, located in Australia, has been a popular Silent Librarian target. Like the overall content of their lures, the subject lines of Silent Librarian phishing emails have remained consistent over time. Phishing Pages . We have identified 127 different domains used to host Silent Librarian phishing sites since 2013. Like a growing number of phishing sites, domains registered by Silent Librarian generally use Freenom top-level domains (TLDs) (.TK, . CF, .GA, .GQ, .ML) because they are available at no cost. Some of the other recent TLDs associated with Silent Librarian domains include .IN, .IR, .INFO, .LINK, and .TOP. Legitimate American University Library Login URL (above) . Silent Librarian Phishing URL (January 2018) . The content of Silent Librarian phishing pages is almost identical to the legitimate target sites. The actors likely scrape the original HTML source code from the legitimate library login page, then edit the references to resources used to render the webpage (images, JavaScript, CSS, etc. An analysis of the Silent Librarian kits identified two email accounts that were used to receive compromised victim credentials. Similarly, the credentials stolen in the Silent Librarian phishing attacks we identified were sold on an Iranian website; however, it is not one of the sites specified in the indictment. Using a combination of technical and open source research, we identified another website, Uniaccount[.]ir, that was used to sell the credentials compromised in the Silent Librarian phishing attacks
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: The use of an initial reconnaissance document allows Inception to profile the target’s computer and potentially customize any subsequent malicious document to exploit known vulnerabilities in unpatched software on the computer
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: The backdoor installer will drop a normal sidebar.exe file (a Windows Gadget tool, a feature already discontinued by Windows), a malicious loader (in "C:\ProgramData\Apple\Update\wab32res.dll"), and an encrypted configuration file
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Spear phishing, including the use of probably compromised email accounts. Lure documents using CVE-2017-11882 to drop malware. Stolen code signing certificates used to sign malware. Use of bitsadmin.exe to download additional tools. Use of PowerShell to download additional tools. Using C:\Windows\Debug and C:\Perflogs as staging directories. Using Windows Management Instrumentation (WMI) for persistence. Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: After the configuration is parsed, Cardinal RAT will proceed with making attempts at connecting with the C2. Using an example request and response from a C2 server, we can see how this traffic is configured
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. Mandiant identified a utility script named kill.bat that was run on systems in the environment. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc. Domain administrators have complete control over Windows systems in an Active Directory environment
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: The first stage implant that is nested in the DOTM file, is using triple base64 encoding in the Visual Basic Macro - The extracted DLL (desktop.dat) is packed with the Themida packer attempting to make analysis more difficult
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as
MITRE ATT&CK techniques:
- T1571: Non-Standard Port