QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: KillDisk’s infection chain . How is it dropped in the system. This KillDisk variant looks like it is intentionally dropped by another process/attacker. The new KillDisk variant’s parameter to shut down the affected machine . KillDisk also has a self-destruct process, although it isn’t really deleting itself. Code snippets showing how KillDisk overwrites then deletes files . How does it wipe the disk. It reads the Master Boot Record (MBR) of every device it successfully opens and proceeds to overwrite the first 0x20 sectors of the device with “0x00”. It uses the information from the MBR to do further damage to the partitions it lists. KillDisk has a numeric parameter that denotes the number of minutes (15 being the default) it will wait before it shuts down the affected machine. To try to reboot the machine, it will try to terminate these processes: This is done most likely to force a reboot or dupe the user into restarting the machine. Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Accept Cancel Continue Processing the data, please give it a few seconds
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: Bisonal used multiple lure documents to entice their victims to open and then be infected with Bisonal malware. Finally, in 2018, Ahnlab released a paper about "Operation Bitter Biscuit" where Bisonal was used against Korean and Japanese entities. This is an application document that has been used to provide a decoy to the Bisonal malware. The attacker also implemented a new order: execution of a command by using named pipe to get the output of the executed command. This mechanism allows the malware to execute API functions without ever using the Call instruction, making it difficult to perform the analysis. So that it ensures the thread has a chance to run, it will return the API call sleep() no matter what was originally requested. Office Extension . In 2019, the actor behind Bisonal used a new way to deploy the machine on the target's systems. The purpose of the malware is to deploy Bisonal on the infected system ($tmp$\tmplogon.exe) and to create a Run registry key in order to execute Bisonal at the next reboot of the system. The attacker implements indirect API calls by using GetProcAddress() and LoadLibrary() API. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: NetPass.exe: a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. WebBrowserPassView: a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. Mail PassView: a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet then writes the service component on the system, which writes Emotet onto the disk
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. On the left a sample from Bisonal 2014 and on the right Bisonal 2011
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: We have seen Grandoreiro use DGA functions to generate a connection to a Google Sites page storing C2 information
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: When the .lnk file is initialized, it spawns a CMD process. This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack. The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Due to its complex infection process that relies in part on registry updates with malware code, Valak can easily infect an unprotected Windows host. With ADS used to hide follow-up malware from a Valak infection, the risk is greatly increased
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. This was probably done to avoid them being written to the file system
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1570: Lateral Tool Transfer
Threat description: Talos has identified two different infection vectors associated with this particular campaign. In order to compromise their victims, the threat actors sent the trojanized Microsoft Word documents, probably via email. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: This script is meant to delete the Pony Loader after execution (works in a loop, in order to wait for the sample to terminate). The same can be found in Pony 1.9 code
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Recently, a newer version was found in-the-wild, abusing NTFS Alternate Data Streams (ADS) in order to store the content of malicious payloads downloaded during execution. The main vector used by the group is sending malicious files in compressed format, attached to email. File types vary from VBS to LNK; the most recent campaign started to attach an HTML file which executes Javascript for downloading a malicious file
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1059.005: Command and Scripting Interpreter - Visual Basic
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: The attack starts with a malicious XLS attachment, sent in a phishing email, containing an obfuscated macro that downloads a heavily packed second-stage downloader. The second stage fetches the encrypted third-stage, which includes three layered encrypted Lokibot. After a privilege escalation, the third stage deploys Lokibot
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Naming conventions designed to blend into normal operations (e.g. amsc.exe, msvsvr.dll, alg.exe) - Dropping implants in folders named for legitimate software (e.g
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: The password-protected ZIP attachments contain a Microsoft Word document with macros to install malware. See Appendix A for examples of these Word documents from June 2020. Prior to April 2020, the most common malware caused by Word documents associated with Shathak/TA551 was Ursnif. Since April 2020, the most common malware distributed by these Word documents has been Valak. Appendix C lists a series of Valak DLL examples from June 2020
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The first lateral movement occurred to the domain controller not affected by the use of CVE-2020-1472. An executable was transferred to it via SMB using a domain administrator account
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: The tools uploaded to the webshells range from legitimate applications such as cURL to post-exploitation tools such as Mimikatz. We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
- T1588.002: Obtain Capabilities - Tool
- T1027: Obfuscated Files or Information
Threat description: Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. This campaign targets organizations in South Asia. ObliqueRAT has been linked to the Transparent Tribe APT group in the past. This campaign hides the ObliqueRAT payload in seemingly benign image files hosted on compromised websites
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: This is used to maintain access to a Meterpreter session. It is saved to C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: REvil sends the encrypted stat data containing the host profile and malware information to the C2 URL via the HTTP POST method. Detection of the associated network traffic is challenging because REvil uses the HTTPS protocol, which encrypts the network communication. The malware reads the subsequent C2 server response but implements no logic to act on the received data. Finally, REvil terminates execution
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: DEATHRANSOM is written in C while the other two families are written in C++. DEATHRANSOM uses a distinct series of do/while loops to enumerate through network resources, logical drives, and directories
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Taking advantage of the unprotected open Docker API port, the attackers are able to instantiate an Ubuntu container with the following entry point
MITRE ATT&CK techniques:
- T1609: Container Administration Command
Threat description: 1) NetPass.exe is a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. 3) WebBrowserPassView is a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. 4) Mail PassView is a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet writes the service component on the system, which writes Emotet onto the disk. Emotet’s access to SMB can result in the infection of entire domains (servers and clients
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake. The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request's cookie in the PHPSESSID field, as seen in the example GET request
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Let's use the example data 8,54351-1616479009,0 from a beacon sent from the payload to the C2, which it will encode using base64 to OCw1NDM1MS0xNjE2NDc5MDA5LDA=, append the @ symbol and embed within a BMP image. The 8-bits of this base2 representation are then used to set specific bits within the 3-bytes for each pixel
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: After all of the data is gathered, the malware starts communication with the C&amp;C server by periodically sending HTTP POST requests to the following URL on the received domain
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: The first evidence of its intrusion dated from May 6, 2015 but activity appeared to have begun in earnest on May 12. The attackers appeared to be interested in one division of the ministry that is responsible for relations with the Asia-Pacific region. They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
- T1083: File and Directory Discovery
Threat description: Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware has evolved over time
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: While historically TA416 has delivered Zip files from cloud hosting providers containing a decoy file, legitimate PE file, a DLL loader, and a PlugX malware configuration DAT file, recent campaigns used a different tactic. Proofpoint researchers noted that the malicious Zip files delivered from DropBox now contain a rudimentary executable which is a dropper malware. This malware establishes persistence for a legitimate executable file used in DLL search order hijacking, as well as initiates the download of four components. These components are included below and resemble the components used in the past to install PlugX malware. Public research has previously documented TA416’s propensity for including PlugX Trident Loader components and decoy in the initial delivered Zip file. The method of installing PlugX via DLL Search Order hijacking that displays a PDF decoy remains constant
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: uid= and writes a JSS Loader binary to %TEMP%\PaintHelper.exe. JSS Loader, which has both .NET and C++ versions, has multiple capabilities, including the ability to load additional executables, PowerShell (PS) and JavaScript (JS) files
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1105: Ingress Tool Transfer
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: The actor behind Bisonal is clearly motivated and has an interest in Russian, Korean and Japanese victims. The development of Bisonal has been active for more than a decade. However, specific functions are still used today, many years after the original implementation of the Bional malware. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors. For example, in one campaign they put the domain name of the C2 server in plaintext in the malware which had the function to generate a non-ASCII string for the C2 servers once decoded. In this condition, the malware cannot work on the compromised system. With this investigation and the analysis of this decade of activity, we hope to force this actor to innovate by providing a better understanding of his arsenal and more specifically how Bisonal works
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: TA505 briefly distributed the Kegotip information stealer in April 2017. Across two campaigns of several million messages each, the actor used both macro-laden Microsoft Word documents and zipped VBScript attachments to install the Trojan on potential victim PCs. Kegotip is an infostealer (credentials and email addresses) used to facilitate other crimeware activities. It steals credentials from various FTP clients, Outlook, and Internet Explorer. It also will gather email addresses scraped from files stored on the computer. This information can be used to facilitate future spam campaigns by the perpetrator or may be sold to other actors
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Note: see the appendix for a list of the domains, file names, and malware MD5 hash values used to facilitate this activity
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: Register as a startup program in HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run if it has no privileged (Figure 6). Otherwise, it will register itself as a system service (Figure 7
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The two resources that contain commands that ISMInjector uses for persistence are named “Tsk1” and “Tsk2”. The specific commands within each of these resources are within Table 1. At a high level, the“Tsk1” command creates a scheduled task named “ReportHealth” that is meant to run a payload saved to "%localappdata%\srvHealth.exe” every 4 minutes. The “Tsk2” command creates a scheduled task that runs every 2 minutes that is responsible for saving the payload to srvHealth.exe. This task saves the payload to this location using the “certutil” command to decode the original payload saved to “srvBS.txt
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: This technique to hijack control flow has also been used by other sophisticated attackers such as FinFisher. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1106: Native API
Threat description: APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts, sometimes coupled with social engineering tactics. In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware. The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: The encryption style does not differ significantly from other prominent ransomware families. WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives. Once the eligible drives are located, the ransomware will begin the encryption process
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: It implements a simple custom-built virtual machine mechanism that will execute an embedded bytecode to decode and inject the payload into memory
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Tonto Team is an APT group active since at least 2009 and targeting governments and institutions mostly based in Russia, Japan and Mongolia. For more than ten years, Tonto Team has been using the Bisonal RAT. Tonto Team is one of the APT groups that now has access to the ShadowPad backdoor
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1505.003: Server Software Component - Web Shell
- T1105: Ingress Tool Transfer
Threat description: The Bazar loader files are dual-extension executable files (such as PreviewReport.DOC.exe) signed with fake certificates such as VB CORPORATE PTY. This is consistent with the Trickbot group, which notoriously abuses the trust of certificate authorities by using signed loaders and malware to evade security product detection
MITRE ATT&CK techniques:
- T1036.007: Masquerading - Double File Extension
Threat description: In addition to loading the communications module, the initial macro described above configures a persistence mechanism for this malware loader by setting up a Registry Run key. The non-concatenated command included in the macro that establishes persistence for Libcurl.dll and the hash for this sample are included below
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Operation North Star C2 infrastructure consisted of compromised domains in Italy and other countries. Compromised domains belonged, for example, to an apparel company, an auction house and printing company. These URLs hosted malicious DOTM files, including a malicious ASP page
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). The signature was signed with a code signing certificate purchased by the same user as the SSL certificate for jmttrading[.]org (Obtain Capabilities: Code Signing Certificates [T1588.003]). The MSI Installer asks the victim for administrative privileges to run (User Execution: Malicious File [T1204.002
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: These platforms are used to exfiltrate documents and receive instructions. Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire. The tokens for each platform are hardcoded within the sample
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: HAWKBALL is a backdoor that attackers can use to collect information from the victim, as well as to deliver payloads. HAWKBALL is capable of surveying the host, creating a named pipe to execute native Windows commands, terminating processes, creating, deleting and uploading files, searching for files, and enumerating drives
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Several files are created by Carbon to keep logs, tasks to execute and configuration that will modify the malware’s behavior
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials. Seedworm uses off-the-shelf, unmodified versions of these tools as well as custom-compiled variants which we have determined are only used by this group
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. Once executed in memory, the corrupter locates files in certain directories on the system with one of the following hardcoded file extensions
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The encrypted request includes a PC identifier and timestamp, and optionally some other data. It is worth noting that the RC2FM module uses a number of encryption methods (variations of a simple XOR encryption routine), unlike the other InvisiMole parts
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: In these cases, the temporary file is written to the %TEMP% directory, and the filename is a combination of numbers generated from a call to GetTickCount and the '.dat' extension (e.g
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: In the past, this APT has relied on Hangul Office documents (hwp files) to target victims, as it’s software that’s commonly used in South Korea. However, in this blog we describe an interesting alternative method, delivered via self-decoding VBA Office files
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Post-compromise, APT39 leverages custom backdoors such as SEAWEED, CACHEMONEY, and a unique variant of POWBAT to establish a foothold in a target environment. Internal reconnaissance has been performed using custom scripts and both freely available and custom tools such as the port scanner, BLUETORCH
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1046: Network Service Discovery
Threat description: Snippets of HOLMIUM PowerShell backdoor (POWERTON) implementing two different persistence mechanisms: WMI event subscription (T1084) and Registry run keys or Startup folder (T1060
MITRE ATT&CK techniques:
- T1546.003: Event Triggered Execution - Windows Management Instrumentation Event Subscription
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The ZIP archive contains a malicious portable executable (PE) file with embedded HTML application (HTA). The user has to unzip the archive and double-click the executable for the infection chain to continue. The PE file is a simple HTA script compiled into an executable. When the user double-clicks the executable, the malicious HTA file is extracted to %temp% and executed by mshta.exe
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: The two dropped artifacts – a payload DLL and a Word document – are written to the “Users\&lt;Log on User&gt;\” folder (the document will replace the opened malicious document with clean stub after killing the running Word process
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. CTU researchers identified two versions of Daserf written in Visual C and Delphi. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. RarStar HTTP POST request. Use malware to upload the large list of enumerated files to the C2 server. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Step 6: After obtaining the fully privileged handle of Taskmgr.exe, the actor uses this handle to execute cmd as high privilege process to execute install.bat
MITRE ATT&CK techniques:
- T1134.004: Access Token Manipulation - Parent PID Spoofing
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: The threat actors can execute remote commands by running this specialized module with predefined actions. This module attempts to execute a command. It uses the PowerShell Invoke-Expression method for the PowerShell-based module, while its C# implementation has both cmd and PowerShell options
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: OFF ON Vision Impaired Profile Enhances website's visuals This profile adjusts the website, so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. This website utilizes various technologies that are meant to make it as accessible as possible at all times. We utilize an accessibility interface that allows persons with specific disabilities to adjust the website’s UI (user interface) and design it to their personal needs. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. In this process, we provide screen-readers with meaningful data using the ARIA set of attributes. It will also extract texts embedded within the image using an OCR (optical character recognition) technology. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Additional UI, design, and readability adjustments . 1) Font adjustments – users can increase and decrease its size, change its family (type), adjust the spacing, alignment, line height, and more. 7) Additional functions – we allow users to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions. Still, we are continually improving our accessibility, adding, updating, improving its options and features, and developing and adopting new technologies
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: NewBCtestDll, NewBCtestnDll Module that is a reverse proxy and is able to execute commands. Module that is a reverse proxy and is able to execute commands. vncDll Module used as a RAT on the victim machine. Module used as a RAT on the victim machine. vpnDll Module used to create VPN proxy routed to a given address. Module used to create VPN proxy routed to a given address. rdpscanDll Module used for brute forcing RDP on a certain list of targets. Module used for brute forcing RDP on a certain list of targets. bcClientDllTestTest An old module used to proxy Trickbot operator traffic through a victim machine. An old module used to proxy Trickbot operator traffic through a victim machine
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: On June 21st, 2017 an attacker breached one of our monitored systems by brute-forcing SSH credentials using two IPs known to be part of the TOR network
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: DHS and FBI identified the threat actors leveraging remote access services and infrastructure such as VPN, RDP, and Outlook Web Access (OWA). The threat actors used the infrastructure of staging targets to connect to several intended targets
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1114.002: Email Collection - Remote Email Collection
Threat description: While investigating these files, we observed what we believe was active development on these .cmd files that helps illuminate the Gamaredon group’s processes
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082]) - Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083]) - Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001]) - Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057]) - Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033]) - Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217]) - Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016]) - Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012]) - Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010]) - Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087]) - Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
- T1518.001: Software Discovery - Security Software Discovery
- T1033: System Owner/User Discovery
- T1083: File and Directory Discovery
- T1082: System Information Discovery
Threat description: BRONZE UNION uses various tools for credential theft. In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands. Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1027: Obfuscated Files or Information
Threat description: PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome, Firefox, and Internet Explorer to a file. This tool was previously observed during a Mandiant incident response in 2018 and, to date, solely utilized by APT34
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003.004: OS Credential Dumping - LSA Secrets
- T1555: Credentials from Password Stores
- T1552.001: Unsecured Credentials - Credentials In Files
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: Static analysis of this executable shows only two functions, but a regular number of imports. Upon detecting a debugger attached to it, the malware will display the message below and terminate the execution. This packer also hides the calls to API functions. This time instead of using a dispatcher function, the malware pushes the arguments into the stack as usual but will then perform a call to a jump table built during the unpacking, in the .text section memory region. Each entry finishes with a jmp instruction into the respective API function. Effectively the malware doesn't do any call to API functions, it always performs a jump. The end result is the same has in the packer from 2016, but with a simpler mechanism. One of the anti-analysis features included in this packer is the lack of calls to API functions. In the early stages of execution, the malware loads the libraries and retrieves the addresses from functions it needs. Feature-wise, there is no change when compared with the 2016 version, in fact when compared the C2 beaconing functions even share some of the offsets
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. File listing plugin: Works on local or remote drives and can map additional paths when given credentials
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1083: File and Directory Discovery
Threat description: The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The PlugX malware can be configured to use HTTP, DNS, raw TCP, or UDP to avoid network-based detection. In one sample analyzed by CTU researchers, PlugX was configured with hard-coded user credentials to bypass a proxy that required authentication. Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1071.004: Application Layer Protocol - DNS
- T1095: Non-Application Layer Protocol
Threat description: Those files are then uploaded via unencrypted HTTP, one after another. Examining the network packets showed that they contained a string with two pieces of information: a file path and a random string of characters
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1041: Exfiltration Over C2 Channel
Threat description: STOLEN INFO’ message – bot message to C2 with stolen information like passwords, accounts, emails, etc. Stolen information is RC4 encrypted and Base64 encoded. The key for the RC4 encryption is generated in a different way and based on the infected system ID (aka Bot ID) values, and not based on a static string as in the case of traffic encryption
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. To gain higher privileges mshlpweb.dll execute the Windows Update Standalone Installer, wusa.exe. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013. This strangeness was related to values listed in newer BlackEnergy configuration files. As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system. The config file provides download instructions for the loader. In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing. Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server. This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: NOBELIUM has been observed modifying Azure AD to enable long-term persistence and access to sensitive information. This can include the creation of users, consent of Azure AD applications, granting of roles to users and applications, creation of additional service principal credentials, and more. In one incident, MSTIC observed the use of Azure RunCommand, paired with Azure admin-on-behalf-of (AOBO), as a technique to gain access to virtual machines and shift access from cloud to on-premise. NOBELIUM has demonstrated an ongoing interest in targeting privileged users, including Global Administrators. NOBELIUM is frequently observed conducting activities consistent with intelligence collection
MITRE ATT&CK techniques:
- T1087.004: Account Discovery - Cloud Account
Threat description: Next, REvil checks the configuration field dbg to see if it’s running in debug mode. If that is not the case, geolocation checks based on the system’s language and the keyboard layout are conducted so the ransomware does not attempt to encrypt files on whitelisted systems. The following are whitelisted system language IDs for the analyzed sample
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: The group has the capability to set up phishing infrastructure to mimic well known websites and trick victims to enter their credentials. This is one of the main methods used by this actor to collect email addresses that later will be used to send spearphishing emails. The group is still using similar phishing models previously mentioned in the KISA report with some small changes
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1589.002: Gather Victim Identity Information - Email Addresses
Threat description: The export called “SendDataToServer_2” does exactly what the name means: it encrypts all collected data, encodes it using Base64 encoding and calls its additional library to send the data to the C2 server. The names of the C2 servers are hardcoded
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: The user receives a phishing email with a ZIP attachment containing an Office document with embedded macros, the document itself or a link to download malicious document. The user opens the malicious attachment/link and is tricked into clicking “Enable content”. - A malicious macro is executed. One of the encrypted resources has the DLL binary (loader) which is decrypted later during runtime
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: Helminth relies on the following shortcut for persistence, as it runs the Trojan each time the system starts using the following command line
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These tools included a fast reverse proxy (frp), Secure Socket Funneling (SSF), and Venom
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack. cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic