sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Mafalda has been obfuscated and contains encrypted functions.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Mafalda can send network system data and files to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Mafalda can establish an SSH connection from a compromised host to a server.
MITRE ATT&CK technique: T1133: External Remote Services
Mafalda can search for files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Mafalda can download additional files onto the compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mafalda can conduct mouse event logging.
MITRE ATT&CK technique: T1056: Input Capture
Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Mafalda can dump password hashes from `LSASS.exe`.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Mafalda can place retrieved files into a destination directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Mafalda can create a token for a different user.
MITRE ATT&CK technique: T1134.003: Access Token Manipulation- Make and Impersonate Token
Mafalda can manipulate the system registry on a compromised host.
MITRE ATT&CK technique: T1112: Modify Registry
Mafalda can use a variety of API calls.
MITRE ATT&CK technique: T1106: Native API
Mafalda can use raw TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.
MITRE ATT&CK technique: T1205.001: Traffic Signaling- Port Knocking
Mafalda can execute PowerShell commands on a compromised machine.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Mafalda can collect a Chrome encryption key used to protect browser cookies.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Mafalda can enumerate running processes on a machine.
MITRE ATT&CK technique: T1057: Process Discovery
Mafalda can enumerate Registry keys with all subkeys and values.
MITRE ATT&CK technique: T1012: Query Registry
Mafalda can take a screenshot of the target machine and save it to a file.
MITRE ATT&CK technique: T1113: Screen Capture
Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Mafalda can create a remote service, let it run once, and then delete it.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Mafalda can encode data using Base64 prior to exfiltration.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Mafalda can encrypt its C2 traffic with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Mafalda can collect the computer name and enumerate all drives on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Mafalda can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Mafalda can use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Mafalda can execute shell commands using `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MailSniper can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
MailSniper can be used for password spraying against Exchange and Office 365.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
MailSniper can be used for searching through email in Exchange and Office 365 environments.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Manjusaka gathers credentials from Chromium-based browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Manjusaka data exfiltration takes place over HTTP channels.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Manjusaka can gather information about specific files on the victim system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Manjusaka can take screenshots of the victim desktop.
MITRE ATT&CK technique: T1113: Screen Capture
Manjusaka communication includes a client-created session cookie with base64-encoded information representing information from the victim system.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Manjusaka performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.
MITRE ATT&CK technique: T1082: System Information Discovery
Manjusaka gathers information about current network connections, local and remote addresses associated with them, and associated processes.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Manjusaka has used HTTP for command and control communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Manjusaka can execute arbitrary commands passed to it from the C2 controller via `cmd.exe /c`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MarkiRAT can use BITS Utility to connect with the C2 server.
MITRE ATT&CK technique: T1197: BITS Jobs
MarkiRAT can capture clipboard content.
MITRE ATT&CK technique: T1115: Clipboard Data
MarkiRAT can upload data from the victim's machine to the C2 server.
MITRE ATT&CK technique: T1005: Data from Local System
MarkiRAT can exfiltrate locally stored data via its C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MarkiRAT can capture all keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
MarkiRAT can store collected data locally in a created .nfo file.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.
MITRE ATT&CK technique: T1106: Native API
MarkiRAT can gather information from the Keepass password manager.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
MarkiRAT can search for different processes on a system.
MITRE ATT&CK technique: T1057: Process Discovery
MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.
MITRE ATT&CK technique: T1113: Screen Capture
MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.
MITRE ATT&CK technique: T1518: Software Discovery
MarkiRAT can obtain the computer name from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
MarkiRAT can retrieve the victim’s username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Matryoshka is capable of providing Meterpreter shell access.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Matryoshka is capable of stealing Outlook passwords.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Matryoshka uses DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Matryoshka is capable of keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Matryoshka can establish persistence by adding Registry Run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Matryoshka is capable of performing screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Maze has injected the malware DLL into a target process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.
MITRE ATT&CK technique: T1070: Indicator Removal
Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
MITRE ATT&CK technique: T1106: Native API
Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Maze has gathered all of the running system processes.
MITRE ATT&CK technique: T1057: Process Discovery
Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.
MITRE ATT&CK technique: T1564.006: Hide Artifacts- Run Virtual Instance
Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Maze has stopped SQL services to ensure it can encrypt any database.
MITRE ATT&CK technique: T1489: Service Stop
Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.
MITRE ATT&CK technique: T1082: System Information Discovery
Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Maze has communicated to hard-coded IP addresses via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
The Maze encryption process has used batch scripts with various commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
MechaFlounder has the ability to upload and download files to and from a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
MechaFlounder uses a python-based payload.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
MechaFlounder has the ability to use base16 encoded strings in C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
MechaFlounder has the ability to identify the username and hostname on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MechaFlounder has the ability to use HTTP in communication with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MechaFlounder has the ability to run commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MegaCortex can enable SeDebugPrivilege and adjust token privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
MegaCortex has changed user account passwords and logged users off the system.
MITRE ATT&CK technique: T1531: Account Access Removal
MegaCortex has used code signing certificates issued to fake companies to bypass security controls.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
MegaCortex has used a Base64 key to decode its components.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
MegaCortex was used to kill endpoint security processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
MegaCortex can wipe deleted data from all drives using cipher.exe.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
MegaCortex loads injecthelper.dll into a newly created rundll32.exe process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
MegaCortex can parse the available drives and directories to determine which files to encrypt.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MegaCortex has deleted volume shadow copies using vssadmin.exe.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
MegaCortex has added entries to the Registry for ransom contact information.
MITRE ATT&CK technique: T1112: Modify Registry
After escalating privileges, MegaCortex calls TerminateProcess, CreateRemoteThread, and other Win32 APIs.
MITRE ATT&CK technique: T1106: Native API
MegaCortex has used rundll32.exe to load a DLL for file encryption.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
MegaCortex can stop and disable services on the system.
MITRE ATT&CK technique: T1489: Service Stop
MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
MegaCortex has used .cmd scripts on the victim's system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Melcoz has been distributed through an AutoIt loader script.
MITRE ATT&CK technique: T1059.010: Command and Scripting Interpreter- AutoHotKey & AutoIT
Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Melcoz can monitor content saved to the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Melcoz has the ability to steal credentials from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Melcoz can use DLL hijacking to bypass security controls.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Melcoz has the ability to download additional files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Melcoz has gained execution through victims opening malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Melcoz can use MSI files with embedded VBScript for execution.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Melcoz has been packed with VMProtect and Themida.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Melcoz has been spread through malicious links embedded in e-mails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.
MITRE ATT&CK technique: T1565.002: Data Manipulation- Transmitted Data Manipulation
Melcoz can use VBS scripts to execute malicious DLLs.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Metamorfo can enumerate all windows on the victim’s machine.
MITRE ATT&CK technique: T1010: Application Window Discovery
Metamorfo's C2 communication has been encrypted using OpenSSL.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.
MITRE ATT&CK technique: T1119: Automated Collection
Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.
MITRE ATT&CK technique: T1115: Clipboard Data
Metamorfo has digitally signed executables using AVAST Software certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Metamorfo has side-loaded its malicious DLL file.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Metamorfo has used YouTube to store and hide C&C server domains.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Metamorfo has injected a malicious DLL into the Windows Media Player process .
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Metamorfo has encrypted payloads and strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Metamorfo can send the data it collects to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Metamorfo has deleted itself from the system after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Metamorfo has hidden its GUI using the ShowWindow WINAPI call.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.
MITRE ATT&CK technique: T1070: Indicator Removal
Metamorfo has used MSI files to download additional files to execute.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Metamorfo includes payloads written in JavaScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.
MITRE ATT&CK technique: T1112: Modify Registry
Metamorfo has used mshta.exe to execute a HTA payload.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Metamorfo has used MsiExec.exe to automatically execute files.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Metamorfo has used native WINAPI calls.
MITRE ATT&CK technique: T1106: Native API
Metamorfo has used raw TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Metamorfo has communicated with hosts over raw TCP on port 9999.
MITRE ATT&CK technique: T1571: Non-Standard Port
Metamorfo has downloaded a zip file for execution on the system.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
Metamorfo has performed process name checks and has monitored applications.
MITRE ATT&CK technique: T1057: Process Discovery
Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Metamorfo can collect screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
Metamorfo collects a list of installed antivirus software from the victim’s system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Metamorfo had used AutoIt to load and execute the DLL payload.
MITRE ATT&CK technique: T1129: Shared Modules
Metamorfo has searched the compromised system for banking applications.
MITRE ATT&CK technique: T1518: Software Discovery
Metamorfo has used VMProtect to pack and protect files.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Metamorfo has been delivered to victims via emails with malicious HTML attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Metamorfo has encrypted C2 commands with AES-256.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Metamorfo has collected the hostname and operating system version from the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Metamorfo has collected the username from the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Metamorfo uses JavaScript to get the system time.
MITRE ATT&CK technique: T1124: System Time Discovery
Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.
MITRE ATT&CK technique: T1565.002: Data Manipulation- Transmitted Data Manipulation
Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Metamorfo has used VBS code on victims’ systems.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Metamorfo has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Metamorfo has used cmd.exe /c to execute files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Meteor has the ability to change the password of local users on compromised hosts and can log off users.
MITRE ATT&CK technique: T1531: Account Access Removal
Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.
MITRE ATT&CK technique: T1485: Data Destruction
Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Meteor can use group policy to push a scheduled task from the AD to all network machines.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Meteor can hide its console window upon execution to decrease its visibility to a victim.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Meteor has the ability to download additional files for execution on the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Meteor can change both the desktop wallpaper and the lock screen image to a custom image.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.
MITRE ATT&CK technique: T1106: Native API
Meteor can use PowerShell commands to disable the network adapters on a victim machines.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.
MITRE ATT&CK technique: T1057: Process Discovery
Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If { $.Disable } }" > NUL`.
MITRE ATT&CK technique: T1489: Service Stop
Meteor has the ability to discover the hostname of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Meteor can use `wmic.exe` as part of its effort to delete shadow copies.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
MgBot can capture input and output audio streams from infected devices.
MITRE ATT&CK technique: T1123: Audio Capture
MgBot can capture clipboard data.
MITRE ATT&CK technique: T1115: Clipboard Data
MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
MgBot includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.
MITRE ATT&CK technique: T1213: Data from Information Repositories
MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.
MITRE ATT&CK technique: T1005: Data from Local System
MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.
MITRE ATT&CK technique: T1025: Data from Removable Media
MgBot includes modules for collecting information on Active Directory domain accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
MgBot includes modules for collecting information on local domain users and permissions.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
MgBot includes keylogger payloads focused on the QQ chat application.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
MgBot includes modules for identifying local administrator accounts on victim systems.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
MgBot includes modules for performing HTTP and server service scans.
MITRE ATT&CK technique: T1046: Network Service Discovery
MgBot includes modules for dumping and capturing credentials from process memory.
MITRE ATT&CK technique: T1003: OS Credential Dumping
MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.
MITRE ATT&CK technique: T1057: Process Discovery
MgBot includes modules for performing ARP scans of local connected systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
MgBot includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
MgBot includes modules for identifying local users and administrators on victim machines.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Micropsia creates a RAR archive based on collected files on the victim's machine.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Micropsia can perform microphone recording.
MITRE ATT&CK technique: T1123: Audio Capture
Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions .
MITRE ATT&CK technique: T1119: Automated Collection
Micropsia obfuscates the configuration with a custom Base64 and XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Micropsia can download and execute an executable from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Micropsia has keylogging capabilities.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.
MITRE ATT&CK technique: T1113: Screen Capture
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Micropsia creates a shortcut to maintain persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Micropsia gathers the hostname and OS version from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Micropsia collects the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Micropsia uses HTTP and HTTPS for C2 network communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Micropsia creates a command-line shell using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Milan can use a COM component to generate scheduled tasks.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Milan has the ability to use DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Milan can upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Milan can use hardcoded domains as an input for domain generation algorithms.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Milan has used an executable named `companycatalog.exe.config` to appear benign.
MITRE ATT&CK technique: T1036.007: Masquerading- Double File Extension
Milan can encode files containing information about the targeted system.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Milan has used an executable named `companycatalogue` to appear benign.
MITRE ATT&CK technique: T1036: Masquerading
Milan can use the API `DnsQuery_A` for DNS resolution.
MITRE ATT&CK technique: T1106: Native API
Milan can use a custom protocol tunneled through DNS or HTTP.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.
MITRE ATT&CK technique: T1012: Query Registry
Milan can establish persistence on a targeted host with scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Milan can enumerate the targeted machine's name and GUID.
MITRE ATT&CK technique: T1082: System Information Discovery
Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Milan can identify users registered to a targeted machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Milan can use HTTPS for communication with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Milan can use `cmd.exe` for discovery actions on a targeted system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MimiPenguin can use the `/maps` and `/mem` file to search for regex patterns and dump the process memory.
MITRE ATT&CK technique: T1003.007: OS Credential Dumping- Proc Filesystem
The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.
MITRE ATT&CK technique: T1098: Account Manipulation
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
Mimikatz's kerberos module can create golden tickets.
MITRE ATT&CK technique: T1558.001: Steal or Forge Kerberos Tickets- Golden Ticket
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface functions.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Mimikatz’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.
MITRE ATT&CK technique: T1207: Rogue Domain Controller
Mimikatz's MISC::AddSid module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.
MITRE ATT&CK technique: T1134.005: Access Token Manipulation- SID-History Injection
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
The Mimikatz credential dumper contains an implementation of an SSP.
MITRE ATT&CK technique: T1547.005: Boot or Logon Autostart Execution- Security Support Provider
Mimikatz's kerberos module can create silver tickets.
MITRE ATT&CK technique: T1558.002: Steal or Forge Kerberos Tickets- Silver Ticket
Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.
MITRE ATT&CK technique: T1649: Steal or Forge Authentication Certificates
Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Miner-C copies itself into the public folder of Network Attached Storage devices and infects new victims who open the file.
MITRE ATT&CK technique: T1080: Taint Shared Content
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
MiniDuke can use DGA to generate new Twitter URLs for C2.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.
MITRE ATT&CK technique: T1008: Fallback Channels
MiniDuke can enumerate local drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
MiniDuke can use control flow flattening to obscure code.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
MiniDuke can gather the hostname on a compromised machine.
MITRE ATT&CK technique: T1082: System Information Discovery
MiniDuke uses HTTP and HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
MirageFox has a function for decrypting data containing C2 configuration information.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
MirageFox can collect CPU and architecture information from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
MirageFox can gather the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MirageFox has the capability to execute commands using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.
MITRE ATT&CK technique: T1547: Boot or Logon Autostart Execution
Mis-Type has collected files and data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Mis-Type has transmitted collected files and data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.
MITRE ATT&CK technique: T1008: Fallback Channels
Mis-Type has downloaded additional malware and files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.
MITRE ATT&CK technique: T1106: Native API
Mis-Type network traffic can communicate over a raw socket.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Mis-Type has been injected directly into a running process, including `explorer.exe`.
MITRE ATT&CK technique: T1055: Process Injection
Mis-Type uses Base64 encoding for C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.
MITRE ATT&CK technique: T1082: System Information Discovery
Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Mis-Type runs tests to determine the privilege level of the compromised user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Mis-Type network traffic can communicate over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols