sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Impacket can be used to sniff network traffic via an interface or raw socket.
MITRE ATT&CK technique: T1040: Network Sniffing
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Impacket contains various modules emulating other service execution tools such as PsExec.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Impacket's wmiexec module can be used to execute commands through WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.
MITRE ATT&CK technique: T1499.004: Endpoint Denial of Service- Application or System Exploitation
Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.
MITRE ATT&CK technique: T1485: Data Destruction
Industroyer decrypts code to connect to a remote C2 server.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Industroyer’s data wiper component enumerates specific files on all the Windows drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Industroyer used Tor nodes for C2.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Industroyer uses a custom port scanner to map out a network.
MITRE ATT&CK technique: T1046: Network Service Discovery
Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
MITRE ATT&CK technique: T1012: Query Registry
Industroyer can enumerate remote computers in the compromised network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.
MITRE ATT&CK technique: T1489: Service Stop
Industroyer collects the victim machine’s Windows GUID.
MITRE ATT&CK technique: T1082: System Information Discovery
Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Industroyer can use supplied user credentials to execute processes and stop services.
MITRE ATT&CK technique: T1078: Valid Accounts
Industroyer’s main backdoor connected to a remote C2 server using HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.
MITRE ATT&CK technique: T1057: Process Discovery
InnaputRAT has a command to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
InnaputRAT enumerates directories and obtains file attributes on a system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
InnaputRAT uses the API call ShellExecuteW for execution.
MITRE ATT&CK technique: T1106: Native API
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Some InnaputRAT variants establish persistence by modifying the Registry key HKU\\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
InnaputRAT gathers volume drive information and system information.
MITRE ATT&CK technique: T1082: System Information Discovery
InnaputRAT launches a shell to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Some InnaputRAT variants create a new Windows service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
InvisiMole can enumerate windows and child windows on a compromised host.
MITRE ATT&CK technique: T1010: Application Window Discovery
InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
InvisiMole can use zlib to compress and decompress data.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
InvisiMole can inject its code into a trusted process via the APC queue.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
InvisiMole can record sound using input audio devices.
MITRE ATT&CK technique: T1123: Audio Capture
InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.
MITRE ATT&CK technique: T1119: Automated Collection
InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
InvisiMole can register itself for execution and persistence via the Control Panel.
MITRE ATT&CK technique: T1218.002: System Binary Proxy Execution- Control Panel
InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
InvisiMole can collect data from the system, and can monitor changes in specified directories.
MITRE ATT&CK technique: T1005: Data from Local System
InvisiMole can collect jpeg files from connected MTP devices.
MITRE ATT&CK technique: T1025: Data from Removable Media
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
InvisiMole has a command to disable routing and the Firewall on the victim’s machine.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
InvisiMole can spread within a network via the BlueKeep and EternalBlue vulnerabilities in RDP and SMB respectively.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
InvisiMole has been configured with several servers available for alternate C2 communications.
MITRE ATT&CK technique: T1008: Fallback Channels
InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.
MITRE ATT&CK technique: T1083: File and Directory Discovery
InvisiMole can create hidden system directories.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
InvisiMole has executed legitimate tools in hidden windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
InvisiMole has undergone regular technical improvements in an attempt to evade detection.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
InvisiMole can upload files to the victim's machine for operations.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
InvisiMole can can remove all system restore points.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
InvisiMole can use a JavaScript file as part of its execution chain.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
InvisiMole can capture keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
InvisiMole has used ListPlanting to inject code into a trusted process.
MITRE ATT&CK technique: T1055.015: Process Injection- ListPlanting
InvisiMole has a command to list account information on the victim’s machine.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
InvisiMole can deliver trojanized versions of software and documents, relying on user execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.
MITRE ATT&CK technique: T1112: Modify Registry
InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.
MITRE ATT&CK technique: T1106: Native API
InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.
MITRE ATT&CK technique: T1046: Network Service Discovery
InvisiMole can disconnect previously connected remote drives.
MITRE ATT&CK technique: T1070.005: Indicator Removal- Network Share Connection Removal
InvisiMole can gather network share information.
MITRE ATT&CK technique: T1135: Network Share Discovery
InvisiMole has used TCP to download additional modules.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
InvisiMole can inject its backdoor as a portable executable into a target process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
InvisiMole can obtain a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.
MITRE ATT&CK technique: T1055: Process Injection
InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
InvisiMole can enumerate Registry values, keys, and data.
MITRE ATT&CK technique: T1012: Query Registry
InvisiMole can place a lnk file in the Startup Folder to achieve persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
InvisiMole has used rundll32.exe for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.
MITRE ATT&CK technique: T1113: Screen Capture
InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
InvisiMole has used Windows services as a way to execute its malicious payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.
MITRE ATT&CK technique: T1518: Software Discovery
InvisiMole uses variations of a simple XOR encryption routine for C&C communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.
MITRE ATT&CK technique: T1082: System Information Discovery
InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
InvisiMole lists local users and session information.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
InvisiMole can obtain running services on the victim.
MITRE ATT&CK technique: T1007: System Service Discovery
InvisiMole gathers the local system time from the victim’s machine.
MITRE ATT&CK technique: T1124: System Time Discovery
InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.
MITRE ATT&CK technique: T1080: Taint Shared Content
InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
InvisiMole can remotely activate the victim’s webcam to capture content.
MITRE ATT&CK technique: T1125: Video Capture
InvisiMole uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
InvisiMole can launch a remote shell to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Invoke-PSImage can be used to embed payload data within a new image file.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.
MITRE ATT&CK technique: T1057: Process Discovery
IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.
MITRE ATT&CK technique: T1055: Process Injection
IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Ixeshe can collect data from a local system.
MITRE ATT&CK technique: T1005: Data from Local System
Ixeshe has a command to delete a file from the machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Ixeshe can list file and directory information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Ixeshe sets its own executable file's attributes to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Ixeshe can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ixeshe can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Ixeshe collects the computer name of the victim's system during the initial infection.
MITRE ATT&CK technique: T1082: System Information Discovery
Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Ixeshe collects the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Ixeshe can list running services.
MITRE ATT&CK technique: T1007: System Service Discovery
Ixeshe uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ixeshe is capable of executing commands via cmd.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
JCry has encrypted files and demanded Bitcoin to decrypt those files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
JCry has used PowerShell to execute payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
JCry has created payloads in the Startup directory to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
JCry has used VBS scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
JCry has used cmd.exe to launch PowerShell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
MITRE ATT&CK technique: T1115: Clipboard Data
JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object .
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
Many strings in JHUHUGIT are obfuscated with a XOR algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
MITRE ATT&CK technique: T1008: Fallback Channels
The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
JHUHUGIT obtains a list of running processes on the victim.
MITRE ATT&CK technique: T1057: Process Discovery
JHUHUGIT performs code injection injecting its own functions to browser processes.
MITRE ATT&CK technique: T1055: Process Injection
JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
JHUHUGIT is executed using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key , accessing the screenshot saved in the clipboard, and converting it to a JPG image.
MITRE ATT&CK technique: T1113: Screen Capture
A JHUHUGIT variant encodes C2 POST data base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.
MITRE ATT&CK technique: T1082: System Information Discovery
A JHUHUGIT variant gathers network interface card information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
JHUHUGIT uses a .bat file to execute a .dll.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
JHUHUGIT has registered itself as a service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
A JPIN variant downloads the backdoor payload via the BITS service.
MITRE ATT&CK technique: T1197: BITS Jobs
JPIN can lower security settings by changing Registry keys.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
JPIN can communicate over FTP.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.
MITRE ATT&CK technique: T1083: File and Directory Discovery
JPIN can download files and upgrade itself.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
JPIN contains a custom keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
JPIN can obtain the permissions of the victim user.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
JPIN can send email over SMTP.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
JPIN can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
JPIN can inject content into lsass.exe to load a module.
MITRE ATT&CK technique: T1055: Process Injection
JPIN can enumerate Registry keys.
MITRE ATT&CK technique: T1012: Query Registry
JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
JPIN can obtain system information such as OS version and disk space.
MITRE ATT&CK technique: T1082: System Information Discovery
JPIN can obtain network information, including DNS, IP, and proxies.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
JPIN can obtain the victim user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
JPIN can list running services.
MITRE ATT&CK technique: T1007: System Service Discovery
JPIN can use the command-line utility cacls.exe to change file permissions.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
JPIN can use the command-line utility cacls.exe to change file permissions.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
JSS Loader has the ability to download malicious executables to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
JSS Loader can download and execute JavaScript files.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
JSS Loader has been executed through malicious attachments contained in spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
JSS Loader has the ability to download and execute PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
JSS Loader has the ability to launch scheduled tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
JSS Loader can download and execute VBScript files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Janicab captured audio and sent it out to a C2 server.
MITRE ATT&CK technique: T1123: Audio Capture
Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Janicab used a cron job for persistence on Mac devices.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Janicab captured screenshots and sent them out to a C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
Javali can use large obfuscated libraries to hinder detection and analysis.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Javali can read C2 information from Google Documents and YouTube.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Javali can download payloads from remote C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Javali has achieved execution through victims clicking links to malicious websites.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Javali has used the MSI installer to download and execute malicious payloads.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Javali can monitor processes for open browsers and custom banking applications.
MITRE ATT&CK technique: T1057: Process Discovery
Javali has been delivered as malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Javali has been delivered via malicious links embedded in e-mails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Javali has used embedded VBScript to download malicious payloads from C2.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
KARAE can use public cloud-based storage providers for command and control.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.
MITRE ATT&CK technique: T1189: Drive-by Compromise
KARAE can upload and download files, including second-stage malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KARAE can collect system information.
MITRE ATT&CK technique: T1082: System Information Discovery
KEYMARBLE has the capability to delete files off the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
KEYMARBLE has a command to search for files on the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KEYMARBLE can upload files to the victim’s machine and can download additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.
MITRE ATT&CK technique: T1112: Modify Registry
KEYMARBLE can obtain a list of running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
KEYMARBLE can capture screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.
MITRE ATT&CK technique: T1082: System Information Discovery
KEYMARBLE gathers the MAC address of the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
KEYMARBLE can execute shell commands using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KEYPLUG can use TLS-encrypted WebSocket Protocol for C2.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
KEYPLUG can decode its configuration file to determine C2 protocols.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
KEYPLUG can use TCP and KCP over UDP for C2 communication.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.
MITRE ATT&CK technique: T1090: Proxy
KEYPLUG can obtain the current tick count of an infected computer.
MITRE ATT&CK technique: T1124: System Time Discovery
KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
KGH_SPY can collect credentials from WINSCP.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
KGH_SPY can send a file containing victim system information to C2.
MITRE ATT&CK technique: T1005: Data from Local System
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
KGH_SPY has used encrypted strings in its installer.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
KGH_SPY can exfiltrate collected information from the host to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
KGH_SPY can enumerate files and directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KGH_SPY has the ability to download and execute code from remote servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KGH_SPY can perform keylogging by polling the GetAsyncKeyState function.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
KGH_SPY can save collected system information to a file named "info" before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
KGH_SPY can harvest data from mail clients.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
KGH_SPY has been spread through Word documents containing malicious macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
KGH_SPY has masqueraded as a legitimate Windows tool.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
KGH_SPY can execute PowerShell commands on the victim's machine.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
KGH_SPY can collect information on installed applications.
MITRE ATT&CK technique: T1518: Software Discovery
KGH_SPY can collect drive information from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
KGH_SPY can send data to C2 with HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KGH_SPY can collect credentials from the Windows Credential Manager.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
KOCTOPUS has obfuscated scripts with the BatchEncryption tool.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
KOCTOPUS has deobfuscated itself before executing its commands.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
KOCTOPUS has used -WindowsStyle Hidden to hide the command window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
KOCTOPUS has executed a PowerShell command to download a file to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KOCTOPUS has relied on victims clicking a malicious document for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
KOCTOPUS has relied on victims clicking on a malicious link delivered via email.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
KOCTOPUS has added and deleted keys from the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.
MITRE ATT&CK technique: T1106: Native API
KOCTOPUS has used PowerShell commands to download additional files.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.
MITRE ATT&CK technique: T1090: Proxy
KOCTOPUS can set the AutoRun Registry key with a PowerShell command.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
KOCTOPUS has been distributed via spearphishing emails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
KOCTOPUS has been distributed as a malicious link within an email.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.
MITRE ATT&CK technique: T1082: System Information Discovery
KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
KOCTOPUS has used `cmd.exe` and batch files for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KOMPROGO is capable of retrieving information about the infected system.
MITRE ATT&CK technique: T1082: System Information Discovery
KOMPROGO is capable of creating a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KOMPROGO is capable of running WMI queries.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
KONNI has encrypted data and files prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify".
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
KONNI had a feature to steal data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
KONNI has modified ComSysApp service to load the malicious DLL payload.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
KONNI can steal profiles from Firefox, Chrome, and Opera.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
KONNI has stored collected information and discovered processes in a tmp file.
MITRE ATT&CK technique: T1005: Data from Local System
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
KONNI is heavily obfuscated and includes encrypted configuration files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
KONNI has sent data and files to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
KONNI has used FTP to exfiltrate reconnaissance data out.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
KONNI can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KONNI can download files and execute them on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KONNI has executed malicious JavaScript code.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
KONNI has the capability to perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
KONNI has pretended to be the xmlProv Network Provisioning service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.
MITRE ATT&CK technique: T1112: Modify Registry
KONNI has hardcoded API calls within its functions to use on the victim's machine.
MITRE ATT&CK technique: T1106: Native API
KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.
MITRE ATT&CK technique: T1134.004: Access Token Manipulation- Parent PID Spoofing
KONNI used PowerShell to download and execute a specific 64-bit version of the malware.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.
MITRE ATT&CK technique: T1057: Process Discovery
A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
KONNI has used Rundll32 to execute its loader for privilege escalation purposes.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
KONNI can take screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
KONNI has been packed for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
KONNI has been delivered via spearphishing campaigns through a malicious Word document.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
KONNI has used a custom base64 key to encode stolen data before exfiltration.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
KONNI has used AES to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used cmd /c systeminfo command to get a snapshot of the current system state of the target machine.
MITRE ATT&CK technique: T1082: System Information Discovery
KONNI can collect the IP address from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
KONNI has used net session on the victim's machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
KONNI can collect the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
KONNI has used HTTP POST for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KONNI has registered itself as a service using its export function.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
KOPILUWAK can gather information from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
KOPILUWAK has exfiltrated collected data to its C2 via POST requests.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
KOPILUWAK had used Javascript to perform its core functions.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript