sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
SVCReady has named a task `RecoveryExTask` as part of its persistence activity.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
SVCReady can use Windows API calls to gather information from an infected host.
MITRE ATT&CK technique: T1106: Native API
SVCReady can encrypt victim data with an RC4 cipher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SVCReady can check for the number of devices plugged into an infected host.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
SVCReady can collect a list of running processes from an infected host.
MITRE ATT&CK technique: T1057: Process Discovery
SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.
MITRE ATT&CK technique: T1012: Query Registry
SVCReady has used `rundll32.exe` for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SVCReady can take a screenshot from an infected host.
MITRE ATT&CK technique: T1113: Screen Capture
SVCReady can collect a list of installed software from an infected host.
MITRE ATT&CK technique: T1518: Software Discovery
SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
SVCReady has the ability to determine if its runtime environment is virtualized.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.
MITRE ATT&CK technique: T1082: System Information Discovery
SVCReady can collect the username from an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SVCReady can collect time zone information.
MITRE ATT&CK technique: T1124: System Time Discovery
SVCReady can enter a sleep stage for 30 minutes to evade detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
SVCReady has used VBA macros to execute shellcode.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
SVCReady can communicate with its C2 servers via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.
MITRE ATT&CK technique: T1556.004: Modify Authentication Process- Network Device Authentication
SYNful Knock is malware that is inserted into a network device by patching the operating system image.
MITRE ATT&CK technique: T1601.001: Modify System Image- Patch System Image
SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.
MITRE ATT&CK technique: T1205: Traffic Signaling
SYSCON has the ability to use FTP in C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
SYSCON has been executed by luring victims to open malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
SYSCON has the ability to use Tasklist to list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
SYSCON has the ability to use Systeminfo to identify system information.
MITRE ATT&CK technique: T1082: System Information Discovery
SYSCON has the ability to execute commands through cmd on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Saint Bot can collect files and information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Saint Bot has used `is_debugger_present` as part of its environmental checks.
MITRE ATT&CK technique: T1622: Debugger Evasion
Saint Bot can deobfuscate strings and files for execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Saint Bot has injected its DLL component into `EhStorAurhn.exe`.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Saint Bot can search a compromised host for specific files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Saint Bot will use the malicious file slideshow.mp4 if present to load the core API provided by ntdll.dll to avoid any hooks placed on calls to the original ntdll.dll file by endpoint detection and response or antimalware software.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Saint Bot can download additional files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Saint Bot had used `InstallUtil.exe` to download and deploy executables.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.
MITRE ATT&CK technique: T1036: Masquerading
Saint Bot has been disguised as a legitimate executable, including as Windows SDK.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.
MITRE ATT&CK technique: T1106: Native API
Saint Bot has been obfuscated to help avoid detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Saint Bot has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.
MITRE ATT&CK technique: T1057: Process Discovery
The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Saint Bot has used `check_registry_keys` as part of its environmental checks.
MITRE ATT&CK technique: T1012: Query Registry
Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Saint Bot has used `regsvr32` to execute scripts.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Saint Bot has created a scheduled task named "Maintenance" to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Saint Bot has been packed using a dark market crypter.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Saint Bot has been distributed as malicious attachments within spearphishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Saint Bot has been distributed through malicious links contained within spearphishing emails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Saint Bot has used Base64 to encode its C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Saint Bot can identify the OS version, CPU, and other details from a victim's machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.
MITRE ATT&CK technique: T1614: System Location Discovery
Saint Bot can collect the IP address of a victim machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Saint Bot can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Saint Bot has used `.vbs` scripts for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Saint Bot has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Saint Bot has used `cmd.exe` and `.bat` scripts for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Sakula contains UAC bypass code for both 32- and 64-bit systems.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Sakula uses single-byte XOR obfuscation to obfuscate many of its files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Some Sakula samples use cmd.exe to delete temporary files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Sakula has the capability to download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Sakula calls cmd.exe to run various DLL files via rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Sakula encodes C2 traffic with single-byte XOR keys.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Sakula uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
SamSam has used garbage code to pad some of its malware components.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
SamSam has been seen using AES or DES to encrypt payloads and payload components.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SamSam uses custom batch scripts to execute some of its components.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Samurai can compile and execute downloaded modules at runtime.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.
MITRE ATT&CK technique: T1005: Data from Local System
Samurai can encrypt API name strings with an XOR-based algorithm.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Samurai can use a specific module for file enumeration.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Samurai has been used to deploy other malware including Ninja.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.
MITRE ATT&CK technique: T1112: Modify Registry
Samurai has the ability to call Windows APIs.
MITRE ATT&CK technique: T1106: Native API
Samurai can use a proxy module to forward TCP packets to external hosts.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Samurai can encrypt the names of requested APIs and deliver its final payload as a compressed, encrypted and base64 encoded blob.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.
MITRE ATT&CK technique: T1090: Proxy
Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.
MITRE ATT&CK technique: T1012: Query Registry
Samurai can check for the presence and version of the .NET framework.
MITRE ATT&CK technique: T1518: Software Discovery
Samurai can base64 encode data sent in C2 communications prior to its encryption.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Samurai can encrypt C2 communications with AES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Samurai can use a remote command module for execution via the Windows command line.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.
MITRE ATT&CK technique: T1005: Data from Local System
Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Sardonic has the ability to delete created WMI objects to evade detections.
MITRE ATT&CK technique: T1070: Indicator Removal
Sardonic has the ability to upload additional malicious files to a compromised machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.
MITRE ATT&CK technique: T1106: Native API
Sardonic has the ability to execute the `net view` command.
MITRE ATT&CK technique: T1135: Network Share Discovery
Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.
MITRE ATT&CK technique: T1571: Non-Standard Port
Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Sardonic has the ability to execute PowerShell commands on a compromised machine.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Sardonic has the ability to execute the `tasklist` command.
MITRE ATT&CK technique: T1057: Process Discovery
Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Sardonic has the ability to collect the computer name, CPU manufacturer name, and C:\ drive serial number from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.
MITRE ATT&CK technique: T1082: System Information Discovery
Sardonic has the ability to execute the `ipconfig` command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sardonic has the ability to execute the `netstat` command.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Sardonic has the ability to execute the `net start` command.
MITRE ATT&CK technique: T1007: System Service Discovery
Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Sardonic can use WMI to execute PowerShell commands on a compromised machine.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
SeaDuke compressed data with zlib prior to sending it over C2.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
SeaDuke can securely delete files, including deleting itself from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SeaDuke is capable of uploading and downloading files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
SeaDuke has been packed with the UPX packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
SeaDuke C2 traffic is base64-encoded.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SeaDuke C2 traffic has been encrypted with RC4 and AES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
MITRE ATT&CK technique: T1078: Valid Accounts
SeaDuke uses HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SeaDuke is capable of executing commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Seasalt obfuscates configuration data.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Seasalt has a command to delete a specified file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Seasalt has the capability to identify the drive type on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Seasalt has a command to download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Seasalt has a command to perform a process listing.
MITRE ATT&CK technique: T1057: Process Discovery
Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Seasalt uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Seasalt is capable of installing itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
ServHelper has a module to delete itself from the infected machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ServHelper may download additional files to execute.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ServHelper has created a new user named "supportaccount".
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
ServHelper has created a new user named `supportaccount`.
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
ServHelper has the ability to execute a PowerShell script to get information from the infected host.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
ServHelper contains modules that will use schtasks to carry out malicious operations.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
ServHelper will attempt to enumerate Windows version and system architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
ServHelper will attempt to enumerate the username of the victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ServHelper uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ServHelper can execute shell commands against cmd.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Seth-Locker has the ability to download and execute files on a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Seth-Locker can execute commands via the command line shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ShadowPad has used DNS tunneling for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
ShadowPad has decrypted a binary blob to start execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ShadowPad uses a DGA that is based on the day of the month for C2 servers.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
ShadowPad has injected a DLL into svchost.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
ShadowPad has used FTP for C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
ShadowPad maintains a configuration block and virtual file system in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
ShadowPad has deleted arbitrary Registry values.
MITRE ATT&CK technique: T1070: Indicator Removal
ShadowPad has downloaded code from a C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.
MITRE ATT&CK technique: T1112: Modify Registry
ShadowPad has used UDP for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
ShadowPad has encoded data as readable Latin characters.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
ShadowPad has encrypted its payload, a virtual file system, and various files.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ShadowPad has collected the PID of a malicious process.
MITRE ATT&CK technique: T1057: Process Discovery
ShadowPad has injected an install module into a newly created process.
MITRE ATT&CK technique: T1055: Process Injection
ShadowPad has sent data back to C2 every 8 hours.
MITRE ATT&CK technique: T1029: Scheduled Transfer
ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.
MITRE ATT&CK technique: T1082: System Information Discovery
ShadowPad has collected the domain name of the victim system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ShadowPad has collected the username of the victim system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ShadowPad has collected the current date and time of the victim system.
MITRE ATT&CK technique: T1124: System Time Discovery
ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Shamoon attempts to disable UAC remote restrictions by modifying the Registry.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.
MITRE ATT&CK technique: T1485: Data Destruction
Shamoon has an operational mode for encrypting data instead of overwriting it.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Shamoon has been seen overwriting features of disk structure such as the MBR.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Shamoon can download an executable to run on the victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Shamoon attempts to copy itself to remote machines on the network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.
MITRE ATT&CK technique: T1112: Modify Registry
Shamoon contains base64-encoded strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Shamoon queries several Registry keys to identify hard disk partitions to overwrite.
MITRE ATT&CK technique: T1012: Query Registry
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.
MITRE ATT&CK technique: T1018: Remote System Discovery
Shamoon accesses network share, enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
Shamoon obtains the target's IP address and local network segment.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Shamoon will reboot the infected system once the wiping functionality has been completed.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Shamoon obtains the system time and will only activate if it is greater than a preset date.
MITRE ATT&CK technique: T1124: System Time Discovery
Shamoon can change the modified time for files to evade forensic detection.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Shamoon has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Shark can use DNS in C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Shark has stored information in folders named `U1` and `U2` prior to exfiltration.
MITRE ATT&CK technique: T1074: Data Staged
Shark can upload files to its C2.
MITRE ATT&CK technique: T1005: Data from Local System
Shark can extract and decrypt downloaded .zip files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Shark can send DNS C2 communications using a unique domain generation algorithm.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Shark can use encrypted and encoded files for C2 configuration.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Shark can update its configuration to use a different C2 server.
MITRE ATT&CK technique: T1008: Fallback Channels
Shark can delete files downloaded to the compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Shark can download additional files from its C2 via HTTP or DNS.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.
MITRE ATT&CK technique: T1012: Query Registry
Shark can pause C2 communications for a specified time.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Shark can collect the GUID of a targeted machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Shark has the ability to use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Shark has the ability to use `CMD` to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.
MITRE ATT&CK technique: T1005: Data from Local System
SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SharpDisco has the ability to transfer data between SMB shares.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` or `%APPDATA%\Microsoft\Windows\Recent` .
MITRE ATT&CK technique: T1083: File and Directory Discovery
SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SharpDisco can leverage Native APIs through plugins including `GetLogicalDrives`.
MITRE ATT&CK technique: T1106: Native API
SharpDisco has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SharpDisco can use a plugin to enumerate system drives.
MITRE ATT&CK technique: T1082: System Information Discovery
SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SharpStage has decompressed data received from the C2 server.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SharpStage has the ability to download and execute additional payloads via a DropBox API.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SharpStage can execute arbitrary commands with PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SharpStage has a persistence component to write a scheduled task for the payload.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SharpStage has the ability to capture the victim's screen.
MITRE ATT&CK technique: T1113: Screen Capture
SharpStage has checked the system settings to see if Arabic is the configured language.
MITRE ATT&CK technique: T1082: System Information Discovery
SharpStage has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
SharpStage has used a legitimate web service for evading detection.
MITRE ATT&CK technique: T1102: Web Service
SharpStage can execute arbitrary commands with the command line.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SharpStage can use WMI for execution.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
ShimRat has installed shim databases in the AppPatch folder.
MITRE ATT&CK technique: T1546.011: Event Triggered Execution- Application Shimming
ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
ShimRat has the capability to upload collected files to a C2.
MITRE ATT&CK technique: T1005: Data from Local System
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ShimRat can use pre-configured HTTP proxies.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
ShimRat has used a secondary C2 location if the first was unavailable.
MITRE ATT&CK technique: T1008: Fallback Channels
ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ShimRat can list directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
ShimRat can download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
ShimRat has registered two registry keys for shim databases.
MITRE ATT&CK technique: T1112: Modify Registry
ShimRat has used Windows API functions to install the service and shim.
MITRE ATT&CK technique: T1106: Native API
ShimRat can enumerate connected drives for infected host machines.
MITRE ATT&CK technique: T1135: Network Share Discovery
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ShimRat can sleep when instructed to do so by the C2.
MITRE ATT&CK technique: T1029: Scheduled Transfer
ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
ShimRat communicated over HTTP and HTTPS with C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ShimRat can be issued a command shell function from the C2.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ShimRat has installed a Windows service to maintain persistence on victim machines.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
ShimRatReporter listed all non-privileged and privileged accounts available on the machine.
MITRE ATT&CK technique: T1087: Account Discovery
ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.
MITRE ATT&CK technique: T1560: Archive Collected Data
ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.
MITRE ATT&CK technique: T1119: Automated Collection
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.
MITRE ATT&CK technique: T1020: Automated Exfiltration
ShimRatReporter sent generated reports to the C2 via HTTP POST requests.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ShimRatReporter had the ability to download additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ShimRatReporter used several Windows API functions to gather information from the infected system.
MITRE ATT&CK technique: T1106: Native API
ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ShimRatReporter gathered the local privileges for the infected host.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
ShimRatReporter listed all running processes on the machine.
MITRE ATT&CK technique: T1057: Process Discovery
ShimRatReporter gathered a list of installed software on the infected host.
MITRE ATT&CK technique: T1518: Software Discovery
ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.
MITRE ATT&CK technique: T1082: System Information Discovery
ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
ShimRatReporter communicated over HTTP with preconfigured C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Sibot has obfuscated scripts used in execution.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Sibot can decrypt data received from a C2 and save to a file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Sibot will delete itself if a certain server response is received.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Sibot will delete an associated registry key if a certain server response is received.
MITRE ATT&CK technique: T1070: Indicator Removal
Sibot can download and execute a payload onto a compromised system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.
MITRE ATT&CK technique: T1112: Modify Registry
Sibot has been executed via MSHTA application.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Sibot has queried the registry for proxy server information.
MITRE ATT&CK technique: T1012: Query Registry
Sibot has executed downloaded DLLs with rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Sibot has been executed via a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Sibot checked if the compromised system is configured to use proxies.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Sibot executes commands using VBScript.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Sibot communicated with its C2 server via HTTP GET requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
MITRE ATT&CK technique: T1102: Web Service
Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SideTwist can embed C2 responses in the source code of a fake Flickr webpage.
MITRE ATT&CK technique: T1001: Data Obfuscation
SideTwist has the ability to upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SideTwist can decode and decrypt messages received from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SideTwist has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.
MITRE ATT&CK technique: T1008: Fallback Channels
SideTwist has the ability to search for specific files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SideTwist has the ability to download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.
MITRE ATT&CK technique: T1106: Native API
SideTwist has used Base64 for encoded C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SideTwist can encrypt C2 communications with a randomly generated key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SideTwist can collect the computer name of a targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
SideTwist has the ability to collect the domain name on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SideTwist can collect the username on a targeted system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery