sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Volgmer can execute commands on the victim's machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
WARPWIRE is a credential harvester written in JavaScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
WARPWIRE can Base64 encode captured credentials with `btoa` prior to sending to C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.
MITRE ATT&CK technique: T1056.003: Input Capture- Web Portal Capture
Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% .
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
WEBC2 can download and execute a file.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WEBC2 can open an interactive command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
WINDSHIELD is capable of file deletion along with other file system interaction.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
WINDSHIELD C2 traffic can communicate via TCP raw sockets.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
WINDSHIELD can gather Registry values.
MITRE ATT&CK technique: T1012: Query Registry
WINDSHIELD can gather the victim computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
WINDSHIELD can gather the victim user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
WINERACK can enumerate active windows.
MITRE ATT&CK technique: T1010: Application Window Discovery
WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
WINERACK can enumerate files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WINERACK can enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
WINERACK can gather information about the host.
MITRE ATT&CK technique: T1082: System Information Discovery
WINERACK can gather information on the victim username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
WINERACK can enumerate services.
MITRE ATT&CK technique: T1007: System Service Discovery
WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WIREFIRE has the ability to download files to compromised devices.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WIREFIRE can Base64 encode process output sent to C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
WIREFIRE can AES encrypt process output sent from compromised devices to C2.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WannaCry uses attrib +h to make some of its files hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
WannaCry uses Tor for command and control traffic.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.
MITRE ATT&CK technique: T1563.002: Remote Service Session Hijacking- RDP Hijacking
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.
MITRE ATT&CK technique: T1018: Remote System Discovery
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.
MITRE ATT&CK technique: T1489: Service Stop
WannaCry will attempt to determine the local network segment it is a part of.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
WannaCry utilizes wmic to delete shadow copies.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center Service."
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
WarzoneRAT can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
WarzoneRAT can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
WarzoneRAT can send collected victim data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
WarzoneRAT can enumerate directories on a compromise host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`.
MITRE ATT&CK technique: T1564: Hide Artifacts
WarzoneRAT can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.
MITRE ATT&CK technique: T1112: Modify Registry
WarzoneRAT can use a variety of API calls on a compromised host.
MITRE ATT&CK technique: T1106: Native API
WarzoneRAT can communicate with its C2 server via TCP over port 5200.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
WarzoneRAT can use PowerShell to download files and execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
WarzoneRAT can obtain a list of processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.
MITRE ATT&CK technique: T1055: Process Injection
WarzoneRAT has the capability to act as a reverse proxy.
MITRE ATT&CK technique: T1090: Proxy
WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
WarzoneRAT has the ability to control an infected PC using RDP.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
WarzoneRAT can include a rootkit to hide processes, files, and startup.
MITRE ATT&CK technique: T1014: Rootkit
WarzoneRAT has been distributed as a malicious attachment within an email.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.
MITRE ATT&CK technique: T1082: System Information Discovery
WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.
MITRE ATT&CK technique: T1221: Template Injection
WarzoneRAT has the ability of performing remote desktop access via a VNC console.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
WarzoneRAT can access the webcam on a victim's machine.
MITRE ATT&CK technique: T1125: Video Capture
WarzoneRAT can use `cmd.exe` to execute malicious code.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
WastedLocker contains junk code to increase its entropy and hide the actual code.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
WastedLocker has performed DLL hijacking before execution.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
WastedLocker can encrypt data and leave a ransom note.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
WastedLocker can enumerate files and directories just prior to encryption.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
WastedLocker can delete shadow volumes.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.
MITRE ATT&CK technique: T1112: Modify Registry
WastedLocker has the ability to save and execute files as an alternate data stream .
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc API function to help execute the payload.
MITRE ATT&CK technique: T1106: Native API
WastedLocker can identify network adjacent and accessible drives.
MITRE ATT&CK technique: T1135: Network Share Discovery
WastedLocker can enumerate removable drives prior to the encryption process.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.
MITRE ATT&CK technique: T1012: Query Registry
WastedLocker can execute itself as a service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
WastedLocker has used cmd to execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
WastedLocker created and established a service that runs until the encryption process is complete.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Waterbear has used DLL side loading to import and load a malicious DLL loader.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Waterbear has used RC4 encrypted shellcode and encrypted functions.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
Waterbear can scramble functions not to be executed again with random values.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Waterbear can receive and load executables from remote C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Waterbear has deleted certain values from the Registry to load a malicious DLL.
MITRE ATT&CK technique: T1112: Modify Registry
Waterbear can leverage API functions for execution.
MITRE ATT&CK technique: T1106: Native API
Waterbear can identify the process for a specific security product.
MITRE ATT&CK technique: T1057: Process Discovery
Waterbear can inject decrypted shellcode into the LanmanServer service.
MITRE ATT&CK technique: T1055: Process Injection
Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.
MITRE ATT&CK technique: T1012: Query Registry
Waterbear can find the presence of a specific security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Waterbear can use thread injection to inject shellcode into the process of security software.
MITRE ATT&CK technique: T1055.003: Process Injection- Thread Execution Hijacking
WellMail can archive files on the compromised host.
MITRE ATT&CK technique: T1560: Archive Collected Data
WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
WellMail can exfiltrate files from the victim machine.
MITRE ATT&CK technique: T1005: Data from Local System
WellMail can decompress scripts received from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WellMail can receive data and executable scripts from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WellMail can use TCP for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.
MITRE ATT&CK technique: T1571: Non-Standard Port
WellMail can identify the IP address of the victim system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
WellMail can identify the current username on the victim system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
WellMess has the ability to use DNS tunneling for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
WellMess can send files from the victim machine to C2.
MITRE ATT&CK technique: T1005: Data from Local System
WellMess can decode and decrypt data received from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WellMess can identify domain group membership for the current user.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
WellMess can write files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WellMess can use junk data in the Base64 string for additional obfuscation.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
WellMess can execute PowerShell scripts received from C2.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
WellMess has used Base64 encoding to uniquely identify communication to and from the C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
WellMess can identify the computer name of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
WellMess can identify the IP address and user domain on the target machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
WellMess can collect the username on the victim machine to send to C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
WellMess can use HTTP and HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
WellMess can execute command line scripts received from C2.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Wevtutil can be used to clear system and security event logs from the system.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Wevtutil can be used to export events from a specific log.
MITRE ATT&CK technique: T1005: Data from Local System
Wevtutil can be used to disable specific event logs on the system.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.
MITRE ATT&CK technique: T1485: Data Destruction
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
WhisperGate can overwrite the Master Book Record on victim systems with a malicious 16-bit bootloader.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
WhisperGate can delete tools from a compromised host after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
WhisperGate can locate files based on hardcoded file extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WhisperGate can download additional stages of malware from a Discord CDN channel.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.
MITRE ATT&CK technique: T1036: Masquerading
WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.
MITRE ATT&CK technique: T1106: Native API
WhisperGate can enumerate connected remote logical drives.
MITRE ATT&CK technique: T1135: Network Share Discovery
WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.
MITRE ATT&CK technique: T1620: Reflective Code Loading
WhisperGate can recognize the presence of monitoring tools on a target system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
WhisperGate has the ability to enumerate fixed logical drives on a targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
WhisperGate can pause for 20 seconds to bypass antivirus solutions.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
WhisperGate can make an HTTPS connection to download additional files.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
WhisperGate can download additional payloads hosted on a Discord channel.
MITRE ATT&CK technique: T1102: Web Service
WhisperGate can use `cmd.exe` to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Wiarp creates a backdoor through which remote attackers can download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Wiarp creates a backdoor through which remote attackers can inject files into running processes.
MITRE ATT&CK technique: T1055: Process Injection
Wiarp creates a backdoor through which remote attackers can open a command line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Wiarp creates a backdoor through which remote attackers can create a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
WinMM is usually configured with primary and backup domains for C2 communications.
MITRE ATT&CK technique: T1008: Fallback Channels
WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WinMM sets a WH_CBT Windows hook to collect information on process creation.
MITRE ATT&CK technique: T1057: Process Discovery
WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
WinMM uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
WindTail has the ability to use the macOS built-in zip utility to archive files.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
WindTail can identify and add files that possess specific file extensions to an array for archiving.
MITRE ATT&CK technique: T1119: Automated Collection
WindTail has the ability to decrypt strings using hard-coded AES keys.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WindTail can be delivered as a compressed, encrypted, and encoded payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
WindTail has the ability to receive and execute a self-delete command.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
WindTail has the ability to enumerate the users home directory and the path to its own application bundle.
MITRE ATT&CK technique: T1083: File and Directory Discovery
WindTail can instruct the OS to execute an application without a dock icon or menu.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
WindTail has been incompletely signed with revoked certificates.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
WindTail has used icons mimicking MS Office files to mask payloads.
MITRE ATT&CK technique: T1036: Masquerading
WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and compare.
MITRE ATT&CK technique: T1106: Native API
WindTail has the ability to generate the current date and time.
MITRE ATT&CK technique: T1124: System Time Discovery
WindTail can use the open command to execute an application.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
WindTail has the ability to use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Windows Credential Editor can dump credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Winexe installs a service on the remote system, executes the command, then uninstalls the service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Wingbird drops a malicious file alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
MITRE ATT&CK technique: T1547.008: Boot or Logon Autostart Execution- LSASS Driver
Wingbird performs multiple process injections to hijack system processes and execute malicious code.
MITRE ATT&CK technique: T1055: Process Injection
Wingbird checks for the presence of Bitdefender security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.
MITRE ATT&CK technique: T1082: System Information Discovery
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Winnti for Linux can encode its configuration file with single-byte XOR encoding.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Winnti for Linux has the ability to deploy modules directly from command and control servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.
MITRE ATT&CK technique: T1014: Rootkit
Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control .
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control mechanism.
MITRE ATT&CK technique: T1205: Traffic Signaling
Winnti for Linux has used HTTP in outbound communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Winnti for Windows can use a variant of the sysprep UAC bypass.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
The Winnti for Windows dropper can decrypt and decompresses a data blob.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Winnti for Windows has the ability to encrypt and compress its payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Winnti for Windows can delete the DLLs for its various components from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.
MITRE ATT&CK technique: T1083: File and Directory Discovery
The Winnti for Windows dropper can place malicious payloads on targeted systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Winnti for Windows can use Native API to create a new process and to start services.
MITRE ATT&CK technique: T1106: Native API
Winnti for Windows can communicate using custom TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.
MITRE ATT&CK technique: T1057: Process Discovery
Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
The Winnti for Windows installer loads a DLL using rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Winnti for Windows can run as a service using svchost.exe.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Winnti for Windows can XOR encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.
MITRE ATT&CK technique: T1082: System Information Discovery
Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
MITRE ATT&CK technique: T1072: Software Deployment Tools
Woody RAT can identify administrator accounts on an infected machine.
MITRE ATT&CK technique: T1087: Account Discovery
Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Woody RAT can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Woody RAT can deobfuscate Base64-encoded strings and scripts.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Woody RAT has used Base64 encoded strings and scripts.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Woody RAT can exfiltrate files from an infected machine to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Woody RAT has relied on CVE-2022-30190 for execution during delivery.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Woody RAT can make `Ping` GET HTTP requests to its C2 server at regular intervals for network connectivity checks.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Woody RAT has relied on users opening a malicious email attachment for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.
MITRE ATT&CK technique: T1106: Native API
Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, `WoodyPowerSession`.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.
MITRE ATT&CK technique: T1057: Process Discovery
Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.
MITRE ATT&CK technique: T1055: Process Injection
Woody RAT can search registry keys to identify antivirus programs on an compromised host.
MITRE ATT&CK technique: T1012: Query Registry
Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.
MITRE ATT&CK technique: T1113: Screen Capture
Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Woody RAT can collect .NET, PowerShell, and Python information from an infected host.
MITRE ATT&CK technique: T1518: Software Discovery
Woody RAT has been delivered via malicious Word documents and archive files.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Woody RAT can use AES-CBC to encrypt data sent to its C2 server.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, environment variables, and storage drives.
MITRE ATT&CK technique: T1082: System Information Discovery
Woody RAT can retrieve network interface and proxy information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Woody RAT can retrieve a list of user accounts and usernames from an infected machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Woody RAT can communicate with its C2 server using HTTP requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Woody RAT can execute commands using `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
XAgentOSX contains the readFiles function to return a detailed listing of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.
MITRE ATT&CK technique: T1083: File and Directory Discovery
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.
MITRE ATT&CK technique: T1106: Native API
XAgentOSX contains the getProcessList function to run ps aux to get running processes.
MITRE ATT&CK technique: T1057: Process Discovery
XAgentOSX contains the takeScreenShot functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.
MITRE ATT&CK technique: T1113: Screen Capture
XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.
MITRE ATT&CK technique: T1082: System Information Discovery
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.
MITRE ATT&CK technique: T1087: Account Discovery
XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.
MITRE ATT&CK technique: T1560: Archive Collected Data
XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.
MITRE ATT&CK technique: T1195.001: Supply Chain Compromise- Compromise Software Dependencies and Development Tools
XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and ~/Desktop with a fixed key and renames files to give them a .enc extension. Only files with sizes less than 500MB are encrypted.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.
MITRE ATT&CK technique: T1005: Data from Local System
XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
XCSSET exfiltrates data stolen from a system over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps .
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
XCSSET uses the chmod +x command to grant executable permissions to the malicious file.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist.
MITRE ATT&CK technique: T1036: Masquerading
XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system.
MITRE ATT&CK technique: T1647: Plist File Modification
XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command. XCSSET will upload a private key file to the server to remotely access the host without a password.
MITRE ATT&CK technique: T1098.004: Account Manipulation- SSH Authorized Keys
XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension. Screen captures are taken at specified intervals based on the system.
MITRE ATT&CK technique: T1113: Screen Capture
XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.
MITRE ATT&CK technique: T1518: Software Discovery
XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
XCSSET uses RC4 encryption over TCP to communicate with its C2 server.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
XCSSET identifies the macOS version and uses ioreg to determine serial number.
MITRE ATT&CK technique: T1082: System Information Discovery
XCSSET uses AppleScript to check the host's language and location with the command user locale of .
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Using the machine's local time, XCSSET waits 43200 seconds from the initial creation timestamp of a specific file, .report. After the elapsed time, XCSSET executes additional modules.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion