"crimeware, remote access tools, and cryptocurrency miners. our detailed technical write ups on the samples we reverse engineered can be found below : - redosdru — encrypted dll payloads to avoid on - disk signatures - generic downloader leads to bitcoin miner — coming soon! - vit…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1055.001Dynamic-link Library Injection
74%
"##gger to troubleshoot a process ( debugger ). when a process gains execution, one of the earliest actions performed by explorer. exe is to check the ifeo key. if the executed process has a correlating subkey ( shares the same name ), windows will check for a debugger value. if t…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1543.003Windows Service
70%
"##s … / f although cmd. exe was a legitimate microsoft executable, the use of a registry value named “ aut2 ” with these nested commands was anomalous. as a result, huntress classified the activity as malicious. suspicious service huntress also discovered a service named “ wsqhwr…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1622Debugger Evasion
64%
"##gger to troubleshoot a process ( debugger ). when a process gains execution, one of the earliest actions performed by explorer. exe is to check the ifeo key. if the executed process has a correlating subkey ( shares the same name ), windows will check for a debugger value. if t…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1112Modify Registry
60%
"attacker chose to modify and delete several registry keys to ensure their commands would run as expected. with these hurdles out of their way, the attackers were free to perform more nefarious actions such as killing antivirus processes : killing antivirus w / image file executio…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1053.005Scheduled Task
52%
"“ taskkill. exe / f / im myapp. exe ” as demonstrated in this procmon screenshot : this technique is an ideal way to prevent some antivirus products from running. to see exactly what processes these attackers were targeting, check out the full list of their ifeo related registry …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1546.012Image File Execution Options Injection
43%
"##gger to troubleshoot a process ( debugger ). when a process gains execution, one of the earliest actions performed by explorer. exe is to check the ifeo key. if the executed process has a correlating subkey ( shares the same name ), windows will check for a debugger value. if t…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1003OS Credential Dumping
38%
"deep dive : squashing an mssql attack during the previous msp moment, we walked our readers through an incident where our partner, ntconnections, used huntress to discover a previously undetected breach. in this deep drive, we ’ ll examine the tradecraft used by the attackers to …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1489Service Stop
32%
"“ taskkill. exe / f / im myapp. exe ” as demonstrated in this procmon screenshot : this technique is an ideal way to prevent some antivirus products from running. to see exactly what processes these attackers were targeting, check out the full list of their ifeo related registry …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1078Valid Accounts
31%
"although the hackers behind this compromise used many different techniques, all of them were well known and documented within the cybersecurity community. despite this, these attackers were able to gain access, disable the preventive security in place, establish a foothold, and s…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
During the previous MSP Moment, we walked our readers through an incident where our partner, NTConnections, used Huntress to discover a previously undetected breach. In this Deep Drive, we’ll examine the tradecraft used by the attackers to gain access through the database, kill/disable antivirus, download malicious files, and establish a persistent foothold within the network.