Procedure examples

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

A Threat Group-3390 tool can read and decrypt stored Registry values.

Threat Group-3390 actors use NBTscan to discover vulnerable systems.

Threat Group-3390 has used the net view command.

Threat Group-3390 has used WinRM to enable remote execution.

Threat Group-3390 has packed malware and tools, including using VMProtect.

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.

Threat Group-3390 malware is compressed with LZNT1 compression.

Threat Group-3390 actors have split RAR files for exfiltration into parts.

Threat Group-3390 has used `whoami` to collect system user information.

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.

A Threat Group-3390 tool can use WMI to execute a binary.

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.

A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

Threat Group-3390 has used PowerShell for execution.

Threat Group-3390 has used command-line interfaces for execution.

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

Threat Group-3390 malware has used HTTP for C2.

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.

Threat Group-3390 has used net user to conduct internal discovery of systems.

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.

Threat Group-3390 has extensively used strategic web compromises to target victims.

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

Threat Group-3390 has lured victims into opening malicious files containing malware.

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.

Threat Group-3390 has used a variety of Web shells.

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.

Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.

Threat Group-3390 obtained a KeePass database from a compromised host.

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.

Threat Group-3390 has exfiltrated stolen data to Dropbox.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.