Procedure examples

FIN7 has collected files and other sensitive information from a compromised network.

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.

FIN7 has used RDP to move laterally in victim environments.

FIN7 has used SSH to move laterally through victim environments.

FIN7 has used TightVNC to control compromised hosts.

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.

FIN7 has used random junk code to obfuscate malware code.

FIN7 has used the command `cmd.exe /C quser` to collect user session information.

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.

FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.

FIN7 has used WMI to install malware on targeted systems.

FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.

FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additionally, WsTaskLoad.exe executes `tasklist /v` to perform process discovery.

FIN7 used SQL scripts to help perform tasks on the victim's machine.

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.

FIN7 used the command prompt to launch commands on the victim’s machine. Additionally, FIN7 has used cmd.exe to open the Run dialog by sending the “Windows + R” keys through malicious USBs acting as virtual keyboards.

FIN7 used VBS scripts to help perform tasks on the victim's machine.

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.

FIN7 has used the command `net group "domain admins" /domain` to enumerate domain groups.

FIN7 has performed C2 using DNS via A, OPT, and TXT records.

FIN7 has harvested valid administrative credentials for lateral movement.

FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.

FIN7 has used csvde.exe, which is a built-in Windows command line tool, to export system information. Additionally, WsTaskLoad has gathered system information, such as operating system and hostname.

FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing `net group “Domain Admins” /domain`. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.

FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations. Additionally, FIN7 has used malicious USBs that acted as virtual keyboards to install malware and txt files that decode to PowerShell commands.

FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

FIN7 captured screenshots and desktop video recordings.

FIN7 has used the PowerShell script 3CF9.ps1 to execute `net time`.

FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.

FIN7 has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated block of data with the key `qawsed1q2w3e`, which led to the installation of Lizar.

FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.

FIN7 has gained initial access by compromising a victim's software supply chain.

FIN7 has used malicious links to lure victims into downloading malware.

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

FIN7 has used `rundll32.exe` to execute malware on a compromised network.

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.

FIN7 created new Windows services and added them to the startup directories for persistence.

FIN7 has used application shim databases for persistence.

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.

FIN7 has used `attrib +h “C:\ProgramData\ssh”` to make the SSH folder hidden.

FIN7 has used .txt files to conceal PowerShell commands.

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.