Procedure examples

APT32 used GetPassword_x64 to harvest credentials.

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

APT32's backdoor can query the Windows Registry to gather system information.

APT32 used the ipconfig /all command to gather the IP address from the system.

APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.

APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

APT32's backdoor has stored its configuration in a registry key.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

APT32 includes garbage code to mislead anti-malware software and researchers.

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.

APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

APT32 has used scheduled tasks to persist on victim systems.

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

APT32 has used COM scriptlets to download Cobalt Strike beacons.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

APT32 has used cmd.exe for execution.

APT32 has used macros, COM scriptlets, and VBS scripts.

APT32 has used JavaScript for drive-by downloads and C2 communications.

APT32 has used CVE-2016-7255 to escalate privileges.

APT32's macOS backdoor can receive a “delete” command.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.

APT32 has used email for C2 via an Office macro.

APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.

APT32 has used legitimate local admin account credentials.

APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.

APT32's backdoor possesses the capability to list files and directories on a machine.

APT32 enumerated administrative users using the commands net localgroup administrators.

APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.

APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.

APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.

APT32 has infected victims by tricking them into visiting compromised watering hole websites.

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.

APT32 has used mshta.exe for code execution.

APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.