Procedure examples

WIRTE has XOR encrypted command line strings to conceal malware execution chains.

WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.

WIRTE has used security service provider naming conventions such as ESET and Kasperky ("Kaspersky Update Agent") in order to appear legitimate.

WIRTE has exfiltrated collected victim data to C2 infrastructure.

WIRTE has used PowerShell for script execution.

WIRTE has used the Windows command line as part of infection chains to open documents.

WIRTE has used VBScript in its operations.

WIRTE has used HTTP for network communication.

WIRTE has staged collected documents of interest in `C:\Users\Public folder`.

WIRTE has downloaded PowerShell code from the C2 server to be executed.

WIRTE has used the `RtlIpv4StringToAddressA` to convert IP-formatted string to a byte array.

WIRTE has collected documents from victims' email accounts.

WIRTE has used Base64 to decode malicious VBS script.

WIRTE has used links embedded in emails to lure users into downloading malicious files.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.

WIRTE has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments.

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.

WIRTE has sent targeted spearphishing emails with malicious links directing victims to malware downloads.

WIRTE has used HTTPS over ports 2083 and 2087 for C2.

WIRTE has used RAR archives containing a legitimate executable and a lure document to execute malicious DLLs via sideloading.

WIRTE has registered domains designed to mimic legitimate sites for use in phishing campaigns.

WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.

WIRTE has obtained and used Empire and Rclone for post-exploitation activities.

WIRTE has directed victims to malicious payloads staged on file sharing services.

WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.