Procedure examples

Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.

Silence has used RDP for lateral movement.

Silence has used environment variable string substitution for obfuscation.

Silence has named its backdoor "WINWORD.exe".

Silence has used scheduled tasks to stage its operation.

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.

Silence has used PowerShell to download and execute payloads.

Silence has used Windows command-line to run commands.

Silence has used VBS scripts.

Silence has used JS scripts.

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.

Silence has used compromised credentials to log on to other systems and escalate privileges.

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.

Silence has downloaded additional modules and malware to victim’s machines.

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.

Silence can create, delete, or modify a specified Registry key or value.

Silence can capture victim screen activity.

Silence has been observed making videos of victims to observe bank employees day to day activities.

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.

Silence has weaponized CHM files in their phishing campaigns.

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.

Silence has used Winexe to install a service on the remote system.

Silence has used port 444 when sending data about the system from the client to the server.

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.