Procedure examples

Windshift has used string encoding with floating point calculations.

Windshift has used malware to identify the username on a compromised host.

Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.

Windshift has used revoked certificates to sign malware.

Windshift has used WMI to collect information about target machines.

Windshift has used malware to enumerate active processes.

Windshift has used Visual Basic 6 (VB6) payloads.

Windshift has used tools that communicate with C2 over HTTP.

Windshift has used malware to identify the computer name of a compromised host.

Windshift has used tools to deploy additional payloads to compromised hosts.

Windshift has used compromised websites to register custom URL schemes on a remote system.

Windshift has used links embedded in e-mails to lure victims into executing malicious code.

Windshift has used e-mail attachments to lure victims into executing malicious code.

Windshift has used malware to identify installed software.

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.

Windshift has created LNK files in the Startup folder to establish persistence.

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.

Windshift has used fake personas on social media to engage and target victims.