Procedure examples

MirrorFace has dumped LSASS memory for credential access.

MirrorFace has used vssadmin to copy registry hives including SAM.

MirrorFace has dumped NTDS.dit through volume shadow copies.

MirrorFace gathered data and files of interest from victim's systems.

MirrorFace has used Tasklist for discovery post compromise.

MirrorFace has used ipconfig for reconnaissance.

MirrorFace has used Ping for system discovery.

MirrorFace has used RDP to exfiltrate files of interest.

MirrorFace has used SMB to copy malware between systems in compromised environments.

MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.

MirrorFace has used Windows native tools to enumerate user information.

MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.

MirrorFace has leveraged WMIC on targeted systems post compromise.

MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.

MirrorFace has used Tasklist on compromised hosts for discovery.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

MirrorFace has used remote templates with VBA code in malware infection chains.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

MirrorFace has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.

MirrorFace has gathered data and files of interest on a single victim machine.

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

MirrorFace has used native Windows tools to obtain domain user information.

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.

MirrorFace has exfiltrated stored emails from compromised hosts.

MirrorFace has exploited vulnerabilities in Fortigate and Array AG devices for initial access.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

MirrorFace has used remote template injection to retrieve malicious payloads from the C2.

MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships.

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.

MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

MirrorFace has placed specific content in phishing emails to target members of particular political parties.

MirrorFace has deployed shellcode to check for Japanese Microsoft Office settings.

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.

MirrorFace has disabled Windows Defender in compromised environments.

MirrorFace has deleted Windows event logs.

MirrorFace can modify the system firewall to allow communication to certain ports.