Procedure examples

Mis-Type has collected files and data from a compromised host.

Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.

Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

Mis-Type runs tests to determine the privilege level of the compromised user.

Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Mis-Type has transmitted collected files and data to its C2 server.

Mis-Type has been injected directly into a running process, including `explorer.exe`.

Mis-Type has used `cmd.exe` to run commands on a compromised host.

Mis-Type network traffic can communicate over HTTP.

Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.

The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.

Mis-Type network traffic can communicate over a raw socket.

Mis-Type has downloaded additional malware and files onto a compromised host.

Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.

Mis-Type uses Base64 encoding for C2 traffic.

Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.

Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.