ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Software: S0640×

17 examples

Technique	Used by	Procedure example
T1016 System Network Configuration Discovery	MalwareAvaddon	Avaddon can collect the external IP address of the victim. Awake Security Avaddon
T1027 Obfuscated Files or Information	MalwareAvaddon	Avaddon has used encrypted strings. Arxiv Avaddon Feb 2021
T1047 Windows Management Instrumentation	MalwareAvaddon	Avaddon uses wmic.exe to delete shadow copies. Hornet Security Avaddon June 2020
T1057 Process Discovery	MalwareAvaddon	Avaddon has collected information about running processes. Arxiv Avaddon Feb 2021
T1059.007 JavaScript	MalwareAvaddon	Avaddon has been executed through a malicious JScript downloader. Awake Security Avaddon Hornet Security Avaddon June 2020
T1083 File and Directory Discovery	MalwareAvaddon	Avaddon has searched for specific files prior to encryption. Arxiv Avaddon Feb 2021
T1106 Native API	MalwareAvaddon	Avaddon has used the Windows Crypto API to generate an AES key. Hornet Security Avaddon June 2020
T1112 Modify Registry	MalwareAvaddon	Avaddon modifies several registry keys for persistence and UAC bypass. Arxiv Avaddon Feb 2021
T1135 Network Share Discovery	MalwareAvaddon	Avaddon has enumerated shared folders and mapped volumes. Arxiv Avaddon Feb 2021
T1140 Deobfuscate/Decode Files or Information	MalwareAvaddon	Avaddon has decrypted encrypted strings. Arxiv Avaddon Feb 2021
T1486 Data Encrypted for Impact	MalwareAvaddon	Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes. Arxiv Avaddon Feb 2021
T1489 Service Stop	MalwareAvaddon	Avaddon looks for and attempts to stop database processes. Arxiv Avaddon Feb 2021
T1490 Inhibit System Recovery	MalwareAvaddon	Avaddon deletes backups and shadow copies using native system tools. Arxiv Avaddon Feb 2021 Hornet Security Avaddon June 2020
T1547.001 Registry Run Keys / Startup Folder	MalwareAvaddon	Avaddon uses registry run keys for persistence. Arxiv Avaddon Feb 2021
T1548.002 Bypass User Account Control	MalwareAvaddon	Avaddon bypasses UAC using the CMSTPLUA COM interface. Arxiv Avaddon Feb 2021
T1614.001 System Language Discovery	MalwareAvaddon	Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities. Arxiv Avaddon Feb 2021
T1685 Disable or Modify Tools	MalwareAvaddon	Avaddon looks for and attempts to stop anti-malware solutions. Arxiv Avaddon Feb 2021

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.