Procedure examples

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. TONESHELL variants have utilized FakeTLS headers with the bytes `0x17 0x03 0x03` to represent TLSv1.2 and `0x17 0x03 0x04` for TLSv1.3.

TONESHELL has used `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.

TONESHELL has used randomized padding to obfuscate payloads.

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.

TONESHELL has been initiated using LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

TONESHELL has obtained the username from an infected host.

TONESHELL has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility Service).

TONESHELL has renamed malicious files to mimic legitimate file names and file extensions. TONESHELL has also masqueraded as legitimate file names to include LogMeIn.dll.

TONESHELL has used WMI queries to gather information from the system.

TONESHELL has created scheduled tasks to maintain persistence.

TONESHELL has used DLL injection to execute payloads received from the C2 server.

TONESHELL has capabilities to conduct keylogging.

TONESHELL has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler. TONESHELL has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.

TONESHELL has created a reverse shell using `cmd.exe`.

TONESHELL has deleted payload files received from the C2 server.

TONESHELL has utilized HTTP for a C2 protocol through HTTP POST. TONESHELL has also utilized HTTPS for C2.

TONESHELL has the ability to retrieve the name of the infected machine.

TONESHELL included functionality to retrieve a list of user accounts.

TONESHELL has utilized TCP-based reverse shells.

TONESHELL has the ability to download additional files to the victim device.

TONESHELL has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`. TONESHELL has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`. TONESHELL has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.

TONESHELL has conducted screen capturing.

TONESHELL has encoded a payload with a random 32-byte key using XOR. TONESHELL has also encoded payloads with a 256-byte key using XOR.

TONESHELL included functionality to create sub-processes with a specific user’s token.

TONESHELL has decoded its payload prior to execution.

TONESHELL has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.

TONESHELL has used regsvr32.exe to execute the windows `DLLRegisterServer` function.

TONESHELL has injected its malicious payload into a running process through Windows utility Microsoft Application Virtualization Injector `MAVInject.exe`.

TONESHELL has an exception handler that executes when ESET antivirus applications `ekrn.exe` and `egui.exe` are not found and directly injects its code into waitfor.exe using Native Windows API including `WriteProcessMemory` and `CreateRemoteThreadEx`.

TONESHELL has generated unique GUIDs to identify victim devices. TONESHELL has leveraged environmental keying in payload delivery using the victim computer name and other configuration values. TONESHELL has also tracked IDs associated with reverse shell subprocesses to manage interactions and terminations from C2.

TONESHELL has created a mutex to avoid duplicate execution.

TONESHELL has leveraged `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.

TONESHELL has checked for the presence of ESET antivirus applications `ekrn.exe` and `egui.exe`.

TONESHELL has created a malicious service DISMsrv to maintain persistence.

TONESHELL has added Registry Run keys to achieve persistence.

TONESHELL has used valid legitimate digital signatures and certificates to evade detection.

TONESHELL has facilitated inter-process communication between DLL components via the use of pipes. TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.

TONESHELL used WinRAR rar.exe to archive files for exfiltration. TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.

TONESHELL has used RC4 encryption in C2 communications. TONESHELL variants used a randomly generated variable length (0x20 - 0x200 bytes) rolling XOR key to encrypt and decrypt network packets.

TONESHELL has abused legitimate executables to side-load malicious DLLs. TONESHELL has also been loaded via DLL side-loading, using legitimate, signed executables to include: FastVD.exe, Bandizip.exe and gpgconf.exe.

TONESHELL has leveraged custom exception handlers to hide code flow and stop execution of a debugger.

TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.

TONESHELL has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C:` to identify the victim machine.