FireEye FIN7 April 2017

HALFBAKED can use WMI queries to gather system information.

FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.

HALFBAKED can obtain information about running processes on the victim.

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.

HALFBAKED can execute PowerShell scripts.

HALFBAKED can delete a specified file.

HALFBAKED can obtain information about the OS, processor, and BIOS.

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

HALFBAKED can obtain screenshots from the victim.

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.