Checkpoint MosesStaff Nov 2021

Moses Staff has collected the domain name of a compromised network.

Moses Staff has used batch scripts that can enable SMB on a compromised host.

PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.

Moses Staff has used obfuscated web shells in their operations.

DCSrv's configuration is encrypted.

PyDCrypt has probed victim machines with whoami and has collected the username from the machine.

DCSrv has masqueraded its service as a legitimate svchost.exe process.

PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.

PyDCrypt has attempted to execute with WMIC.

PyDCrypt has used netsh to find RPC connections on remote machines.

PyDCrypt has attempted to execute with PowerShell.

PyDCrypt has used `cmd.exe` for execution.

PyDCrypt, along with its functions, is written in Python.

PyDCrypt will remove all created artifacts such as dropped executables.

Moses Staff collected information about the infected host, including the machine names and OS architecture.

Moses Staff has collected the administrator username from a compromised host.

Moses Staff has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.

DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.

DCSrv has created Registry keys for persistence.

DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.

PyDCrypt has decrypted and dropped the DCSrv payload to disk.

Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.

DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.

Moses Staff has dropped a web shell onto a compromised system.

DCSrv has a function to sleep for two hours before rebooting the system.

DCSrv has created new services for persistence by modifying the Registry.

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.

Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.

Moses Staff has used the commercial tool DiskCryptor.

PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.

Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.