JPCERT MirrorFace JUL 2024

MirrorFace has dumped LSASS memory for credential access.

MirrorFace has used vssadmin to copy registry hives including SAM.

MirrorFace has dumped NTDS.dit through volume shadow copies.

HiddenFace can upload files from the victim machine to C2 nodes.

MirrorFace has used Tasklist for discovery post compromise.

MirrorFace has used ipconfig for reconnaissance.

MirrorFace has used Ping for system discovery.

MirrorFace has used SMB to copy malware between systems in compromised environments.

NOOPLDR can use control flow flattening to help hide malicious code.

HiddenFace has encrypted its payload with AES.

NOOPLDR can insert junk code to obfuscate malicious payloads.

MirrorFace has leveraged WMIC on targeted systems post compromise.

MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.

HiddenFace can inject code directly into legitimate applications.

MirrorFace has used Tasklist on compromised hosts for discovery.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

HiddenFace can alter timestamps for directory content on targeted machines.

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.

HiddenFace can enumerate the hostname and username of the compromised system.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.

HiddenFace can use a custom TCP protocol over Port 443 for C2.

HiddenFace can download files from the C2 to victim systems.

HiddenFace can store its configuration file in the Registry.

NOOPLDR can be executed via MSBuild.

HiddenFace has the ability to decrypt its payload prior to execution.

MirrorFace has exploited vulnerabilities in Fortigate and Array AG devices for initial access.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

NOOPLDR can hide services used to aid execution.

HiddenFace has used dynamic domain generation algorithms in C2.

HiddenFace's passive mode listens on TCP 47000.

NOOPLDR can be executed via sideloading.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

MirrorFace has disabled Windows Defender in compromised environments.

MirrorFace has deleted Windows event logs.

MirrorFace can modify the system firewall to allow communication to certain ports.