Trend Micro Earth Kasha NOV 2024

MirrorFace has used vssadmin to copy registry hives including SAM.

MirrorFace has dumped NTDS.dit through volume shadow copies.

MirrorFace gathered data and files of interest from victim's systems.

HiddenFace can upload files from the victim machine to C2 nodes.

HiddenFace can use active and passive C2 modes that use different encryption algorithms and backdoor commands.

MirrorFace has used RDP to exfiltrate files of interest.

MirrorFace has used SMB to copy malware between systems in compromised environments.

NOOPLDR can use control flow flattening to help hide malicious code.

HiddenFace can dynamically resolve Windows APIs.

The NOOPLDR payload is encrypted with AES256-CBC.

NOOPLDR can insert junk code to obfuscate malicious payloads.

MirrorFace has used Windows native tools to enumerate user information.

HiddenFace has used scheduled tasks for execution and persistence.

NOOPLDR can inject decrypted payloads into processes including wuauclt.exe., rdrleakdiag.exe, and tabcal.exe.

LODEINFO can capture keystrokes on targeted systems.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

NOOPLDR can delete a file containing configuration instructions after use.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

HiddenFace can alter timestamps for directory content on targeted machines.

MirrorFace has gathered data and files of interest on a single victim machine.

NOOPLDR can discover the device ID and hostname from the targeted machine to use for encryption keys.

HiddenFace can enumerate the hostname and username of the compromised system.

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

MirrorFace has used native Windows tools to obtain domain user information.

HiddenFace can act as an internal HTTP proxy within the targeted environment.

HiddenFace can use a custom TCP protocol over Port 443 for C2.

HiddenFace can download files from the C2 to victim systems.

NOOPLDR can use native APIs `NtProtectVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateThreadEx` to aid process injection.

NOOPLDR can store its payload in the Registry using a random hex string in `HKCU\SOFTWARE\Microsoft\COM3`.

NOOPLDR can decrypt its payload prior to execution.

HiddenFace can check for the presence of specific analysis tools and will terminate itself if they are found.

MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships.

HiddenFace can identify processes identified with security applications and tooling.

LODEINFO has used Registry run keys to set persistence.

MirrorStealer can target Group Policy Preferences for credentials.

MirrorStealer has the ability to steal credentials from email clients.

MirrorStealer can steal credentials stored in browsers.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

HiddenFace has used dynamic domain generation algorithms in C2.

HiddenFace's passive mode listens on TCP 47000.

HiddenFace can use RSA-2048 in addition to symmetric algorithms in C2.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.

NOOPLDR can be executed via sideloading.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

HiddenFace can reconfigure Windows firewalls to enable communication by adding a rule named “Cortana” to allow inbound connection to TCP/47000.