Trend Micro Tick November 2019

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

down_new has the ability to identify the MAC address of a compromised host.

Avenger can identify the domain of the compromised host.

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

BBK can extract a malicious Portable Executable (PE) from a photo.

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.

ABK can extract a malicious Portable Executable (PE) from a photo.

Avenger can extract backdoor malware from downloaded images.

build_downer can extract malware from a downloaded JPEG.

Avenger has the ability to XOR encrypt files to be sent to C2.

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.

build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.

ABK has the ability to inject shellcode into svchost.exe.

BBK has the ability to inject shellcode into svchost.exe.

Avenger has the ability to inject shellcode into svchost.exe.

down_new has the ability to list running processes on a compromised host.

Avenger has the ability to use Tasklist to identify running processes.

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

BRONZE BUTLER has used VBS and VBE scripts for execution.

BRONZE BUTLER has made use of Python-based remote access tools.

ABK has the ability to use HTTP in communications with C2.

BBK has the ability to use HTTP in communications with C2.

Avenger has the ability to use HTTP in communication with C2.

down_new has the ability to use HTTP in C2 communications.

Avenger has the ability to identify the OS architecture on a compromised host.

Avenger has the ability to browse files in directories such as Program Files and the Desktop.

down_new has the ability to list the directories on a compromised host.

build_downer has the ability to download files from C2 to the infected host.

BBK has the ability to download files from C2 to the infected host.

down_new has the ability to download files to the compromised host.

Avenger has the ability to download files from C2 to a compromised host.

ABK has the ability to download files from C2.

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.

build_downer has the ability to use the WinExec API to execute malware on a compromised host.

BRONZE BUTLER has used a tool to capture screenshots.

build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.

down_new has the ability to base64 encode C2 communications.

BBK has the ability to decrypt AES encrypted payloads.

Avenger has the ability to decrypt files downloaded from C2.

ABK has the ability to decrypt AES encrypted payloads.

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.

BRONZE BUTLER has used tools to enumerate software installed on an infected host.

down_new has the ability to gather information on installed applications.

down_new has the ability to detect anti-virus products and processes on a compromised host.

Avenger has the ability to identify installed anti-virus products on a compromised host.

ABK has the ability to identify the installed anti-virus product on the compromised host.

build_downer has the ability to detect if the infected host is running an anti-virus process.