Kaspersky WIRTE November 2021

LitePower can query the Registry for keys added to execute COM hijacking.

LitePower can determine if the current user has admin privileges.

WIRTE has used security service provider naming conventions such as ESET and Kasperky ("Kaspersky Update Agent") in order to appear legitimate.

LitePower can send collected data, including screenshots, over its C2 channel.

LitePower can create a scheduled task to enable persistence mechanisms.

LitePower can use a PowerShell script to execute commands.

Ferocious can use PowerShell scripts for execution.

Ferocious has the ability to use Visual Basic scripts for execution.

Ferocious can delete files from a compromised host.

LitePower can use HTTP and HTTPS for C2 communications.

Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.

LitePower has the ability to enumerate the OS architecture.

LitePower has the ability to download payloads containing system commands to a compromised host.

LitePower can use various API calls.

Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.

LitePower can take system screenshots and save them to `%AppData%`.

Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function GET.WORKSPACE to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.

LitePower can identify installed AV software.

Ferocious has checked for AV software as part of its persistence process.

Ferocious can use COM hijacking to establish persistence.

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.

WIRTE has used HTTPS over ports 2083 and 2087 for C2.

LitePower has the ability to list local drives.