ATT&CK ReferencesMicrosoft PLATINUM April 2016

Microsoft PLATINUM April 2016

Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

Open the source

Techniques0

Not cited by any technique.

Groups1

PLATINUM

Software3

adbupd Dipsind JPIN

Campaigns0

None recorded.

Procedure examples38

Technique	Used by	Procedure example
T1003.001 LSASS Memory	GroupPLATINUM	PLATINUM has used keyloggers that are also capable of dumping credentials. Microsoft PLATINUM April 2016
T1007 System Service Discovery	MalwareJPIN	JPIN can list running services. Microsoft PLATINUM April 2016
T1012 Query Registry	MalwareJPIN	JPIN can enumerate Registry keys. Microsoft PLATINUM April 2016
T1016 System Network Configuration Discovery	MalwareJPIN	JPIN can obtain network information, including DNS, IP, and proxies. Microsoft PLATINUM April 2016
T1027 Obfuscated Files or Information	MalwareJPIN	A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer. Microsoft PLATINUM April 2016
T1029 Scheduled Transfer	MalwareDipsind	Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic. Microsoft PLATINUM April 2016
T1033 System Owner/User Discovery	MalwareJPIN	JPIN can obtain the victim user name. Microsoft PLATINUM April 2016
T1055 Process Injection	MalwareJPIN	JPIN can inject content into lsass.exe to load a module. Microsoft PLATINUM April 2016
T1055 Process Injection	GroupPLATINUM	PLATINUM has used various methods of process injection including hot patching. Microsoft PLATINUM April 2016
T1056.001 Keylogging	GroupPLATINUM	PLATINUM has used several different keyloggers. Microsoft PLATINUM April 2016
T1056.001 Keylogging	MalwareJPIN	JPIN contains a custom keylogger. Microsoft PLATINUM April 2016
T1056.004 Credential API Hooking	GroupPLATINUM	PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access. Microsoft PLATINUM April 2016
T1057 Process Discovery	MalwareJPIN	JPIN can list running processes. Microsoft PLATINUM April 2016
T1059.003 Windows Command Shell	Malwareadbupd	adbupd can run a copy of cmd.exe. Microsoft PLATINUM April 2016
T1059.003 Windows Command Shell	MalwareDipsind	Dipsind can spawn remote shells. Microsoft PLATINUM April 2016
T1059.003 Windows Command Shell	MalwareJPIN	JPIN can use the command-line utility cacls.exe to change file permissions. Microsoft PLATINUM April 2016
T1068 Exploitation for Privilege Escalation	GroupPLATINUM	PLATINUM has leveraged a zero-day vulnerability to escalate privileges. Microsoft PLATINUM April 2016
T1069.001 Local Groups	MalwareJPIN	JPIN can obtain the permissions of the victim user. Microsoft PLATINUM April 2016
T1070.004 File Deletion	MalwareJPIN	JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running. Microsoft PLATINUM April 2016
T1071.001 Web Protocols	MalwareDipsind	Dipsind uses HTTP for C2. Microsoft PLATINUM April 2016
T1071.002 File Transfer Protocols	MalwareJPIN	JPIN can communicate over FTP. Microsoft PLATINUM April 2016
T1071.003 Mail Protocols	MalwareJPIN	JPIN can send email over SMTP. Microsoft PLATINUM April 2016
T1082 System Information Discovery	MalwareJPIN	JPIN can obtain system information such as OS version and disk space. Microsoft PLATINUM April 2016
T1083 File and Directory Discovery	MalwareJPIN	JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe. Microsoft PLATINUM April 2016
T1105 Ingress Tool Transfer	MalwareDipsind	Dipsind can download remote files. Microsoft PLATINUM April 2016
T1105 Ingress Tool Transfer	MalwareJPIN	JPIN can download files and upgrade itself. Microsoft PLATINUM April 2016
T1132.001 Standard Encoding	MalwareDipsind	Dipsind encodes C2 traffic with base64. Microsoft PLATINUM April 2016
T1189 Drive-by Compromise	GroupPLATINUM	PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins. Microsoft PLATINUM April 2016
T1197 BITS Jobs	MalwareJPIN	A JPIN variant downloads the backdoor payload via the BITS service. Microsoft PLATINUM April 2016
T1204.002 Malicious File	GroupPLATINUM	PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims. Microsoft PLATINUM April 2016
T1222.001 Windows Permissions	MalwareJPIN	JPIN can use the command-line utility cacls.exe to change file permissions. Microsoft PLATINUM April 2016
T1518.001 Security Software Discovery	MalwareJPIN	JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them. Microsoft PLATINUM April 2016
T1546.003 Windows Management Instrumentation Event Subscription	Malwareadbupd	adbupd can use a WMI script to achieve persistence. Microsoft PLATINUM April 2016
T1547.004 Winlogon Helper DLL	MalwareDipsind	A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence. Microsoft PLATINUM April 2016
T1566.001 Spearphishing Attachment	GroupPLATINUM	PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector. Microsoft PLATINUM April 2016
T1573.001 Symmetric Cryptography	MalwareDipsind	Dipsind encrypts C2 data with AES256 in ECB mode. Microsoft PLATINUM April 2016
T1573.002 Asymmetric Cryptography	Malwareadbupd	adbupd contains a copy of the OpenSSL library to encrypt C2 traffic. Microsoft PLATINUM April 2016
T1685 Disable or Modify Tools	MalwareJPIN	JPIN can lower security settings by changing Registry keys. Microsoft PLATINUM April 2016

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.