Mandiant FIN13 Aug 2022

FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.

FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.

FIN13 has used `nslookup` and `ipconfig` for network reconnaissance efforts. FIN13 has also utilized a compromised Symantec Altiris console and LanDesk account to retrieve network information.

FIN13 has used `Ping` and `tracert` for network reconnaissance efforts.

FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.

FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.

FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.

FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.

FIN13 has utilized `nmap` for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.

FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.

FIN13 has used `netstat` and other net commands for network reconnaissance efforts.

FIN13 has created scheduled tasks in the `C:\Windows` directory of the compromised network.

FIN13 has logged the keystrokes of victims to escalate privileges.

FIN13 has used PowerShell commands to obtain DNS data from a compromised network.

FIN13 has leveraged `xp_cmdshell` and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.

FIN13 has enumerated all users and roles from a victim's main treasury system.

FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.

FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.

FIN13 has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.

FIN13 has used the Windows `dir` command to enumerate files and directories in a victim's network.

FIN13 has enumerated all users and their roles from a victim's main treasury system.

FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.

FIN13 has downloaded additional tools and malware to compromised systems.

FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).

FIN13 has executed net view commands for enumeration of open shares on compromised machines.

FIN13 has utilized `certutil` to decode base64 encoded versions of custom malware.

FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.

FIN13 has used Windows Registry run keys such as, `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts` to maintain persistence.

FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.

FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.

FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.

FIN13 has utilized custom malware to maintain persistence in a compromised environment.

FIN13 has researched employees to target for social engineering attacks.

FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.