PWC Cloud Hopper Technical Annex April 2017

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

RedLeaves can obtain information about network parameters.

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.

menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.

A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.

RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

RedLeaves can enumerate drives and Remote Desktop sessions.

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

EvilGrab has the capability to capture keystrokes.

menuPass uses PowerSploit to inject shellcode into PowerShell.

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

RedLeaves can delete specified files.

RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

ChChes collects the victim hostname, window resolution, and Microsoft Windows version.

RedLeaves can enumerate and search for files and directories.

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.

RedLeaves is capable of downloading a file from a specified URL.

EvilGrab has the capability to capture screenshots.

EvilGrab has the capability to capture audio from a victim machine.

EvilGrab has the capability to capture video from a victim machine.

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

menuPass has used InstallUtil.exe to execute malicious software.

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.

PlugX adds Run key entries in the Registry to establish persistence. PlugX has established persistence via the registry keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

ChChes establishes persistence by adding a Registry Run key.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.

ChChes steals credentials stored inside Internet Explorer.

menuPass has compressed files before exfiltration using TAR and RAR.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

RedLeaves can use HTTP over non-standard ports, such as 995, for C2.

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

ChChes can alter the victim's proxy configuration.