Kaspersky Cloud Atlas August 2019

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

PowerShower has the ability to identify the current Windows domain of the infected host.

PowerShower has the ability to identify the current user on the infected host.

PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.

VBShower has the ability to execute VBScript files.

VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.

VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.

VBShower has the ability to download VBS files to the target computer.

PowerShower has the ability to encode C2 communications with base64 encoding.

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

Inception has used malicious HTA files to drop and execute malware.

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8} to maintain persistence.

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.

Inception has obtained and used open-source tools such as LaZagne.