ATT&CK ReferencesESET Sednit Part 1

ESET Sednit Part 1

ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software1

JHUHUGIT

Campaigns0

None recorded.

Procedure examples14

Technique	Used by	Procedure example
T1008 Fallback Channels	MalwareJHUHUGIT	JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails. ESET Sednit Part 1
T1027.013 Encrypted/Encoded File	MalwareJHUHUGIT	Many strings in JHUHUGIT are obfuscated with a XOR algorithm. ESET Sednit Part 1 F-Secure Sofacy 2015 Talos Seduploader Oct 2017
T1037.001 Logon Script (Windows)	MalwareJHUHUGIT	JHUHUGIT has registered a Windows shell script under the Registry key `HKCU\Environment\UserInitMprLogonScript` to establish persistence. ESET Sednit Part 1 Talos Seduploader Oct 2017
T1053.005 Scheduled Task	MalwareJHUHUGIT	JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in. ESET Sednit July 2015 ESET Sednit Part 1
T1057 Process Discovery	MalwareJHUHUGIT	JHUHUGIT obtains a list of running processes on the victim. ESET Sednit Part 1 Unit 42 Sofacy Feb 2018
T1068 Exploitation for Privilege Escalation	MalwareJHUHUGIT	JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges. ESET Sednit July 2015 ESET Sednit Part 1
T1070.004 File Deletion	MalwareJHUHUGIT	The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files. ESET Sednit Part 1 Unit 42 Sofacy Feb 2018
T1071.001 Web Protocols	MalwareJHUHUGIT	JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS. ESET Sednit Part 1 Unit 42 Playbook Dec 2017 Unit 42 Sofacy Feb 2018
T1105 Ingress Tool Transfer	MalwareJHUHUGIT	JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine. ESET Sednit Part 1 Talos Seduploader Oct 2017 Unit 42 Sofacy Feb 2018
T1543.003 Windows Service	MalwareJHUHUGIT	JHUHUGIT has registered itself as a service to establish persistence. ESET Sednit Part 1
T1546.015 Component Object Model Hijacking	GroupAPT28	APT28 has used COM hijacking for persistence by replacing the legitimate `MMDeviceEnumerator` object with a payload. ESET Sednit Part 1 ESET Zebrocy May 2019
T1546.015 Component Object Model Hijacking	MalwareJHUHUGIT	JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}). ESET Sednit Part 1 Talos Seduploader Oct 2017
T1547.001 Registry Run Keys / Startup Folder	MalwareJHUHUGIT	JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process. ESET Sednit Part 1
T1680 Local Storage Discovery	MalwareJHUHUGIT	JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key `HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum`. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name. ESET Sednit Part 1 Unit 42 Sofacy Feb 2018

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.