ATT&CK ReferencesESET LoJax Sept 2018

ESET LoJax Sept 2018

ESET. (2018, September). LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group. Retrieved July 2, 2019.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1014 Rootkit	MalwareLoJax	LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems. ESET LoJax Sept 2018
T1014 Rootkit	GroupAPT28	APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax. ESET LoJax Sept 2018 Symantec APT28 Oct 2018
T1112 Modify Registry	MalwareLoJax	LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk ’` to `‘autocheck autoche ’`. ESET LoJax Sept 2018
T1542.001 System Firmware	MalwareLoJax	LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems. ESET LoJax Sept 2018
T1547.001 Registry Run Keys / Startup Folder	MalwareLoJax	LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk ’` to `‘autocheck autoche ’` in order to execute its payload during Windows startup. ESET LoJax Sept 2018
T1564.004 NTFS File Attributes	MalwareLoJax	LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions. ESET LoJax Sept 2018

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.