DFIR Phosphorus November 2021

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.

Magic Hound has used Ping for discovery on targeted networks.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.

Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.

Magic Hound has used scheduled tasks to establish persistence and execution.

Magic Hound has used PowerShell for execution and privilege escalation.

Magic Hound has used the command-line interface for code execution.

Magic Hound has deleted and overwrote files to cover tracks.

Magic Hound malware has used IRC for C2.

Magic Hound has used HTTP for C2.

Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.

Magic Hound has used domain administrator accounts after dumping LSASS process memory.

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.

Magic Hound has downloaded additional code and files from servers onto victims.

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`

Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).

Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.

Magic Hound has used multiple web shells to gain execution.

Magic Hound malware has used Registry Run keys to establish persistence.

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.

Magic Hound has copied tools within a compromised network using RDP.

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.

Magic Hound has used Plink to tunnel RDP over SSH.

Magic Hound has used an encrypted http proxy in C2 communications.

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.

Magic Hound has executed scripts to disable the event log service.

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.