FireEye MuddyWater Mar 2018

POWERSTATS can upload files from compromised hosts.

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation

POWERSTATS can sleep for a given number of seconds.

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

POWERSTATS can use WMI queries to retrieve data from compromised hosts.

MuddyWater has used PowerShell for execution.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.

POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.

POWERSTATS can retrieve usernames from compromised hosts.

POWERSTATS has connected to C2 servers through proxies.

POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.

POWERSTATS can retrieve screenshots from compromised hosts.

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.

POWERSTATS has detected security tools.

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

POWERSTATS can use DDE to execute additional payloads on compromised hosts.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

POWERSTATS has encrypted C2 traffic with RSA.

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.