DFIR Report APT35 ProxyShell March 2022

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.

Magic Hound has used quser.exe to identify existing RDP connections.

Magic Hound has used scheduled tasks to establish persistence and execution.

Magic Hound has used PowerShell for execution and privilege escalation.

Magic Hound has used the command-line interface for code execution.

Magic Hound has removed mailbox export requests from compromised Exchange servers.

Magic Hound has used HTTP for C2.

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

Magic Hound has used Powershell to discover email accounts.

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.

Magic Hound has downloaded additional code and files from servers onto victims.

Magic Hound has modified Registry settings for security tools.

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.

Magic Hound has used multiple web shells to gain execution.

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.

Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.