ATT&CK SoftwareOSInfo

OSInfo

S0165

Malware.View on attack.mitre.org

About this malware

OSInfo is a custom tool used by APT3 to do internal discovery on a victim's computer and network.

Techniques used10

Discovery10

T1012Query Registry T1016System Network Configuration Discovery T1018Remote System Discovery T1049System Network Connections Discovery T1069.001Local Groups T1069.002Domain Groups T1082System Information Discovery T1087.001Local Account T1087.002Domain Account T1135Network Share Discovery

Procedure examples10

Technique	Procedure example
T1012 Query Registry	OSInfo queries the registry to look for information about Terminal Services. Symantec Buckeye
T1016 System Network Configuration Discovery	OSInfo discovers the current domain information. Symantec Buckeye
T1018 Remote System Discovery	OSInfo performs a connection test to discover remote systems in the network Symantec Buckeye
T1049 System Network Connections Discovery	OSInfo enumerates the current network connections similar to `net use` . Symantec Buckeye
T1069.001 Local Groups	OSInfo has enumerated the local administrators group. Symantec Buckeye
T1069.002 Domain Groups	OSInfo specifically looks for Domain Admins and power users within the domain. Symantec Buckeye
T1082 System Information Discovery	OSInfo discovers information about the infected machine. Symantec Buckeye
T1087.001 Local Account	OSInfo enumerates local and domain users Symantec Buckeye
T1087.002 Domain Account	OSInfo enumerates local and domain users Symantec Buckeye
T1135 Network Share Discovery	OSInfo discovers shares on the network Symantec Buckeye

Groups that use it1

Campaigns0

None recorded.

References1

Symantec Buckeye Open source
Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.