ATT&CK SoftwareTYPEFRAME

TYPEFRAME

S0263

Malware.View on attack.mitre.org

About this malware

TYPEFRAME is a remote access tool that has been used by Lazarus Group.

Procedure examples15

Technique	Procedure example
T1027.011 Fileless Storage	TYPEFRAME can install and store encrypted configuration data under the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs`. US-CERT TYPEFRAME June 2018
T1027.013 Encrypted/Encoded File	APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR. US-CERT TYPEFRAME June 2018
T1059.003 Windows Command Shell	TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell. US-CERT TYPEFRAME June 2018
T1059.005 Visual Basic	TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution. US-CERT TYPEFRAME June 2018
T1070.004 File Deletion	TYPEFRAME can delete files off the system. US-CERT TYPEFRAME June 2018
T1083 File and Directory Discovery	TYPEFRAME can search directories for files on the victim’s machine. US-CERT TYPEFRAME June 2018
T1090 Proxy	A TYPEFRAME variant can force the compromised system to function as a proxy server. US-CERT TYPEFRAME June 2018
T1105 Ingress Tool Transfer	TYPEFRAME can upload and download files to the victim’s machine. US-CERT TYPEFRAME June 2018
T1112 Modify Registry	TYPEFRAME can install encrypted configuration data under the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs`. US-CERT TYPEFRAME June 2018
T1140 Deobfuscate/Decode Files or Information	One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35". US-CERT TYPEFRAME June 2018
T1204.002 Malicious File	A Word document delivering TYPEFRAME prompts the user to enable macro execution. US-CERT TYPEFRAME June 2018
T1543.003 Windows Service	TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine. US-CERT TYPEFRAME June 2018
T1571 Non-Standard Port	TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method. US-CERT TYPEFRAME June 2018
T1680 Local Storage Discovery	TYPEFRAME can gather the disk volume information. US-CERT TYPEFRAME June 2018
T1686.003 Windows Host Firewall	TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections. US-CERT TYPEFRAME June 2018

Groups that use it1

Campaigns0

None recorded.

References1

US-CERT TYPEFRAME June 2018 Open source
US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.