ATT&CK SoftwareLoJax

LoJax

S0397

Malware.View on attack.mitre.org

About this malware

LoJax is a UEFI rootkit used by APT28 to persist remote access software on targeted systems.

Techniques used5

Persistence3

T1112Modify Registry T1542.001System Firmware T1547.001Registry Run Keys / Startup Folder

Privilege Escalation1

T1547.001Registry Run Keys / Startup Folder

Stealth3

T1014Rootkit T1542.001System Firmware T1564.004NTFS File Attributes

Defense Impairment1

T1112Modify Registry

Procedure examples5

Technique	Procedure example
T1014 Rootkit	LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems. ESET LoJax Sept 2018
T1112 Modify Registry	LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk ’` to `‘autocheck autoche ’`. ESET LoJax Sept 2018
T1542.001 System Firmware	LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems. ESET LoJax Sept 2018
T1547.001 Registry Run Keys / Startup Folder	LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk ’` to `‘autocheck autoche ’` in order to execute its payload during Windows startup. ESET LoJax Sept 2018
T1564.004 NTFS File Attributes	LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions. ESET LoJax Sept 2018

Groups that use it1

Campaigns0

None recorded.

References1

ESET LoJax Sept 2018 Open source
ESET. (2018, September). LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group. Retrieved July 2, 2019.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.