Dynamic Approaches seen in AveMaria’s Distribution Strategy

MITRE Techniques

• [T1566.001] Spearphishing Attachment – “phishing emails impersonating the Russian government targeted Kazakhstan officials with a malicious .vhdx file disguised as a fake meeting notice.” – Used to deliver initial payloads via email attachments.
• [T1105] Ingress Tool Transfer – “Stage 1: Custom downloader retrieves an encrypted file from a third party file sharing website and after downloading and decrypting in memory, it executes the decrypted version of the retrieved payload, which is in PE format.”
• [T1059.001] PowerShell – “Stage 1: VBScript … calls out powershell.exe with commands consisting of two downloading urls.”
• [T1059.005] VBScript – “The vbscript … on execution, calls out powershell.exe with commands consisting of two downloading urls.”
• [T1218.005] Mshta – “The bundled HTA file downloads the end payload via mshta.exe.”
• [T1095] Non-Application Layer Protocol – “C2 communications on non-HTTP protocol, after decrypting its C2 connection using RC4.”
• [T1547.001] Registry Run Keys/Startup Folder – “adds run key in the registry to achieve persistence.”
• [T1055] Process Injection – “Stage 2: Second stage DLL … leads to process injection of malware into a legitimate file.”
• [T1113] Screen Capture – “remote camera control” capability described as part of AveMaria.
• [T1562.001] Impair Defenses – “exclude the whole drive prior to the initialization of the copied file for further infection, via powershell command.”