A Truly Graceful Wipe Out

MITRE Techniques

• [T1566.002] Phishing – Initial access via email campaign. Quote: “initial access was obtained through an email campaign.”
• [T1204.002] User Execution – Payload masqueraded as a PDF; user executed it. Quote: “The payload, Document_may_24_16654.exe, imitated a PDF document by using an icon of an Adobe Acrobat document.”
• [T1059.001] PowerShell – Obfuscated PowerShell usage to create tasks and load components. Quote: “in obfuscated PowerShell, where the Schedule.Service COM Object was used to create a new task.”
• [T1053.005] Scheduled Task – Multiple methods to create persistence tasks; random task names. Quote: “three different methods to create new scheduled tasks.”
• [T1055] Process Injection – Beacon DLL injection and signs of injection in various processes (cmd.exe, svchost.exe, msiexec.exe). Quote: “injected module beacon.dll” and “memory of cmd.exe clearly indicated signs of injection.”
• [T1021.002] Remote Services – Lateral movement using PsExec/JUMP; Cobalt Strike module used for movement. Quote: “Cobalt Strike’s jump psexec module to move to new hosts.”
• [T1003.001] OS Credential Dumping – LSASS memory accessed for credential dumping. Quote: “accessed LSASS memory on the beachhead host.”
• [T1550.002] Pass the Hash – Lateral movement using a local administrator hash. Quote: “used a local administrator hash to perform pass-the-hash lateral movement.”
• [T1047] Windows Management Instrumentation – Remote execution/collection via WMIC utilities; remote process queries. Quote: “wmic /node: process get executablepath.”
• [T1069.001/T1069.002] Domain/Local Group Discovery – Discovery of domain admins/domain controllers and local groups; adminr user added to groups. Quote: “adminr… added to the Local Administrators group and Remote Desktop Users group.”
• [T1083/T1087] File and Directory/Account Discovery – Discovery commands (dir, net view, AdFind) and domain user attributes. Quote: “AdFind was used… to collect operating system information and specific attributes from the domain user objects.”
• [T1561.002] Disk Structure Wipe – MBR Killer overwrites MBR/MFT/VBR/EBR and triggers reboot. Quote: “overwrote the MBR (Master Boot Record) and triggered a reboot, rendering the hosts unusable.”
• [T1562.001] Impair Defenses – Disable Windows Defender Real-Time monitoring and add exclusions. Quote: “disable Windows Defender Real-Time monitoring and added exclusions.”
• [T1041] Exfiltration – Data exfiltration occurred in two periods via non-TLS TCP channels. Quote: “two distinct exfiltration periods were observed taking place.” and “The network traffic was not sent over a TLS connection but just the TCP protocol.”