Scam Detection and Incident Management

MITRE Techniques

• [T1608.006] Stage Capabilities: SEO Poisoning – used to place malicious download sites in search results (‘advertising their websites in Yandex search results’).
• [T1608.001] Stage Capabilities: Upload Malware – attackers hosted malicious ZIP/MSI installers on cloned or GitHub/raw pages (‘download a ZIP file being falsely advertised as popular software’).
• [T1204.001] User Execution: Malicious Link – users were led to malicious resources via YouTube descriptions, comments and Telegram links (‘links to their resources and instructions on how to launch the malware’).
• [T1204.002] User Execution: Malicious File – distribution relied on users running password-protected MSI installers inside ZIP archives (‘Inside the archive is an MSI file and a TXT file with a password required for installation’).
• [T1059.010] Command and Scripting Interpreter: AutoHotKey & AutoIT – attackers used a legitimate AutoIt interpreter to execute compiled A3X scripts embedded in DLLs (‘AutoIt interpreter has an interesting way of reading files…compiled scripts’).
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – BAT files and “start” commands are used throughout the chain to extract and launch components (‘the BAT file extracts the encrypted RAR archive and runs the “start” command’).
• [T1059.005] Command and Scripting Interpreter: Visual Basic – MSI CustomAction executed VBScript to start the BAT extraction chain (‘CustomAction field value of the MSI file is executed — this is effectively a VB script’).
• [T1546.012] Event Triggered Execution: Image File Execution Options Injection – registry debugger/monitor keys are abused for persistence (‘abuses the registry keys “Image File Execution Options”, “Debugger” and “MonitorProcess”’).
• [T1546.003] Event Triggered Execution: Windows Management Instrumentation Event Subscription – WMI filters and bindings are created to run commands on common events (‘creates filters which are activated by common events … executed using the __FilterToConsumerBinding class’).
• [T1053.005] Scheduled Task/Job: Scheduled Task – periodic execution is scheduled via WMI polling frequencies to run netcat, nun.bat and other steps (‘Once every three minutes… once every five to ten minutes… once every fifteen minutes’).
• [T1055] Process Injection – final payload injects the miner into explorer.exe memory (‘injects into a newly created explorer.exe process memory an open-source miner’).
• [T1562.001] Impair Defenses: Disable or Modify Tools – installers and instructions advise disabling antivirus/Windows Defender (‘attackers recommend disabling any installed antivirus and Windows Defender beforehand’).
• [T1497] Virtualization/Sandbox Evasion – the MSI password and process checks stop execution in sandboxed or analysis environments (‘the MSI file asks for the password… one of the first countermeasures against sandbox analysis’ and implant checks active processes’).
• [T1027.009] Obfuscated Files or Information: Embedded Payloads – A3X and other files embed additional payloads and installers inside compiled scripts/DLL signatures (‘the interpreter stores the files for installation right inside the compiled script’).
• [T1027.010] Obfuscated Files or Information: Command Obfuscation – scripts and compiled components use obfuscation and embedding to hide actions (‘malicious A3X implant… deobfuscated code shows security process name check’).
• [T1036.008] Masquerading: Masquerade File Type – netcat is renamed StartMenuExperienceHost.exe and signed DLLs are used to appear legitimate (‘netcat utility masked as StartMenuExperienceHost.exe’ and payload hidden in legit dynamic library signature).
• [T1564.001] Hide Artifacts: Hidden Files and Directories – installed directories are set system/hidden/read-only and use GUID-like names to hide in Explorer (‘directories containing the installed files have system, hidden and read-only attributes’ and use names like Classic.{GUID}).
• [T1518.001] Software Discovery: Security Software Discovery – the implant collects installed AV/software info to decide on actions (‘collects… installed AV software’).
• [T1033] System Owner/User Discovery – the implant gathers computer name and username (‘collects the following information: computer name, username’).
• [T1082] System Information Discovery – OS version, architecture, CPU and GPU data are enumerated (‘OS version and architecture, CPU name, data about the GPU’).
• [T1113] Screen Capture – some variants take screenshots of the desktop (‘some of the malware variants sending a screenshot of the user’s desktop’).
• [T1496] Resource Hijacking – SilentCryptoMiner is used to mine cryptocurrencies on victims’ machines (‘injects… an open-source miner named SilentCryptoMiner’ to mine Monero/Zephyr).
• [T1041] Exfiltration Over C2 Channel – collected host info is sent to a Telegram bot and C2 channels control the implant (‘sent to a special Telegram bot chat controlled by the attackers’ and netcat connects to sportjump[.]ru).