Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC1549 (threat actor)
Risk
74
High
13 techniques 40 tools/malware 2 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1199
Trusted Relationship initial access
›
4 Exploitation
3
T1059.001
PowerShell execution
CVE CVE-2020-0688
CVE CVE-2021-26855
›
5 Installation
3
T1003.006
DCSync credential access
T1110.003
Password Spraying credential access
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
4
T1113
Screen Capture collection
T1123
Audio Capture collection
T1213.002
Sharepoint collection
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
4
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T1574.001
DLL stealth
T0812
T0812
Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors Beacon C2 infrastructure CRASHPAD Custom Backdoor Custom backdoors Custom malware Custom tools DCSYNCER.SLICK DCSync DCSyncer DEEPROOT Explorer GHOSTLINE Global Guard Imperial Kitten LIGHTRAIL MINIBUS Malware MiniBrowse MiniJunk Minibike Nexus Nimbus Manticore OilRig OneDrive POLLBLEND Payload Payload Phishing campaigns PowerShell SIGHTGRAB Setup.exe Signal Smoke Sandstorm Spear-phishing TWOSTROKE UNC1549 phishing

Indicators of Compromise (40)

Domain
airbus.usa-careers.com airtravellog.com masterflexiblecloud.azurewebsites.net storagewiz.co.azurewebsites.net thecloudappbox.azurewebsites.net thetacticstore.com services-update-check.azurewebsites.net send-feedback.azurewebsites.net +16 more
Filename
MigAutoPlay.exe net.exe secur32.dll FileCoAuth.exe Mini-Junked.dll Micro.dll update.dll Survey.zip +6 more
MD5 Hash
4a223bc9c6096ac6bae3e7452ed6a1cd
IPv4 Address
111.0.0.2

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (3)
M1018 User Account Management M1030 Network Segmentation M1032 Multi-factor Authentication
Exploitation (5)
M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1049 Antivirus/Antimalware
Installation (5)
M1015 Active Directory Configuration M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies
Command & Control (5)
M1017 User Training M1018 User Account Management M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit
Actions on Objectives (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +7 more

Detection Coverage

12 strategies
5/7 stages covered

Delivery (1)

DET0488 Detect abuse of Trusted Relationships (t...

Exploitation (1)

DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (3)

DET0274 Boot or Logon Autostart Execution Detect... DET0487 Distributed Password Spraying via Authen... DET0594 Detection of Unauthorized DCSync Operati...

Command & Control (4)

DET0221 Behavioral Detection Strategy for T1123... DET0346 Detect Screen Capture via Commands and A... DET0444 Detection of Command and Control Over Ap... DET0500 Detecting Abnormal SharePoint Data Minin...

Actions on Objectives (3)

DET0201 Detection Strategy for Hijack Execution... DET0546 Detection of Abused or Compromised Cloud... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC1549

Type: Unknown Active
Nimbus Manticore defense other regions APT34 Earth Preta +36 more
Infrastructure 25 IOC(s)
50%
Domain
airbus.usa-careers.com airtravellog.com masterflexiblecloud.azurewebsites.net storagewiz.co.azurewebsites.net thecloudappbox.azurewebsites.net +19
IPv4 Address
111.0.0.2
Artifacts (15)
MigAutoPlay.exe net.exe secur32.dll FileCoAuth.exe Mini-Junked.dll Micro.dll +9
Capability
50%
13 technique(s) 40 tool(s)/malware 2 CVE(s)
Backdoors Beacon C2 infrastructure CRASHPAD Custom Backdoor Custom backdoors Custom malware Custom tools +32
T0812
collection
T1113 T1123 T1213.002
command and control
T1071
credential access
T1003.006 T1110.003
Victim
70%

Targeted Sectors

government defense aerospace telecommunications aviation financial-services non-profit critical-infrastructure education media healthcare think-tank energy utilities manufacturing pharmaceutical transportation maritime legal-services nuclear entertainment chemical hospitality

Targeted Countries

IR AE IL RU US CN UA IN TR BY PK VN PL KR ES LB TW KZ JP KP IQ DE IT SA FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1199

Capability (Malware)

Backdoors Beacon C2 infrastructure
4 Exploitation

Capability (Techniques)

T1059.001

Capability (Malware)

Backdoors Beacon C2 infrastructure
5 Installation

Capability (Techniques)

T1003.006 T1110.003 T1547

Capability (Malware)

Backdoors Beacon C2 infrastructure
6 Command & Control

Capability (Malware)

Backdoors Beacon C2 infrastructure
Leaving Threaticon

This link opens an external site that isn't part of the platform.