Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0102 (threat actor)
Risk
91
Critical
46 techniques 45 tools/malware 6 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
16
T1059.003
Windows Command Shell execution
T1059.013
Container CLI/API execution
T1129
Shared Modules execution
T1204.001
Malicious Link execution
T1559
Inter-Process Communication execution
T1559.001
Component Object Model execution
T1559.002
Dynamic Data Exchange execution
T1559.003
XPC Services execution
T1610
Deploy Container execution
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2022-23521
CVE CVE-2022-27596
CVE CVE-2022-31704
CVE CVE-2022-31706
CVE CVE-2022-41903
CVE CVE-2022-41953
›
5 Installation
6
T1558.004
AS-REP Roasting credential access
T1087.002
Domain Account discovery
T1124
System Time Discovery discovery
T1135
Network Share Discovery discovery
T1518.002
Backup Software Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
10
T1123
Audio Capture collection
T1125
Video Capture collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1560.002
Archive via Library collection
T1560.003
Archive via Custom Method collection
T1132.001
Standard Encoding command and control
T1132.002
Non-Standard Encoding command and control
T1550
Use Alternate Authentication Material lateral movement
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
18
T1112
Modify Registry defense impairment
T1685
Disable or Modify Tools defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1490
Inhibit System Recovery impact
T1498
Network Denial of Service impact
T1078.001
Default Accounts stealth
T1078.002
Domain Accounts stealth
T1127
Trusted Developer Utilities Proxy Execution stealth
T1127.001
MSBuild stealth
T1127.002
ClickOnce stealth
T1127.003
JamPlus stealth
T1134
Access Token Manipulation stealth
T1134.001
Token Impersonation/Theft stealth
T1134.002
Create Process with Token stealth
T1134.003
Make and Impersonate Token stealth
T1134.004
Parent PID Spoofing stealth
T1134.005
SID-History Injection stealth
T1060
T1060
Stage risk: Critical High Medium None

Tools & Malware (45)

APT38 Akira Backdoors BlackByte Carbanak Cobalt Confucius Custom .NET web spoofing scripts Custom malware Dark Email filtering utilities Explorer GitHub Global Hive Indrik Spider Kimsuky LockBit MuddyWater NSIS Naikon Nexus PLAY Payload Payload Phishing campaigns Phishing emails Phishing templates PowerShell PowerShell (for payload delivery) Remcos Remcos RAT Remote Access Tools (generic RAT components) Remote access tools Rhadamanthys Rundll32 SideWinder Telegram Trojan Unknown ValleyRAT Void WhatsApp Winnti phishing

Indicators of Compromise (39)

Domain
Config2.ini TEMP.Veles TEMP.Jumper TEMP.Periscope TEMP.Hex Protect.ngo TEMP.hermit TEMP.Reaper +13 more
Email Address
rocke@live.cn
Filename
rundll32.exe intel.dll chrmstp.exe UserAccountBroker.exe 360Tray.exe Explorer.exe intell.dll cmd.exe +6 more
SHA-1 Hash
b02a99344f2fa81636ad913f805b52051debe529
IPv4 Address
143.92.38.217 206.238.221.165

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (16)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more
Installation (9)
M1021 Restrict Web-Based Content M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication +4 more
Command & Control (10)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +5 more
Actions on Objectives (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

45 strategies
5/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (10)

DET0018 Behavior-chain, platform-aware detection... DET0066 User Execution – Malicious Link (click →... DET0083 Container CLI and API Abuse via Docker/K... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... +5 more

Installation (6)

DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0129 Domain Account Enumeration Across Platfo... DET0151 Behavior-chain, platform-aware detection... DET0182 Behavior-chain detection for T1135 Netwo... +1 more

Command & Control (10)

DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... DET0268 Detect Archiving via Library (T1560.002) +5 more

Actions on Objectives (17)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0210 Abuse of Domain Accounts DET0280 Behavior-Based Registry Modification Det... +12 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0102

Type: Unknown Active
Patchwork Winter Vivern to target UAC-0102 created a Sandworm Team Operation Cleaver +13 more
Infrastructure 23 IOC(s)
50%
Domain
Config2.ini TEMP.Veles TEMP.Jumper TEMP.Periscope TEMP.Hex +16
IPv4 Address
143.92.38.217 206.238.221.165
Artifacts (16)
rocke@live.cn rundll32.exe intel.dll chrmstp.exe UserAccountBroker.exe 360Tray.exe +10
Capability
50%
46 technique(s) 45 tool(s)/malware 6 CVE(s)
APT38 Akira Backdoors BlackByte Carbanak Cobalt Confucius Custom .NET web spoofing scripts +37
T1060
collection
T1123 T1125 T1560 T1560.001 +2
command and control
T1132.001 T1132.002
credential access
T1558.004
Victim
70%

Targeted Sectors

government financial-services defense telecommunications healthcare education manufacturing media non-profit energy critical-infrastructure aviation pharmaceutical hospitality information-technology retail aerospace maritime transportation think-tank nuclear mining chemical gaming legal-services construction entertainment oil-gas utilities

Targeted Countries

US UA RU CN GB PL IR DE VN AU JP IL ES SA PK TW FR AE SG KR IN BY TR MX KP CA NL RO NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

APT38 Akira Backdoors
4 Exploitation

Capability (Malware)

APT38 Akira Backdoors
5 Installation

Capability (Malware)

APT38 Akira Backdoors
6 Command & Control

Capability (Malware)

APT38 Akira Backdoors
7 Actions on Objectives

Capability (Techniques)

T1041 T1490 T1498

Capability (Malware)

APT38 Akira Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.