Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TheWizards (threat actor)
Risk
84
Critical
40 techniques 48 tools/malware 1 vulnerabilities 37 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
5
T1583.001
Domains resource development
T1583.004
Server resource development
T1585
Establish Accounts resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
›
3 Delivery
1
T1659
Content Injection initial access
›
4 Exploitation
5
T1059
Command and Scripting Interpreter execution
T1059.003
Windows Command Shell execution
T1106
Native API execution
T1611
Escape to Host privilege escalation
CVE CVE-2020-1472
›
5 Installation
10
T1555
Credentials from Password Stores credential access
T1557
Adversary-in-the-Middle credential access
T1082
System Information Discovery discovery
T1087
Account Discovery discovery
T1124
System Time Discovery discovery
T1518.001
Security Software Discovery discovery
T1133
External Remote Services persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
8
T1005
Data from Local System collection
T1074
Data Staged collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1095
Non-Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1573.001
Symmetric Cryptography command and control
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
12
T1112
Modify Registry defense impairment
T1685
Disable or Modify Tools defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1027.007
Dynamic API Resolution stealth
T1027.009
Embedded Payloads stealth
T1027.014
Polymorphic Code stealth
T1055
Process Injection stealth
T1055.004
Asynchronous Procedure Call stealth
T1197
BITS Jobs stealth
T1480.002
Mutual Exclusion stealth
Stage risk: Critical High Medium None

Tools & Malware (48)

APT38 Akira AppleJeus Backdoors BlackByte Carbanak Cobalt Cobalt Strike Confucius Conti Custom backdoors Custom malware Custom tools Dark DarkNimbus EternalBlue exploitation module Ghost RAT Global Group Policy Guard Hafnium Kimsuky Legitimate Software Mimikatz MuddyWater Naikon Nexus OilRig PLAY Payload Payload PowerShell Remote access tools Ryuk STOP ShadowPad Spellbinder TrickBot Turla Unknown Void WinPcap Windows Command Shell Winnti WizardNet Zerologon exploitation module cmd.exe phishing

Indicators of Compromise (37)

Domain
TEMP.Veles classes.dex TEMP.MixMaster log.dat hao.com plugin-audiofirstpiece.ml Agent.CAZ Spy.Agent.EEF +6 more
Email Address
threatintel@eset.com
Filename
wsc.dll AVGApplicationFrameHost.exe ipv6.exe AVGApplicationFrameHostS.zip winpcap.exe minibrowser11.zip QBDeltaUpdate.exe QQ.exe +4 more
MD5 Hash
a961766c1b2e5133d589be1cf47e3338 da73153c76b6f652f9b2847531d1c367
SHA-1 Hash
0CBA19B19DF9E2C5EBE55D9DE377D26A1A51B70A 9784A1483B4586EB12D86E549D39CA4BB63871B8 76953E949AC54BE8FF3A68794EF1419E9EF9AFCB 1A8147050AF6F05DEA5FBCA1AE1FF2FFD2B68F9C DA867188937698C7769861C72F5490CB9C3D4F63 4DB38A097AE4D5E70B2F51A8EE13B0C1EE01A2A1
IPv4 Address
43.155.62.54 43.155.116.7

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (2)
M1021 Restrict Web-Based Content M1041 Encrypt Sensitive Information
Exploitation (11)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +6 more
Installation (20)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +15 more
Command & Control (12)
M1016 Vulnerability Scanning M1019 Threat Intelligence Program M1026 Privileged Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention +7 more
Actions on Objectives (17)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +12 more

Detection Coverage

40 strategies
6/7 stages covered

Weaponization (5)

DET0852 Detection of Tool DET0871 Detection of Server DET0872 Detection of Malware DET0873 Detection of Establish Accounts DET0892 Detection of Domains

Delivery (1)

DET0349 Detection Strategy for Content Injection

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0219 Detection Strategy for Escape to Host DET0516 Behavioral Detection of Command and Scri... DET0529 Behavioral Detection of Native API Invoc...

Installation (10)

DET0016 Security Software Discovery Across Platf... DET0151 Behavior-chain, platform-aware detection... DET0274 Boot or Logon Autostart Execution Detect... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0354 Behavior-chain detection for T1133 Exter... +5 more

Command & Control (8)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0143 Detection Strategy for Encrypted Channel... DET0380 Detection of Local Data Collection Prior... +3 more

Actions on Objectives (12)

DET0091 Detection Strategy for Dynamic API Resol... DET0098 Detect abuse of Windows BITS Jobs for do... DET0100 Behavioral Detection of Asynchronous Pro... DET0131 Behavioral Detection Strategy for Exfilt... DET0132 Detection of Mutex-Based Execution Guard... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

TheWizards

Type: Unknown Active
UPSEC APT28 APT34 Earth Preta Stately Taurus +78 more
Infrastructure 16 IOC(s)
50%
Domain
TEMP.Veles classes.dex TEMP.MixMaster log.dat hao.com +9
IPv4 Address
43.155.62.54 43.155.116.7
Artifacts (21)
threatintel@eset.com wsc.dll AVGApplicationFrameHost.exe ipv6.exe AVGApplicationFrameHostS.zip winpcap.exe +15
Capability
50%
40 technique(s) 48 tool(s)/malware 1 CVE(s)
APT38 Akira AppleJeus Backdoors BlackByte Carbanak Cobalt Cobalt Strike +40
collection
T1005 T1074 T1560
command and control
T1071 T1095 T1105 T1573.001
credential access
T1555 T1557
defense impairment
T1112 T1685
Victim
70%

Targeted Sectors

government defense financial-services telecommunications education healthcare non-profit manufacturing energy media critical-infrastructure think-tank aerospace pharmaceutical aviation hospitality transportation retail chemical maritime legal-services information-technology mining gaming nuclear entertainment utilities oil-gas construction

Targeted Countries

CN US RU UA AE IL VN PK IR BY JP IN TW GB KR SA PL AU TR DE LB KZ SG IT FR MX ES CA IQ RO NG KP AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 Akira AppleJeus
3 Delivery

Capability (Techniques)

T1659

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Malware)

APT38 Akira AppleJeus
7 Actions on Objectives

Capability (Techniques)

T1041 T1048 T1567

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.