Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6692 (threat actor)

Risk

Critical

52 techniques 49 tools/malware 3 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.002

Spearphishing Link initial access

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.006

Python execution

T1059.007

JavaScript execution

T1059.010

AutoHotKey & AutoIT execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1559

Inter-Process Communication execution

T1569.002

Service Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2026-15409

CVE CVE-2026-15410

CVE CVE-2026-16232

›

5 Installation

T1003.001

LSASS Memory credential access

T1003.002

Security Account Manager credential access

T1621

Multi-Factor Authentication Request Generation credential access

T1046

Network Service Discovery discovery

T1083

File and Directory Discovery discovery

T1518.001

Security Software Discovery discovery

T1176.001

Browser Extensions persistence

T1543

Create or Modify System Process persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

T1547.009

Shortcut Modification persistence

›

6 Command & Control

T1005

Data from Local System collection

T1071.004

DNS command and control

T1104

Multi-Stage Channels command and control

T1571

Non-Standard Port command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.002

SMB/Windows Admin Shares lateral movement

T1534

Internal Spearphishing lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1027

Obfuscated Files or Information stealth

T1027.010

Command Obfuscation stealth

T1027.015

Compression stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055

Process Injection stealth

T1070.004

File Deletion stealth

T1134

Access Token Manipulation stealth

T1134.001

Token Impersonation/Theft stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1202

Indirect Command Execution stealth

T1564.001

Hidden Files and Directories stealth

T1622

Debugger Evasion stealth

T1015

T1054

T1156

T1223

T1255

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (49)

AppDomainManager AutoHotkey Script BITS CALENDAR Custom malware Dindoor Edgecution FTK Imager Global Group Policy Handala Hook Interception KongTuke KryBit Leverage LimeWire MSBuild Microsoft Teams Nexus NightshadeC2 PHOTO Payload Payload Phishing emails Phishing kits PowerShell PowerShell commands Process Hollowing Quick Assist RedCap Remote access tools Rogue SNOWBASIN SNOWBELT SNOWGLAZE STOP Scheduled Tasks Social engineering tactics Sysinternals PsExec Telegram UNC1549 VERMIN WhatsApp Windows Command Shell inter netsh phishing systemd

Indicators of Compromise (40)

Domain

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log environment.However d385m5skczp5q5.cloudfront.net d7xpwoah6gdv2.cloudfront.net d3434apz0x8t7d.cloudfront.net Fal.Con +16 more

Filename

background.js powershell.exe cmd.exe tar.exe msedge.exe CoreUIComponents.dll dream.js python-3.13.3-embed-amd64-with-pip.zip

MD5 Hash

3199ff1aca5f78f4284304bc58513fe0

SHA-256 Hash

e88c196a86c74ea0e53dfe77c93f577cb441ee590756cf7f3284522a2d6a6be5 232bca658c585627830623fcdce56647dc291666b25c901ee56212681198067a da1cf68c9dc1cebcebf8ec7d1cf99ac9c0291db7b21bf279b9cad24c7a49948c

URL

http://app5805.s3.us-east-1.amazonaws.com/js/patch3265343.a http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.a http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.ahk http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (5)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration

Exploitation (20)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +15 more

Installation (20)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity M1026 Privileged Account Management +15 more

Command & Control (12)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +7 more

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +5 more

Detection Coverage

46 strategies

5/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (13)

DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... +8 more

Installation (11)

DET0016 Security Software Discovery Across Platf... DET0044 Detecting Malicious Browser Extensions A... DET0085 Credential Dumping from SAM via Registry... DET0160 Detection Strategy for Multi-Factor Auth... DET0180 Detection Strategy for T1547.009 – Short... +6 more

Command & Control (7)

DET0054 Internal Spearphishing via Trusted Accou... DET0227 Detection Strategy for Non-Standard Port... DET0228 Detect Multi-Stage Command and Control C... DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... +2 more

Actions on Objectives (13)

DET0032 Detection Strategy for Hidden Files and... DET0140 Behavioral Detection of Malicious File D... DET0200 Indirect Command Execution – Windows uti... DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6692

Type: Unknown Active

tracked as coordinat a tunneler a backdoor JokerDPR

Infrastructure 28 IOC(s)

50%

Domain

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log environment.However d385m5skczp5q5.cloudfront.net +19

URL

Artifacts (12)

background.js powershell.exe cmd.exe tar.exe msedge.exe CoreUIComponents.dll +6

Capability

50%

52 technique(s) 49 tool(s)/malware 3 CVE(s)

AppDomainManager AutoHotkey Script BITS CALENDAR Custom malware Dindoor Edgecution FTK Imager +41

T1015 T1054 T1156 T1223 +2

collection

T1005

command and control

T1071.004 T1104 T1571

credential access

T1003.001 T1003.002 T1621

Victim

70%

Targeted Sectors

defense aerospace manufacturing government financial-services education energy healthcare hospitality telecommunications nuclear chemical maritime information-technology legal-services media transportation

Targeted Countries

UA CN RU US IL IR FR KP KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.002 T1566.004

Capability (Malware)

AppDomainManager AutoHotkey Script BITS

Infrastructure

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log

4 Exploitation

Capability (Techniques)

T1053 T1053.005 T1059 T1059.001 T1059.003

Capability (Malware)

AppDomainManager AutoHotkey Script BITS

Infrastructure

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log

5 Installation

Capability (Techniques)

T1003.001 T1003.002 T1621 T1046 T1083

Capability (Malware)

AppDomainManager AutoHotkey Script BITS

Infrastructure

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log

6 Command & Control

Capability (Techniques)

T1005 T1071.004 T1104 T1571 T1021.001

Capability (Malware)

AppDomainManager AutoHotkey Script BITS

Infrastructure

d2g6dl71gua1qa.cloudfront.net subprocess.Popen extension.log