Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

hyadina (threat actor)

Risk

Medium

2 techniques 44 tools/malware 0 vulnerabilities 38 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

T1219

Remote Access Tools command and control

›

7 Actions on Objectives

T1036

Masquerading stealth

Stage risk: Critical High Medium None

Tools & Malware (44)

Anubis AnyDesk CHINACHOPPER Carbon Dark Exploit kits Formbook GROK GitHub Global Guard Hafnium Havex RAT Hunter INC Ransomware Leverage Malware Payloads Maze Mimikatz Netscan NirSoft tools Open-source tools PLAY PasswordFox Payload Payload Phishing emails PlugX PoisonX Kernel Driver PowerShell Predator PsExec Qilin Ramsay Ransomware payload Rogue STOP SniffPass Spear-phishing Triton Unknown VNCPassView WebBrowserPassView phishing

Indicators of Compromise (38)

Domain

1.Ferr 2.Wood 3.Chorus 4.Waters 5.Codd 6.Francis 7.Codd j.scitotenv +19 more

Email Address

nubero@um.es maboal@um.es

Filename

toxins-16-00190-s001.zip anydesk.exe symantec.exe g11.sys encrypter-windows-gui-x86.exe mimik.exe psexesvc.exe

SHA-256 Hash

2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d b29f91a440527fb621d106a2048f6379fff3263c60aeda9c82ff8c1d5ae880a8

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (5)

M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1038 Execution Prevention M1042 Disable or Remove Feature or Program

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

2 strategies

2/7 stages covered

Command & Control (1)

DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (1)

DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

hyadina

Type: Unknown Active

user mode tracked as

Infrastructure 27 IOC(s)

50%

Domain

1.Ferr 2.Wood 3.Chorus 4.Waters 5.Codd +22

Artifacts (11)

nubero@um.es maboal@um.es toxins-16-00190-s001.zip anydesk.exe symantec.exe g11.sys +5

Capability

50%

2 technique(s) 44 tool(s)/malware

Anubis AnyDesk CHINACHOPPER Carbon Dark Exploit kits Formbook GROK +36

command and control

T1219

stealth

T1036

Victim

70%

Targeted Sectors

defense healthcare financial-services manufacturing education government critical-infrastructure energy food-agriculture

Targeted Countries

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1219

Capability (Malware)

Anubis AnyDesk CHINACHOPPER

Infrastructure

1.Ferr 2.Wood 3.Chorus