Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Ajax Security Team (threat actor)

Risk

High

14 techniques 64 tools/malware 1 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1204

User Execution execution

T1204.002

Malicious File execution

CVE CVE-2021-40444

›

5 Installation

T1555

Credentials from Password Stores credential access

T1555.003

Credentials from Web Browsers credential access

T1087

Account Discovery discovery

›

6 Command & Control

T1056

Input Capture collection

T1056.001

Keylogging collection

T1071

Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (64)

.NETWoolger APT38 Akira AppleJeus Backdoors BlackByte BlackCat COATHOOK CWoolger Carbanak Clop Cobalt Custom RATs Custom malware Custom tools Dark DarkSide Ferocious FireMalv GHOLE / Core Impact Gholee/Wrapper Global Guard HTRAN Hermit Hive Jackal Kimsuky Leash LockBit MPK MagicHound.Leash Medusa Meterpreter MuddyWater Naikon Nexus Open source tools PLAY Payload Payload Phishing campaigns Poseidon PowerShell PowerShell scripts Puppy RAT Pupy QUICKBALL QuickPulse REvil Ransomware variants Ryuk SOGU STOP Social engineering tactics Spear-phishing TWOCHAINS Trojan Wicked Winnti Zero-day exploits credential stealers such as WCE gsecdump phishing

Indicators of Compromise (40)

Domain

Assembly.GetType TEMP.Hermit TEMP.Veles TEMP.Beanie TEMP.Zagros MagicHound.Fetch MagicHound.Leash www1.chrome-up.date +17 more

Filename

powershell.exe 1748-1833.pdf rr.exe spp.exe entry.client-xi9AqQZ0.js

SHA-256 Hash

218fac3d0639c0d762fcf71685bcf6b64c33d1533df03b4cf223d9b07ca1e3c2 6c195ea18c05bbf091f09873ed9cd533ec7c8de7a831b85690e48290b579634b 7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f d08d737fa59edbea4568100cf83cff7bf930087aaa640f1b4edf48eea4e07b19 82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190

IPv4 Address

45.76.128.165 139.59.46.154 45.58.37.142

URL

http://:3485/eiloShaegae1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (10)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more

Installation (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint

Detection Coverage

14 strategies

5/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior...

Installation (3)

DET0037 Detect Suspicious Access to Browser Cred... DET0430 Detect Credentials Access from Password... DET0587 Enumeration of User or Account Informati...

Command & Control (4)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Ajax Security Team

Type: Unknown Active

Operation Woolen-Goldfish AjaxTM Rocket Kitten Flying Kitten Operation Saffron Rose +98 more

Infrastructure 29 IOC(s)

50%

Domain

Assembly.GetType TEMP.Hermit TEMP.Veles TEMP.Beanie TEMP.Zagros +20

IPv4 Address

45.76.128.165 139.59.46.154 45.58.37.142

URL

http://:3485/eiloShaegae1

Artifacts (11)

powershell.exe 1748-1833.pdf rr.exe spp.exe entry.client-xi9AqQZ0.js 218fac3d0639c0d762fcf71685bcf6b64c33d1533df03b4cf223d9b07ca1e3c2 +5

Capability

67%

14 technique(s) 64 tool(s)/malware 1 CVE(s)

.NETWoolger APT38 Akira AppleJeus Backdoors BlackByte BlackCat COATHOOK +56

collection

T1056 T1056.001

command and control

T1071 T1105

credential access

T1555 T1555.003

discovery

T1087

Victim

70%

Targeted Sectors

defense energy media education research critical infrastructure government financial-services telecommunications healthcare critical-infrastructure manufacturing non-profit pharmaceutical aviation hospitality aerospace think-tank retail gaming transportation information-technology legal-services mining chemical maritime utilities nuclear entertainment oil-gas construction aerospace & defense legal

Targeted Countries

IL IR SA US CN RU VN IN JP PK UA GB AU KR TW AE KP SG DE TR BY BR MX ES PL CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.003

Capability (Malware)

.NETWoolger APT38 Akira

Infrastructure

Assembly.GetType TEMP.Hermit TEMP.Veles

4 Exploitation

Capability (Techniques)

T1059.001 T1204 T1204.002

Capability (Malware)

.NETWoolger APT38 Akira

Infrastructure

Assembly.GetType TEMP.Hermit TEMP.Veles

5 Installation

Capability (Techniques)

T1555 T1555.003 T1087

Capability (Malware)

.NETWoolger APT38 Akira

Infrastructure

Assembly.GetType TEMP.Hermit TEMP.Veles

6 Command & Control

Capability (Techniques)

T1056 T1056.001 T1071 T1105

Capability (Malware)

.NETWoolger APT38 Akira

Infrastructure

Assembly.GetType TEMP.Hermit TEMP.Veles