Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT42 (threat actor)
Risk
73
High
32 techniques 2 tools/malware 0 vulnerabilities 45 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1682
Query Public AI Services reconnaissance
›
2 Weaponization
5
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1585.002
Email Accounts resource development
T1588.002
Tool resource development
T1608.001
Upload Malware resource development
›
3 Delivery
1
T1566.002
Spearphishing Link initial access
›
4 Exploitation
4
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.005
Visual Basic execution
›
5 Installation
8
T1111
Multi-Factor Authentication Interception credential access
T1539
Steal Web Session Cookie credential access
T1555.003
Credentials from Web Browsers credential access
T1016
System Network Configuration Discovery discovery
T1082
System Information Discovery discovery
T1087.001
Local Account discovery
T1518.001
Security Software Discovery discovery
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
8
T1056
Input Capture collection
T1056.001
Keylogging collection
T1113
Screen Capture collection
T1530
Data from Cloud Storage collection
T1071.001
Web Protocols command and control
T1102
Web Service command and control
T1132.001
Standard Encoding command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
5
T1112
Modify Registry defense impairment
T1036.005
Match Legitimate Resource Name or Location stealth
T1070
Indicator Removal stealth
T1070.008
Clear Mailbox Data stealth
T1684.001
Impersonation stealth
Stage risk: Critical High Medium None

Tools & Malware (2)

NICECURL TAMECAT

Indicators of Compromise (45)

Domain
brookings.email sharedrive.webredirect.org understandingthewar.org panel-short-check.live check-pabnel-status.live meetroomonlin1925.w3spaces.com smaaaal.cfd click-choose-figured.cfd +5 more
MD5 Hash
6c033c2cbeff71f7d17be4628c7e59f5
SHA-1 Hash
ca06b5b530c5c9fc09b12b1c8c48f8aeca4c3452
SHA-256 Hash
33a61ff123713da26f45b399a9828e29ad25fbda7e8994c954d714375ef92156 c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32 bc2597ce09987022ff0498c6710a9b51a1a47ed8082ac044be2838b384157527 baac058ddfc96c8aea8c0057077505f0ad3ff20311d999886fed549924404849 0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60 f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060 82ae2eb470a5a16ca39ec84b387294eaa3ae82e5ada4b252470c1281e1f31c0a 89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c +2 more
IPv4 Address
49.13.194.118 91.107.150.184
URL
https://sharedrive.webredirect.org/Khn/shoaGzA/cGNt/dMPaV/kvvhK https://firebasestorage.googleapis.com/v0/b/share-box-5f395.appspot.com/o/onedrive-qrty45.html https://visioneditor.loseyourip.com https://s3api.shop/api/ https://panel-short-check.live/PhyfkFQX https://check-pabnel-status.live/Gcollection/Ref/CkliPwaM https://n9.cl/4xgro https://smaaaal.cfd/Wp59tqKU +10 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration
Exploitation (10)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +5 more
Installation (9)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1028 Operating System Configuration +4 more
Command & Control (9)
M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention +4 more
Actions on Objectives (9)
M1017 User Training M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1029 Remote Data Storage +4 more

Detection Coverage

32 strategies
7/7 stages covered

Reconnaissance (1)

DET0919 Detection of Query Public AI Services

Weaponization (5)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0852 Detection of Tool DET0892 Detection of Domains

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (4)

DET0076 Behavioral Detection of Visual Basic Exe... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (8)

DET0016 Security Software Discovery Across Platf... DET0037 Detect Suspicious Access to Browser Cred... DET0195 Behavioral Detection of System Network C... DET0246 Detection Strategy for MFA Interception... DET0274 Boot or Logon Autostart Execution Detect... +3 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0124 Behavior-chain detection for T1132.001 D... DET0346 Detect Screen Capture via Commands and A... +3 more

Actions on Objectives (5)

DET0184 Behavioral Detection of Indicator Remova... DET0266 Behavioral Detection of Mailbox Data and... DET0280 Behavior-Based Registry Modification Det... DET0286 Detection Strategy for Impersonation DET0347 Detection Strategy for Masquerading via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

APT42

Type: Unknown Active
UNC788 CALANQUE CALANQUE ION
Infrastructure 33 IOC(s)
50%
Domain
brookings.email sharedrive.webredirect.org understandingthewar.org panel-short-check.live check-pabnel-status.live +8
IPv4 Address
49.13.194.118 91.107.150.184
URL
https://sharedrive.webredirect.org/Khn/shoaGzA/cGNt/dMPaV/kvvhK https://firebasestorage.googleapis.com/v0/b/share-box-5f395.appspot.com/o/onedrive-qrty45.html https://visioneditor.loseyourip.com https://s3api.shop/api/ https://panel-short-check.live/PhyfkFQX +13
Artifacts (12)
6c033c2cbeff71f7d17be4628c7e59f5 ca06b5b530c5c9fc09b12b1c8c48f8aeca4c3452 33a61ff123713da26f45b399a9828e29ad25fbda7e8994c954d714375ef92156 c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32 bc2597ce09987022ff0498c6710a9b51a1a47ed8082ac044be2838b384157527 baac058ddfc96c8aea8c0057077505f0ad3ff20311d999886fed549924404849 +6
Capability
90%
32 technique(s) 2 tool(s)/malware
NICECURL TAMECAT
collection
T1056 T1056.001 T1113 T1530
command and control
T1071.001 T1102 T1132.001 T1573.002
credential access
T1111 T1539 T1555.003
defense impairment
T1112
Victim
70%

Targeted Sectors

education government defense energy financial-services healthcare pharmaceutical legal-services manufacturing media non-profit

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1682

Capability (Malware)

NICECURL TAMECAT
2 Weaponization

Capability (Malware)

NICECURL TAMECAT
3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

NICECURL TAMECAT
4 Exploitation

Capability (Malware)

NICECURL TAMECAT
5 Installation

Capability (Malware)

NICECURL TAMECAT
6 Command & Control

Capability (Malware)

NICECURL TAMECAT
Leaving Threaticon

This link opens an external site that isn't part of the platform.