Threat Group-3390

Data from Local System

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)

Keylogging

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.(Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)(Citation: Securelist LuckyMouse June 2018)

Local Data Staging

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.(Citation: SecureWorks BRONZE UNION June 2017)

Remote Data Staging

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)

Automated Collection

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)

Archive via Library

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)

Web Protocols

Threat Group-3390 malware has used HTTP for C2.(Citation: Securelist LuckyMouse June 2018)

Ingress Tool Transfer

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .(Citation: Dell TG-3390)(Citation: Trend Micro DRBControl February 2020)

LSASS Memory

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)

Security Account Manager

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)

LSA Secrets

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)

Password Managers

Threat Group-3390 obtained a KeePass database from a compromised host.(Citation: Trend Micro DRBControl February 2020)

Modify Registry

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Trend Micro Iron Tiger April 2021)

Disable or Modify Windows Event Log

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.(Citation: SecureWorks BRONZE UNION June 2017)

Query Registry

A Threat Group-3390 tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)

System Network Configuration Discovery

Threat Group-3390 actors use NBTscan to discover vulnerable systems.(Citation: Dell TG-3390)

Remote System Discovery

Threat Group-3390 has used the <code>net view</code> command.(Citation: Nccgroup Emissary Panda May 2018)

System Owner/User Discovery

Threat Group-3390 has used `whoami` to collect system user information.(Citation: Trend Micro DRBControl February 2020)

Network Service Discovery

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.(Citation: Dell TG-3390)(Citation: Unit42 Emissary Panda May 2019)

System Network Connections Discovery

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.(Citation: SecureWorks BRONZE UNION June 2017)

Local Account

Threat Group-3390 has used <code>net user</code> to conduct internal discovery of systems.(Citation: SecureWorks BRONZE UNION June 2017)

Windows Management Instrumentation

A Threat Group-3390 tool can use WMI to execute a binary.(Citation: Nccgroup Emissary Panda May 2018)

At

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.(Citation: Dell TG-3390)

PowerShell

Threat Group-3390 has used PowerShell for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)

Windows Command Shell

Threat Group-3390 has used command-line interfaces for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Unit42 Emissary Panda May 2019)

Exploitation for Client Execution

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.(Citation: Trend Micro Iron Tiger April 2021)

Malicious File

Threat Group-3390 has lured victims into opening malicious files containing malware.(Citation: Trend Micro DRBControl February 2020)

Data Transfer Size Limits

Threat Group-3390 actors have split RAR files for exfiltration into parts.(Citation: Dell TG-3390)

Exfiltration to Cloud Storage

Threat Group-3390 has exfiltrated stolen data to Dropbox.(Citation: Trend Micro DRBControl February 2020)

Drive-by Compromise

Threat Group-3390 has extensively used strategic web compromises to target victims.(Citation: Dell TG-3390)(Citation: Securelist LuckyMouse June 2018)

Exploit Public-Facing Application

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.(Citation: Trend Micro Iron Tiger April 2021)

Compromise Software Supply Chain

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.(Citation: Trend Micro Iron Tiger April 2021)

Trusted Relationship

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.(Citation: Profero APT27 December 2020)

Spearphishing Attachment

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.(Citation: Trend Micro DRBControl February 2020)

Windows Remote Management

Threat Group-3390 has used WinRM to enable remote execution.(Citation: SecureWorks BRONZE UNION June 2017)

Exploitation of Remote Services

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.(Citation: Unit42 Emissary Panda May 2019)

External Remote Services

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.(Citation: Dell TG-3390) Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.(Citation: SecureWorks BRONZE UNION June 2017)

Web Shell

Threat Group-3390 has used a variety of Web shells.(Citation: Unit42 Emissary Panda May 2019)

Windows Service

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)

Registry Run Keys / Startup Folder

Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)

Exploitation for Privilege Escalation

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Profero APT27 December 2020)

Bypass User Account Control

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.(Citation: Nccgroup Emissary Panda May 2018)

Domains

Threat Group-3390 has registered domains for C2.(Citation: Lunghi Iron Tiger Linux)

Tool

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.(Citation: Unit42 Emissary Panda May 2019)(Citation: Dell TG-3390)

Code Signing Certificates

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.(Citation: Lunghi Iron Tiger Linux)

Upload Malware

Threat Group-3390 has hosted malicious payloads on Dropbox.(Citation: Trend Micro DRBControl February 2020)

Upload Tool

Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.(Citation: Dell TG-3390)

Drive-by Target

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.(Citation: Gallagher 2015)

Software Packing

Threat Group-3390 has packed malware and tools, including using VMProtect.(Citation: Trend Micro DRBControl February 2020)(Citation: Trend Micro Iron Tiger April 2021)

Encrypted/Encoded File

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)

Compression

Threat Group-3390 malware is compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)

Process Hollowing

A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)

File Deletion

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)

Network Share Connection Removal

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.(Citation: SecureWorks BRONZE UNION June 2017)

Valid Accounts

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.(Citation: Dell TG-3390)

Deobfuscate/Decode Files or Information

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Securelist LuckyMouse June 2018)

DLL

Threat Group-3390 has performed DLL search order hijacking to execute their payload.(Citation: Nccgroup Emissary Panda May 2018) Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)(Citation: Lunghi Iron Tiger Linux)

T1574.001 -DLL Side-loading:Load Commonly Used Tools