FireEye APT32 May 2017

SOUNDBITE is capable of enumerating application windows.

WINDSHIELD can gather Registry values.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

WINDSHIELD can gather the victim user name.

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

KOMPROGO is capable of running WMI queries.

APT32 has used scheduled tasks to persist on victim systems.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

KOMPROGO is capable of creating a reverse shell.

PHOREAL is capable of creating reverse shell.

APT32 has used CVE-2016-7255 to escalate privileges.

WINDSHIELD is capable of file deletion along with other file system interaction.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

SOUNDBITE communicates via DNS for C2.

APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.

APT32 has used legitimate local admin account credentials.

WINDSHIELD can gather the victim computer name.

KOMPROGO is capable of retrieving information about the infected system.

SOUNDBITE is capable of gathering system information.

SOUNDBITE is capable of enumerating and manipulating files and directories.

WINDSHIELD C2 traffic can communicate via TCP raw sockets.

PHOREAL communicates via ICMP for C2.

PHOREAL is capable of manipulating the Registry.

SOUNDBITE is capable of modifying the Registry.

APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.

APT32 has used the WindowStyle parameter to conceal PowerShell windows.

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

APT32 has cleared select event log entries.