Kaspersky Lyceum October 2021

Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.

Kevin can upload logs and other data from a compromised host.

Kevin can assign hard-coded fallback domains for C2.

Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.

HEXANE has used Ping and `tracert` for network discovery.

HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.

HEXANE has used `net view` to enumerate domain machines.

HEXANE has used Base64-encoded scripts.

Milan can encode files containing information about the targeted system.

Kevin has Base64-encoded its configuration file.

Kevin can exfiltrate data to the C2 server in 27-character chunks.

HEXANE has run `whoami` on compromised machines to identify the current user.

Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.

Kevin can send data from the victim host through a DNS C2 channel.

HEXANE has used netstat to monitor connections to specific ports.

HEXANE has used a scheduled task to establish persistence for a keylogger.

HEXANE has used a PowerShell-based keylogger named `kl.ps1`.

HEXANE has enumerated processes on targeted systems.

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.

Kevin can use a renamed image of `cmd.exe` for execution.

HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.

HEXANE has run `net localgroup` to enumerate local groups.

Kevin can delete files created on the victim's machine.

Variants of Kevin can communicate with C2 over HTTP.

Milan can use HTTPS for communication with C2.

Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.

Milan has the ability to use DNS for C2 communications.

Kevin can create directories to store logs and other collected data.

Kevin can enumerate the OS version and hostname of a targeted machine.

HEXANE has collected the hostname of a compromised machine.

Kevin can download files to the compromised host.

HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.

Milan can use the API `DnsQuery_A` for DNS resolution.

Kevin can use the `ShowWindow` API to avoid detection.

Kevin can Base32 encode chunks of output files during exfiltration.

Kevin can sleep for a time interval between C2 communication attempts.

HEXANE has enumerated programs installed on an infected machine.

HEXANE has used WMI event subscriptions for persistence.

Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.

HEXANE has run `cmdkey` on victim machines to identify stored credentials.

HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.

Kevin can hide the current window from the targeted user via the `ShowWindow` API function.

Milan can use a custom protocol tunneled through DNS or HTTP.

Kevin can use a custom protocol tunneled through DNS or HTTP.

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.