Trend Micro Iron Tiger April 2021

SysUpdate has been packed with VMProtect.

Threat Group-3390 has packed malware and tools, including using VMProtect.

HyperBro has the ability to pack its payload.

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

SysUpdate can encrypt and encode its configuration file.

Pandora has the ability to compress stings with QuickLZ.

SysUpdate can use WMI for execution on a compromised host.

Pandora can start and inject code into a new `svchost` process.

Pandora can monitor processes on a compromised host.

Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.

SysUpdate can delete its configuration file from the targeted system.

Pandora can communicate over HTTP.

SysUpdate can collect a system's architecture, operating system version, and hostname.

SysUpdate can search files on a compromised host.

Pandora can load additional drivers and files onto a victim machine.

SysUpdate has the ability to download files to a compromised host.

Pandora can write an encrypted token to the Registry to enable processing of remote commands.

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.

SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

SysUpdate has the ability to capture screenshots.

SysUpdate can deobfuscate packed binaries in memory.

HyperBro can unpack and decrypt its payload prior to execution.

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.

SysUpdate can create a service to establish persistence.

Pandora has the ability to gain system privileges through Windows services.

SysUpdate can use a Registry Run key to establish persistence.

Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.

SysUpdate has the ability to set file attributes to hidden.

SysUpdate can manage services and processes.

Pandora has the ability to install itself as a Windows service.

Pandora has the ability to encrypt communications with D3DES.

Pandora can use DLL side-loading to execute malicious payloads.

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.

SysUpdate can load DLLs through vulnerable legitimate executables.

SysUpdate can collect a system's drive information.