Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

Mustang Panda utilized “Hdump” to dump credentials from memory.

Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.

Mustang Panda has queried Active Directory for computers using AdFind. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

TONESHELL has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility Service).

Mustang Panda has leveraged NBTscan to scan IP networks.

Mustang Panda has used FTP to exfiltrate archive files.

TONESHELL has created scheduled tasks to maintain persistence.

TONESHELL has capabilities to conduct keylogging.

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.

Mustang Panda has leveraged AdFind to enumerate domain groups.

Mustang Panda has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Mustang Panda has utilized AdFind to identify domain users.

TONESHELL has the ability to download additional files to the victim device.

TONESHELL has conducted screen capturing.

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.

TONESHELL has created a malicious service DISMsrv to maintain persistence.

TONESHELL has added Registry Run keys to achieve persistence.

TONESHELL has facilitated inter-process communication between DLL components via the use of pipes. TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.

TONESHELL used WinRAR rar.exe to archive files for exfiltration. TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR `rar.exe` to archive files for exfiltration.

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using `curl`.

TONESHELL has abused legitimate executables to side-load malicious DLLs. TONESHELL has also been loaded via DLL side-loading, using legitimate, signed executables to include: FastVD.exe, Bandizip.exe and gpgconf.exe.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.

Mustang Panda has used Wevtutil to gather Windows Security Event Logs.