Talos Frankenstein June 2019

During Frankenstein, the threat actors used Empire to gather various local system information.

Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.

During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.

Empire has the ability to automatically send collected data back to the threat actors' C2.

During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.

During Frankenstein, the threat actors ran encoded commands from the command line.

During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.

Empire can enumerate the username on targeted hosts.

During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.

During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.

Empire can send data gathered from a target through the command and control channel.

During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.

During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"

Empire can find information about processes running on local and remote systems.

During Frankenstein, the threat actors used Empire to obtain a list of all running processes.

During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.

During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line

During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.

During Frankenstein, the threat actors used HTTP GET requests for C2.

During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.

Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.

During Frankenstein, the threat actors downloaded files and tools onto a victim machine.

Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.

During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.

During Frankenstein, the threat actors used MSbuild to execute an actor-created file.

During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.

During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.

During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.

During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.

During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.

During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.

During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.

During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.

For Frankenstein, the threat actors obtained and used Empire.