Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа LazyScripter
Риски
Каталоги
MITRE ATT&CK
Преступная группа
LazyScripter
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

LazyScripter

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)
ID: G0140
Associated Groups: 
Version: 1.1
Created: 24 Nov 2021
Last Modified: 17 Nov 2024

Associated Group Descriptions
Name Description

Techniques Used
Domain ID Name Use
Enterprise T1583 .001 Acquire Infrastructure: Domains

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.(Citation: MalwareBytes LazyScripter Feb 2021)
.006 Acquire Infrastructure: Web Services

LazyScripter has established GitHub accounts to host its toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)

Enterprise T1071 .004 Application Layer Protocol: DNS

LazyScripter has leveraged dynamic DNS providers for C2 communications.(Citation: MalwareBytes LazyScripter Feb 2021)

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.(Citation: MalwareBytes LazyScripter Feb 2021)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

LazyScripter has used PowerShell scripts to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)
.003 Command and Scripting Interpreter: Windows Command Shell

LazyScripter has used batch files to deploy open-source and multi-stage RATs.(Citation: MalwareBytes LazyScripter Feb 2021)

.005 Command and Scripting Interpreter: Visual Basic

LazyScripter has used VBScript to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)

.007 Command and Scripting Interpreter: JavaScript

LazyScripter has used JavaScript in its attacks.(Citation: MalwareBytes LazyScripter Feb 2021)

Enterprise T1027 .010 Obfuscated Files or Information: Command Obfuscation

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.(Citation: MalwareBytes LazyScripter Feb 2021)
Enterprise T1588 .001 Obtain Capabilities: Malware

LazyScripter has used a variety of open-source remote access Trojans for its operations.(Citation: MalwareBytes LazyScripter Feb 2021)
Enterprise T1566 .001 Phishing: Spearphishing Attachment

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.(Citation: MalwareBytes LazyScripter Feb 2021)
.002 Phishing: Spearphishing Link

LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.(Citation: MalwareBytes LazyScripter Feb 2021)

Enterprise T1608 .001 Stage Capabilities: Upload Malware

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.(Citation: MalwareBytes LazyScripter Feb 2021)
Enterprise T1218 .005 System Binary Proxy Execution: Mshta

LazyScripter has used `mshta.exe` to execute Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021)

.011 System Binary Proxy Execution: Rundll32

LazyScripter has used `rundll32.exe` to execute Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021)

Enterprise T1204 .001 User Execution: Malicious Link

LazyScripter has relied upon users clicking on links to malicious files.(Citation: MalwareBytes LazyScripter Feb 2021)
.002 User Execution: Malicious File

LazyScripter has lured users to open malicious email attachments.(Citation: MalwareBytes LazyScripter Feb 2021)

Software
ID Name References Techniques
S0508 ngrok (Citation: Cyware Ngrok May 2019) (Citation: FireEye Maze May 2020) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Zdnet Ngrok September 2018) Domain Generation Algorithms, Exfiltration Over Web Service, Protocol Tunneling, Proxy, Web Service
S0363 Empire (Citation: EmPyre) (Citation: GitHub ATTACK Empire) (Citation: Github PowerShell Empire) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: NCSC Joint Report Public Tools) (Citation: PowerShell Empire) Scheduled Task, Windows Management Instrumentation, Screen Capture, System Owner/User Discovery, Keylogging, Path Interception by PATH Environment Variable, Bypass User Account Control, Group Policy Discovery, Local Email Collection, Domain Account, Local Account, Windows Service, SSH, DLL, Automated Collection, Clipboard Data, Network Sniffing, Network Share Discovery, System Information Discovery, Native API, Process Injection, Timestomp, Shortcut Modification, Security Support Provider, Archive Collected Data, Credentials from Web Browsers, Path Interception by Search Order Hijacking, Group Policy Modification, Browser Information Discovery, Private Keys, Local Account, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Create Process with Token, Distributed Component Object Model, Video Capture, System Network Configuration Discovery, Accessibility Features, Command and Scripting Interpreter, Domain Account, Domain Trust Discovery, Golden Ticket, Automated Exfiltration, File and Directory Discovery, System Network Connections Discovery, Credentials In Files, Exfiltration to Code Repository, Process Discovery, Exfiltration Over C2 Channel, PowerShell, Exploitation of Remote Services, Registry Run Keys / Startup Folder, Exploitation for Privilege Escalation, SID-History Injection, Bidirectional Communication, Asymmetric Cryptography, Exfiltration to Cloud Storage, Path Interception by Unquoted Path, MSBuild, Security Software Discovery, Windows Command Shell, Silver Ticket, Command Obfuscation, Access Token Manipulation, Web Protocols, Network Service Discovery, Pass the Hash, Ingress Tool Transfer, Service Execution, Kerberoasting, Credential API Hooking, Commonly Used Port, Dylib Hijacking
S0332 Remcos (Citation: Fortinet Remcos Feb 2017) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Riskiq Remcos Jan 2018) (Citation: Talos Remcos Aug 2018) Screen Capture, Keylogging, Audio Capture, Bypass User Account Control, System Checks, Clipboard Data, Process Injection, Modify Registry, Video Capture, Proxy, File and Directory Discovery, Registry Run Keys / Startup Folder, Obfuscated Files or Information, Python, Windows Command Shell, Ingress Tool Transfer
S9000 Ngrok (Citation: MalwareBytes LazyScripter Feb 2021) Domain Generation Algorithms, Exfiltration Over Web Service, Protocol Tunneling, Proxy, Web Service
S0250 Koadic (Citation: Github Koadic) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Palo Alto Sofacy 06-2018) Scheduled Task, Windows Management Instrumentation, System Owner/User Discovery, Rundll32, Bypass User Account Control, Security Account Manager, Clipboard Data, Network Share Discovery, System Information Discovery, Data from Local System, System Network Configuration Discovery, File and Directory Discovery, Mshta, PowerShell, Registry Run Keys / Startup Folder, Regsvr32, Asymmetric Cryptography, Hidden Window, Windows Command Shell, Web Protocols, Visual Basic, Network Service Discovery, Ingress Tool Transfer, Remote Desktop Protocol, NTDS, Service Execution, Dynamic-link Library Injection
S0385 njRAT (Citation: Bladabindi) (Citation: Fidelis njRAT June 2013) (Citation: FireEye Njw0rm Aug 2013) (Citation: LV) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Njw0rm) (Citation: Trend Micro njRAT 2018) Screen Capture, System Owner/User Discovery, Standard Encoding, Keylogging, Encrypted/Encoded File, Fast Flux DNS, Peripheral Device Discovery, System Information Discovery, Native API, Replication Through Removable Media, Data from Local System, Application Window Discovery, Disable or Modify System Firewall, Modify Registry, Credentials from Web Browsers, Video Capture, Indicator Removal, File and Directory Discovery, Process Discovery, Exfiltration Over C2 Channel, PowerShell, Registry Run Keys / Startup Folder, Non-Standard Port, Query Registry, Compile After Delivery, Uncommonly Used Port, Windows Command Shell, Clear Persistence, File Deletion, Web Protocols, Remote System Discovery, Ingress Tool Transfer, Remote Desktop Protocol, Custom Command and Control Protocol
S0262 QuasarRAT (Citation: GitHub QuasarRAT) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Securelist APT10 March 2021) (Citation: TrendMicro Patchwork Dec 2017) (Citation: Volexity Patchwork June 2018) (Citation: xRAT) Scheduled Task, System Owner/User Discovery, Keylogging, Bypass User Account Control, Symmetric Cryptography, Code Signing, System Information Discovery, Data from Local System, Credentials from Password Stores, Modify Registry, Credentials from Web Browsers, Video Capture, System Network Configuration Discovery, Proxy, Credentials In Files, Registry Run Keys / Startup Folder, Non-Standard Port, Non-Application Layer Protocol, System Location Discovery, Hidden Window, Windows Command Shell, Ingress Tool Transfer, Remote Desktop Protocol, Hidden Files and Directories
S0669 KOCTOPUS (Citation: MalwareBytes LazyScripter Feb 2021) Bypass User Account Control, Match Legitimate Resource Name or Location, Malicious File, Spearphishing Link, Spearphishing Attachment, System Information Discovery, Native API, Deobfuscate/Decode Files or Information, Modify Registry, Proxy, PowerShell, Registry Run Keys / Startup Folder, Disable or Modify Tools, Hidden Window, Windows Command Shell, Clear Persistence, Command Obfuscation, Visual Basic, Ingress Tool Transfer, Malicious Link

References

  1. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.