Wingbird
Techniques Used |
||||
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1547 | .008 | Boot or Logon Autostart Execution: LSASS Driver |
Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017) |
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017) |
Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017) |
Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.(Citation: Microsoft SIR Vol 21) |
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Wingbird checks for the presence of Bitdefender security software.(Citation: Microsoft SIR Vol 21) |
Enterprise | T1569 | .002 | System Services: Service Execution |
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017) |
Groups That Use This Software |
||
ID | Name | References |
---|---|---|
G0055 | NEODYMIUM |
(Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21) |
References
- Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
- Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.
- Microsoft. (2017, November 9). Backdoor:Win32/Wingbird.A!dha. Retrieved November 27, 2017.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.