TYPEFRAME
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
TYPEFRAME can uninstall malware components using a batch script.(Citation: US-CERT TYPEFRAME June 2018) TYPEFRAME can execute commands using a shell.(Citation: US-CERT TYPEFRAME June 2018) |
| .005 | Command and Scripting Interpreter: Visual Basic |
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.(Citation: US-CERT TYPEFRAME June 2018) |
||
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018) |
| Enterprise | T1562 | .004 | Impair Defenses: Disable or Modify System Firewall |
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.(Citation: US-CERT TYPEFRAME June 2018) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
TYPEFRAME can delete files off the system.(Citation: US-CERT TYPEFRAME June 2018) |
| Enterprise | T1027 | .011 | Obfuscated Files or Information: Fileless Storage |
TYPEFRAME can install and store encrypted configuration data under the Registry key |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.(Citation: US-CERT TYPEFRAME June 2018) |
||
| Enterprise | T1204 | .002 | User Execution: Malicious File |
A Word document delivering TYPEFRAME prompts the user to enable macro execution.(Citation: US-CERT TYPEFRAME June 2018) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0032 | Lazarus Group |
(Citation: US-CERT TYPEFRAME June 2018) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.