Pandora
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Pandora can communicate over HTTP.(Citation: Trend Micro Iron Tiger April 2021) |
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Pandora has the ability to gain system privileges through Windows services.(Citation: Trend Micro Iron Tiger April 2021) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
Pandora has the ability to encrypt communications with D3DES.(Citation: Trend Micro Iron Tiger April 2021) |
| Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
Pandora can use DLL side-loading to execute malicious payloads.(Citation: Trend Micro Iron Tiger April 2021) |
| Enterprise | T1553 | .006 | Subvert Trust Controls: Code Signing Policy Modification |
Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.(Citation: Trend Micro Iron Tiger April 2021) |
| Enterprise | T1569 | .002 | System Services: Service Execution |
Pandora has the ability to install itself as a Windows service.(Citation: Trend Micro Iron Tiger April 2021) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G1021 | Cinnamon Tempest |
(Citation: Sygnia Emperor Dragonfly October 2022) (Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022) (Citation: Microsoft Ransomware as a Service) (Citation: Dell SecureWorks BRONZE STARLIGHT Profile) |
| G0027 | Threat Group-3390 |
(Citation: Trend Micro Iron Tiger April 2021) |
References
- Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
- Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.
- Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.
- Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.
- SecureWorks. (n.d.). BRONZE STARLIGHT. Retrieved December 6, 2023.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.