Winnti Group

Associated Group Descriptions

Name	Description
Blackfly	[5]

Techniques Used

Domain	ID		Name	Use
Enterprise	T1583	.001	Acquire Infrastructure: Domains	Winnti Group has registered domains for C2 that mimicked sites of their intended targets.[1]
Enterprise	T1083		File and Directory Discovery	Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.[1]
Enterprise	T1105		Ingress Tool Transfer	Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.[1]
Enterprise	T1057		Process Discovery	Winnti Group looked for a specific process running on infected servers.[1]
Enterprise	T1014		Rootkit	Winnti Group used a rootkit to modify typical server functionality.[1]
Enterprise	T1553	.002	Subvert Trust Controls: Code Signing	Winnti Group used stolen certificates to sign its malware.[1]

Software

ID	Name	References	Techniques
S0501	PipeMon	[6]	Abuse Elevation Control Mechanism: Bypass User Account Control, Access Token Manipulation: Create Process with Token, Access Token Manipulation: Parent PID Spoofing, Boot or Logon Autostart Execution: Print Processors, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Fallback Channels, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Modify Registry, Native API, Non-Application Layer Protocol, Obfuscated Files or Information, Obfuscated Files or Information: Fileless Storage, Process Discovery, Process Injection: Dynamic-link Library Injection, Shared Modules, Software Discovery: Security Software Discovery, Subvert Trust Controls: Code Signing, System Information Discovery, System Network Configuration Discovery, System Time Discovery
S0013	PlugX	[1]	Application Layer Protocol: DNS, Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, File and Directory Discovery, Hide Artifacts: Hidden Files and Directories, Hijack Execution Flow: DLL Side-Loading, Hijack Execution Flow: DLL Search Order Hijacking, Ingress Tool Transfer, Input Capture: Keylogging, Masquerading: Masquerade Task or Service, Masquerading: Match Legitimate Name or Location, Modify Registry, Native API, Network Share Discovery, Non-Application Layer Protocol, Obfuscated Files or Information, Process Discovery, Query Registry, Screen Capture, System Network Connections Discovery, Trusted Developer Utilities Proxy Execution: MSBuild, Virtualization/Sandbox Evasion: System Checks, Web Service: Dead Drop Resolver
S0141	Winnti for Windows	[1][2]	Abuse Elevation Control Mechanism: Bypass User Account Control, Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Execution Guardrails: Environmental Keying, File and Directory Discovery, Indicator Removal: Timestomp, Indicator Removal: File Deletion, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Native API, Non-Application Layer Protocol, Obfuscated Files or Information, Process Discovery, Proxy: Internal Proxy, Proxy: External Proxy, System Binary Proxy Execution: Rundll32, System Information Discovery, System Services: Service Execution

References