Orangeworm

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. ^[1]

ID: G0071

Contributors: Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre

Version: 1.0

Techniques Used

Domain	ID	Name	Use
Enterprise	T1071	Standard Application Layer Protocol	Orangeworm has used HTTP for C2.^[2]
Enterprise	T1077	Windows Admin Shares	Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.^[1]

Software

ID	Name	References	Techniques
S0099	Arp	^[1]	System Network Configuration Discovery
S0106	cmd	^[1]	Command-Line Interface, File and Directory Discovery, File Deletion, Remote File Copy, System Information Discovery
S0100	ipconfig	^[1]	System Network Configuration Discovery
S0236	Kwampirs	^[1]	Account Discovery, Binary Padding, Deobfuscate/Decode Files or Information, Fallback Channels, File and Directory Discovery, Masquerading, Network Share Discovery, New Service, Obfuscated Files or Information, Password Policy Discovery, Permission Groups Discovery, Process Discovery, Remote File Copy, Remote System Discovery, Rundll32, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery, System Owner/User Discovery, System Service Discovery, Windows Admin Shares
S0039	Net	^[1]	Account Discovery, Create Account, Network Share Connection Removal, Network Share Discovery, Password Policy Discovery, Permission Groups Discovery, Remote System Discovery, Service Execution, System Network Connections Discovery, System Service Discovery, System Time Discovery, Windows Admin Shares
S0104	netstat	^[1]	System Network Connections Discovery
S0103	route	^[1]	System Network Configuration Discovery
S0096	Systeminfo	^[1]	System Information Discovery

References

Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.

Symantec Security Response Attack Investigation Team. (2018, April 23). Orangeworm: Indicators of Compromise. Retrieved July 8, 2018.