PLAINTEE
PLAINTEE is a malware sample that has been used by Rancor in targeted attacks in Singapore and Cambodia. [1]
ID: S0254
Type: MALWARE
Platforms: Windows
Version: 1.0
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1088 | Bypass User Account Control | An older variant of PLAINTEE performs UAC bypass.[1] |
| Enterprise | T1059 | Command-Line Interface | PLAINTEE uses cmd.exe to execute commands on the victim’s machine.[1] |
| Enterprise | T1094 | Custom Command and Control Protocol | PLAINTEE uses a custom UDP protocol to communicate.[1] |
| Enterprise | T1024 | Custom Cryptographic Protocol | PLAINTEE encodes C2 beacons using XOR.[1] |
| Enterprise | T1112 | Modify Registry |
PLAINTEE uses reg add to add a Registry Run key for persistence.[1]
|
| Enterprise | T1057 | Process Discovery |
PLAINTEE performs the tasklist command to list running processes.[1]
|
| Enterprise | T1060 | Registry Run Keys / Startup Folder |
PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.[1]
|
| Enterprise | T1105 | Remote File Copy | PLAINTEE has downloaded and executed additional plugins.[1] |
| Enterprise | T1082 | System Information Discovery | PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.[1] |
| Enterprise | T1016 | System Network Configuration Discovery |
PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.[1]
|
Groups
Groups that use this software:
Rancor