{"description": "Enterprise techniques used by MiniJunk, ATT&CK software S9053 (v1.0)", "name": "MiniJunk (S9053)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has leveraged HTTPS calls to the C2.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1547", "showSubtechniques": true}, {"techniqueID": "T1547.001", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has been executed using the auto-run registry key `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\MigAutoPlay` that executes the benign windows executable `MigAutoPlay`.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1074", "showSubtechniques": true}, {"techniqueID": "T1074.001", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to move or rename files.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1083", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has listed all hard drives or has listed files within a specified directory.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has a command that is capable of deleting a file.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to load a DLL from the C2.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1106", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has utilized Windows API calls to make HTTPs requests to C2.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has obfuscated code that utilized junk code insertion, control-flow obfuscation, opaque predicates, obfuscated function calls, and encrypted strings to hinder analysis.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1027.013", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has encoded network data by converting strings into bytes, then reversing the bytes and the entire strings. [MiniJunk](https://attack.mitre.org/software/S9053) has also encrypted strings to obfuscate code.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.015", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has been delivered within a malicious zip file.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.016", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has been compiled through several obfuscation techniques to include junk code insertion.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1057", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to validate running processes.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1553", "showSubtechniques": true}, {"techniqueID": "T1553.002", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has leveraged legitimate digital signatures from SSL[.]com to appear legitimate.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1082", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to gather the computer name.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1033", "comment": "[MiniJunk](https://attack.mitre.org/software/S9053) has collected the domain name with username.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by MiniJunk", "color": "#66b1ff"}]}