Patchwork, Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover, Group G0040
Excerpt
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control Patchwork bypassed User Access Control (UAC).[1]
Enterprise T1560 Archive Collected Data
Patchwork encrypted the collected files' path with AES and then encoded them with base64.[3] Enterprise T1119 Automated Collection
Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server. [3]
Enterprise T1197 BITS Jobs
Patchwork has used BITS jobs to download malicious payloads.[6]
Enterprise T1547 .001 Boot or Logon…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
