Incident Score: Analysis & Impact (MIN1775638175)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Spearphishing Attachment (T1566.001) with high confidence (90%), with evidence including spear-phishing emails with geofenced payloads, and malicious documents triggered CVE-2017-0199 and Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), supported by evidence indicating exploited two long-standing Microsoft Office vulnerabilities (CVE-2017-0199, CVE-2017-11882). Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with high confidence (90%), supported by evidence indicating cVE-2017-0199 (remote code execution) and CVE-2017-11882 (memory corruption) and Command and Scripting Interpreter: Visual Basic (T1059.005) with moderate to high confidence (70%), supported by evidence indicating equation Editor exploitation (CVE-2017-11882) executed shellcode-based loader. Under the Persistence tactic, the analysis identified Hijack Execution Flow: DLL Side-Loading (T1574.002) with moderate to high confidence (80%), with evidence including dLL side-loading to install StealerBot, and backdoors established via DLL side-loading. Under the Defense Evasion tactic, the analysis identified Virtualization/Sandbox Evasion: System Checks (T1497.001) with moderate to high confidence (80%), supported by evidence indicating geofencing such as if victim’s IP did not match targeted region, empty RTF file sent as decoy and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating shellcode-based loader to deploy StealerBot. Under the Credential Access tactic, the analysis identified Input Capture: Keylogging (T1056.001) with high confidence (90%), supported by evidence indicating stealerBot designed to steal keystrokes and Credentials from Password Stores (T1555) with moderate to high confidence (80%), supported by evidence indicating stealerBot designed to steal passwords. Under the Collection tactic, the analysis identified Screen Capture (T1113) with high confidence (90%), supported by evidence indicating stealerBot designed to steal screenshots and Data from Local System (T1005) with high confidence (90%), supported by evidence indicating stealerBot designed to steal files. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating stealerBot establish a reverse shell. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including data exfiltration such as Yes, and stealerBot designed to steal screenshots, keystrokes, passwords, and files. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.