Incident Score: Analysis & Impact (RAP1778084674)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing via Service (T1566.003) with high confidence (90%), supported by evidence indicating unsolicited Microsoft Teams messages sent to employees and Trusted Relationship (T1199) with moderate to high confidence (80%), supported by evidence indicating exploited Teams’ trusted environment to bypass security controls. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with moderate to high confidence (80%), supported by evidence indicating interactive screen-sharing sessions instructing victims to execute commands, Command and Scripting Interpreter: PowerShell (T1059.001) with moderate to high confidence (70%), supported by evidence indicating arbitrary command execution via encoded PowerShell (Game.exe RAT), and Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate to high confidence (70%), supported by evidence indicating executed discovery commands (ipconfig /all, whoami, net start). Under the Persistence tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating deployed DWAgent and AnyDesk for persistent remote access and Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) with moderate confidence (60%), supported by evidence indicating rAT (Game.exe) likely established persistence via startup mechanisms. Under the Privilege Escalation tactic, the analysis identified Valid Accounts: Domain Accounts (T1078.002) with moderate to high confidence (80%), supported by evidence indicating authenticated to Domain Controllers using stolen accounts. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating game.exe RAT disguised as legitimate Microsoft WebView2 application, Obfuscated Files or Information: Command Obfuscation (T1027.010) with moderate to high confidence (70%), supported by evidence indicating encoded PowerShell commands via Game.exe RAT, Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating sandbox and virtual machine detection by Game.exe, and Hijack Execution Flow: DLL Side-Loading (T1574.002) with moderate confidence (50%), supported by evidence indicating python-based process injection (pythonw.exe) used by MuddyWater. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001) with moderate confidence (50%), supported by evidence indicating interactive screen-sharing sessions for credential harvesting, Input Capture: Keylogging (T1056.001) with moderate to high confidence (70%), supported by evidence indicating victims entered credentials into locally created files (credentials.txt), and Multi-Factor Authentication Request Generation (T1621) with high confidence (90%), supported by evidence indicating attackers added their devices to victims’ MFA configurations. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate to high confidence (80%), supported by evidence indicating executed whoami and net start commands post-compromise and System Network Configuration Discovery (T1016) with moderate to high confidence (80%), supported by evidence indicating executed ipconfig /all to gather network configuration. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate to high confidence (80%), supported by evidence indicating lateral movement via RDP using stolen credentials and Remote Services: SMB/Windows Admin Shares (T1021.002) with moderate confidence (60%), supported by evidence indicating likely used SMB for lateral movement to Domain Controllers. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating harvested credentials and sensitive organizational data and Automated Collection (T1119) with moderate to high confidence (70%), supported by evidence indicating game.exe RAT enabled chunked file uploads and data exfiltration. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with high confidence (90%), supported by evidence indicating c2 communication via moonzonet.com (port 443), Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating custom downloader (ms_upd.exe) fetched from C2 server, and Encrypted Channel: Symmetric Cryptography (T1573.001) with moderate to high confidence (70%), supported by evidence indicating aES-256-GCM encrypted RAT configuration storage. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration via Game.exe RAT and C2 infrastructure and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating c2 domains (uploadfiler.com, adm-pulse.com) suggest cloud exfiltration. Under the Impact tactic, the analysis identified Defacement: Internal Defacement (T1491.001) with moderate confidence (50%), supported by evidence indicating chaos ransomware used as false flag to mislead attribution. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.