Incident Score: Analysis & Impact (GOOSEN1789503965)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), with evidence including phishing lures impersonating 12 Brazilian banks, and tricking victims into installing a malicious browser extension and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating javaScript file disguised as a banking document, invoice, or corporate file, manually executed by the victim. Under the Execution tactic, the analysis identified JavaScript (T1059.007) with moderate to high confidence (80%), supported by evidence indicating javaScript loaders, custom C++ installers, and malicious browser extensions, User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating malicious JavaScript file manually executed by the victim, and Scheduled Task/Job: Scheduled Task (T1053.005) with moderate to high confidence (70%), supported by evidence indicating establishes persistence via a scheduled task. Under the Persistence tactic, the analysis identified Browser Extensions (T1176) with high confidence (90%), supported by evidence indicating malicious browser extension (AVSync System Inc.) installed on Chrome/Edge and Scheduled Task/Job: Scheduled Task (T1053.005) with moderate to high confidence (70%), supported by evidence indicating establishes persistence via a scheduled task. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate confidence (60%), supported by evidence indicating bypassing Chromium’s integrity mechanisms by manipulating Secure Preferences. Under the Defense Evasion tactic, the analysis identified Subvert Trust Controls: Code Signing (T1553.002) with moderate to high confidence (80%), supported by evidence indicating sideloads an unsigned DLL (SentinelAgentCore.dll) via legitimate SentinelOne binary, Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating malicious extension named AVSync System Inc. to appear legitimate, Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (70%), supported by evidence indicating enabling Chrome’s developer mode to bypass Secure Preferences protection, Indicator Removal: File Deletion (T1070.004) with moderate confidence (60%), supported by evidence indicating malware terminates if sandbox or VM environment detected, Reflective Code Loading (T1620) with moderate to high confidence (70%), supported by evidence indicating dLL sideloading via legitimate SentinelOne binary, and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating regenerating HMACs and App-Bound encrypted hashes to evade detection. Under the Credential Access tactic, the analysis identified Steal Web Session Cookie (T1539) with high confidence (90%), supported by evidence indicating harvests and exfiltrates cookies, sessionStorage, localStorage, Credentials from Web Browsers: Browser Password Stores (T1555.003) with moderate to high confidence (80%), supported by evidence indicating steals credentials via malicious browser extension, and Unsecured Credentials: Credentials In Files (T1552.001) with moderate to high confidence (70%), supported by evidence indicating exfiltrates localStorage and sessionStorage data. Under the Discovery tactic, the analysis identified Account Discovery: Local Account (T1087.001) with moderate confidence (60%), supported by evidence indicating scans for hard-coded process names and hardware properties, Process Discovery (T1057) with moderate to high confidence (70%), supported by evidence indicating scans for hard-coded process names to evade analysis, System Information Discovery (T1082) with moderate to high confidence (70%), supported by evidence indicating verifies hardware properties (e.g., ≥2 CPUs and >3GB RAM), and Application Window Discovery (T1010) with moderate to high confidence (80%), supported by evidence indicating tab enumeration and domain tracking via malicious extension. Under the Collection tactic, the analysis identified Screen Capture (T1113) with moderate to high confidence (80%), supported by evidence indicating screenshot capture of active tabs via malicious extension, Data from Information Repositories: Confluence (T1213.001) with moderate confidence (50%), supported by evidence indicating hTML source extraction from active tabs, and Data from Local System (T1005) with high confidence (90%), supported by evidence indicating harvests cookies, sessionStorage, localStorage, tab history. Under the Command and Control tactic, the analysis identified Web Service: Dead Drop Resolver (T1102.002) with high confidence (90%), supported by evidence indicating uses Ethereum smart contracts as dead drop resolvers for C2 endpoints, Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating exfiltrates data to C2 server (luizestrelhashapr.online such as 443), and Ingress Tool Transfer (T1105) with moderate to high confidence (70%), supported by evidence indicating retrieves payload locations from Ethereum smart contract. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating exfiltrates cookies, session tokens, and tab history to C2 server and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating dynamic C2 updates via Ethereum smart contracts. Under the Impact tactic, the analysis identified Defacement: Internal Defacement (T1491.001) with moderate confidence (50%), supported by evidence indicating potential unauthorized access to banking accounts. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.