TSCookie
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol:Web Protocols | TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.[2][1] |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter:Windows Command Shell | TSCookie has the ability to execute shell commands on the infected host.[1] |
| Enterprise | T1555 | .003 | Credentials from Password Stores:Credentials from Web Browsers | TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | TSCookie has the ability to decrypt, load, and execute a DLL and its resources.[1] | |
| Enterprise | T1573 | .001 | Encrypted Channel:Symmetric Cryptography | |
| Enterprise | T1083 | File and Directory Discovery | TSCookie has the ability to discover drive information on the infected host.[1] | |
| Enterprise | T1105 | Ingress Tool Transfer | TSCookie has the ability to upload and download files to and from the infected host.[1] | |
| Enterprise | T1095 | Non-Application Layer Protocol | TSCookie can use ICMP to receive information on the destination server.[2] | |
| Enterprise | T1057 | Process Discovery | TSCookie has the ability to list processes on the infected host.[1] | |
| Enterprise | T1055 | Process Injection | TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.[2] | |
| Enterprise | T1090 | Proxy | TSCookie has the ability to proxy communications with command and control (C2) servers.[2] | |
| Enterprise | T1016 | System Network Configuration Discovery | TSCookie has the ability to identify the IP of the infected host.[1] | |
| Enterprise | T1204 | .001 | User Execution:Malicious Link | TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.[1] |