{"description": "Enterprise techniques used by HAMMERTOSS, ATT&CK software S0037 (v1.2)", "name": "HAMMERTOSS (S0037)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "The \"Uploader\" variant of [HAMMERTOSS](https://attack.mitre.org/software/S0037) visits a hard-coded server over HTTP/S to download the images [HAMMERTOSS](https://attack.mitre.org/software/S0037) uses to receive commands.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "[HAMMERTOSS](https://attack.mitre.org/software/S0037) is known to use PowerShell.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1001", "showSubtechniques": true}, {"techniqueID": "T1001.002", "comment": "[HAMMERTOSS](https://attack.mitre.org/software/S0037) is controlled via commands that are appended to image files.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1573", "showSubtechniques": true}, {"techniqueID": "T1573.001", "comment": "Before being appended to image files, [HAMMERTOSS](https://attack.mitre.org/software/S0037) commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1567", "showSubtechniques": true}, {"techniqueID": "T1567.002", "comment": "[HAMMERTOSS](https://attack.mitre.org/software/S0037) exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1564", "showSubtechniques": true}, {"techniqueID": "T1564.003", "comment": "[HAMMERTOSS](https://attack.mitre.org/software/S0037) has used -WindowStyle hidden to conceal [PowerShell](https://attack.mitre.org/techniques/T1059/001) windows.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1102", "showSubtechniques": true}, {"techniqueID": "T1102.003", "comment": "The \"tDiscoverer\" variant of [HAMMERTOSS](https://attack.mitre.org/software/S0037) establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. [HAMMERTOSS](https://attack.mitre.org/software/S0037) binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.(Citation: FireEye APT29)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by HAMMERTOSS", "color": "#66b1ff"}]}