{"description": "Enterprise techniques used by Shamoon, ATT&CK software S0140 (v2.2)", "name": "Shamoon (S0140)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1548", "showSubtechniques": true}, {"techniqueID": "T1548.002", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) attempts to disable UAC remote restrictions by modifying the Registry.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1134", "showSubtechniques": true}, {"techniqueID": "T1134.001", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.(Citation: McAfee Shamoon December 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) has used HTTP for C2.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1543", "showSubtechniques": true}, {"techniqueID": "T1543.003", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) creates a new service named \u201cntssrv\u201d to execute the payload. Newer versions create the \"MaintenaceSrv\" and \"hdv_725x\" services.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1485", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) attempts to overwrite operating system files and disk structures with image files.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016) In a later variant, randomly generated data was used for data overwrites.(Citation: Unit 42 Shamoon3 2018)(Citation: McAfee Shamoon December 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1486", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) has an operational mode for encrypting data instead of overwriting it.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1140", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) decrypts ciphertext using an XOR cipher and a base64-encoded string.(Citation: Unit 42 Shamoon3 2018)\t", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1561", "showSubtechniques": true}, {"techniqueID": "T1561.002", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) has been seen overwriting features of disk structure such as the MBR.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.006", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) can change the modified time for files to evade forensic detection.(Citation: McAfee Shamoon December 2018)\t", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) can download an executable to run on the victim.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1570", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) attempts to copy itself to remote machines on the network.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "showSubtechniques": true}, {"techniqueID": "T1036.004", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) creates a new service named \u201cntssrv\u201d that attempts to appear legitimate; the service's display name is \u201cMicrosoft Network Realtime Inspection Service\u201d and its description is \u201cHelps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.\u201d Newer versions create the \"MaintenaceSrv\" service, which misspells the word \"maintenance.\"(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1112", "comment": "Once [Shamoon](https://attack.mitre.org/software/S0140) has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy to 1.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) contains base64-encoded strings.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1012", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) queries several Registry keys to identify hard disk partitions to overwrite.(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1021", "showSubtechniques": true}, {"techniqueID": "T1021.002", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) to execute the malware.(Citation: FireEye Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1018", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) scans the C-class subnet of the IPs on the victim's interfaces.(Citation: FireEye Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1053", "showSubtechniques": true}, {"techniqueID": "T1053.005", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) copies an executable payload to the target system by using [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) and then scheduling an unnamed task to execute the malware.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1082", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1016", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) obtains the target's IP address and local network segment.(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1569", "showSubtechniques": true}, {"techniqueID": "T1569.002", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) creates a new service named \u201cntssrv\u201d to execute the payload. [Shamoon](https://attack.mitre.org/software/S0140) can also spread via [PsExec](https://attack.mitre.org/software/S0029).(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December19 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1529", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) will reboot the infected system once the wiping functionality has been completed.(Citation: Unit 42 Shamoon3 2018)(Citation: McAfee Shamoon December 2018)\t", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1124", "comment": "[Shamoon](https://attack.mitre.org/software/S0140) obtains the system time and will only activate if it is greater than a preset date.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1078", "showSubtechniques": true}, {"techniqueID": "T1078.002", "comment": "If [Shamoon](https://attack.mitre.org/software/S0140) cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.(Citation: FireEye Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Shamoon", "color": "#66b1ff"}]}