{"description": "Enterprise techniques used by OopsIE, ATT&CK software S0264 (v1.2)", "name": "OopsIE (S0264)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) uses HTTP for C2 communications.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1560", "showSubtechniques": true}, {"techniqueID": "T1560.001", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) compresses collected files with GZipStream before sending them to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1560.003", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) compresses collected files with a simple character replacement scheme before sending them to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.003", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) uses the command prompt to execute commands on the victim's machine.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.005", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) creates and uses a VBScript as part of its persistent execution.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1132", "showSubtechniques": true}, {"techniqueID": "T1132.001", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) encodes data in hexadecimal format over the C2 channel.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1074", "showSubtechniques": true}, {"techniqueID": "T1074.001", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) stages the output from command execution and collected files in specific folders before exfiltration.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1030", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) exfiltrates command output and collected files to its C2 server in 1500-byte blocks.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1140", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1041", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) can upload files from the victim's machine to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) has the capability to delete files and scripts from the victim's machine.(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) can download files from its C2 server to the victim's machine.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. [OopsIE](https://attack.mitre.org/software/S0264) also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1027.002", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.(Citation: Unit 42 OopsIE! Feb 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1053", "showSubtechniques": true}, {"techniqueID": "T1053.005", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) creates a scheduled task to run itself every three minutes.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1082", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1124", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) checks to see if the system is configured with \"Daylight\" time and checks for a specific region to be set for the timezone.(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1497", "showSubtechniques": true}, {"techniqueID": "T1497.001", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it\u2019s running in a virtual environment.(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1047", "comment": "[OopsIE](https://attack.mitre.org/software/S0264) uses WMI to perform discovery techniques.(Citation: Unit 42 OilRig Sept 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by OopsIE", "color": "#66b1ff"}]}