Rancor
Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents. [1]
ID: G0075
Version: 1.2
Created: 17 October 2018
Last Modified: 30 March 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell | |
.005 | Command and Scripting Interpreter: Visual Basic |
Rancor has used VBS scripts as well as embedded macros for execution.[1] |
||
Enterprise | T1105 | Ingress Tool Transfer |
Rancor has downloaded additional malware, including by using certutil.[1] |
|
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Rancor has attached a malicious document to an email to gain initial access.[1] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Rancor launched a scheduled task to gain persistence using the |
Enterprise | T1218 | .007 | Signed Binary Proxy Execution: Msiexec |
Rancor has used |
Enterprise | T1204 | .002 | User Execution: Malicious File |
Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.[1] |