WIRTE
WIRTE is a threat group that has been active since at least August 2018. The group focuses on targeting Middle East defense and diplomats.[1]
ID: G0090
Contributors: Lab52 by S2 Grupo
Version: 1.1
Created: 24 May 2019
Last Modified: 30 March 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic | |
.001 | Command and Scripting Interpreter: PowerShell | |||
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
WIRTE has decoded a base64 encoded document which was embedded in a VBS script.[1] |
|
Enterprise | T1105 | Ingress Tool Transfer |
WIRTE has downloaded PowerShell code from the C2 server to be executed.[1] |
|
Enterprise | T1218 | .010 | Signed Binary Proxy Execution: Regsvr32 |
WIRTE has used Regsvr32.exe to trigger the execution of a malicious script.[1] |