Egregor

How Egregor typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Egregor.

1. T1059.001 PowerShell Execution

   What they do: Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1059.003 Windows Command Shell Execution

   What they do: Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.

   What that means: Adversaries may abuse the Windows command shell for execution.

3. T1106 Native API Execution

   What they do: Egregor has used the Windows API to make detection more difficult.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

4. T1197 BITS Jobs ExecutionPersistenceStealth

   What they do: Egregor has used BITSadmin to download and execute malicious DLLs.

   What that means: Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.

5. T1574.001 DLL ExecutionStealth

   What they do: Egregor has used DLL side-loading to execute its payload.

   What that means: Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.

6. T1055 Process Injection Privilege EscalationStealth

   What they do: Egregor can inject its payload into iexplore.exe process.

   What that means: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

7. T1484.001 Group Policy Modification Privilege EscalationDefense Impairment

   What they do: Egregor can modify the GPO to evade detection.

   What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

8. T1027.002 Software Packing Stealth

   What they do: Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

   What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

9. T1036.004 Masquerade Task or Service Stealth

   What they do: Egregor has masqueraded the svchost.exe process to exfiltrate data.

   What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

10. T1140 Deobfuscate/Decode Files or Information Stealth

    What they do: Egregor has been decrypted before execution.

    What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

11. T1218.010 Regsvr32 Stealth

    What they do: Egregor has used regsvr32.exe to execute malicious DLLs.

    What that means: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.

12. T1218.011 Rundll32 Stealth

    What they do: Egregor has used rundll32 during execution.

    What that means: Adversaries may abuse rundll32.exe to proxy execution of malicious code.

13. T1497 Virtualization/Sandbox Evasion StealthDiscovery

    What they do: Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

    What that means: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

14. T1497.003 Time Based Checks StealthDiscovery

    What they do: Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.

    What that means: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

15. T1685 Disable or Modify Tools Defense Impairment

    What they do: Egregor has disabled Windows Defender to evade protections.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

16. T1033 System Owner/User Discovery Discovery

    What they do: Egregor has used tools to gather information about users.

    What that means: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

17. T1049 System Network Connections Discovery Discovery

    What they do: Egregor can enumerate all connected drives.

    What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

18. T1069.002 Domain Groups Discovery

    What they do: Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.

    What that means: Adversaries may attempt to find domain-level groups and permission settings.

19. T1082 System Information Discovery Discovery

    What they do: Egregor can perform a language check of the infected system and can query the CPU information (cupid).

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

20. T1124 System Time Discovery Discovery

    What they do: Egregor contains functionality to query the local/system time.

    What that means: An adversary may gather the system time and/or time zone settings from a local or remote system.

21. T1039 Data from Network Shared Drive Collection

    What they do: Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.

    What that means: Adversaries may search network shares on computers they have compromised to find files of interest.

22. T1071.001 Web Protocols Command and Control

    What they do: Egregor has communicated with its C2 servers via HTTPS protocol.

    What that means: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

23. T1105 Ingress Tool Transfer Command and Control

    What they do: Egregor has the ability to download files from its C2 server.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.

24. T1219 Remote Access Tools Command and Control

    What they do: Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.

    What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.

25. T1486 Data Encrypted for Impact Impact

    What they do: Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122