Rare Wolf preys on sensitive data using fake 1C:Enterprise invoices as a lure

How adversaries create diversions and stay invisible

Tactic	Technique	Procedure
Initial Access	Phishing: Spearphishing Attachment	Rare Wolf uses emails containing malicious attachments to gain initial access
Execution	User Execution: Malicious File	To initiate the compromise process, the victim needs to launch the malicious file
	Command and Scripting Interpreter: Windows Command Shell	Rare Wolf uses `.cmd` files that are executed from the Windows command line
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Rare Wolf uses the registry branches responsible for autoloading to gain persistence in the system
Privilege Escalation	Abuse Elevation Control Mechanism: Bypass User Account Control	Smart Install Maker asks the user for administrator privileges for privileged execution
Defense Evasion	Abuse Elevation Control Mechanism: Bypass User Account Control	Smart Install Maker asks the user for administrator privileges for privileged execution
	Hide Artifacts: Hidden Files and Directories	The folder `C:\Intel` is created with the attributes set to Hidden, System, Unindexed
	Indicator Removal: File Deletion	The file `rezet.cmd` is deleted after execution. The files in `C:\Intel` are deleted after a reboot using `mail.exe` and `go.exe`
	Indicator Removal: Clear Persistence	When executing `mail.exe` and `go.exe`, the registry hives that Rare Wolf used to add to autorun are cleared out
	Masquerading	The executable files used by Rare Wolf in gaining initial access are disguised as Microsoft Word documents
	Modify Registry	Rare Wolf uses registry hives responsible for autoloading to gain persistence in the system
Credential Access	Credentials from Password Stores: Credentials from Web Browsers	Rare Wolf downloads WebBrowserPassView (a program to retrieve user credentials from browsers) onto the compromised device
	Keylogging	Mipko Employee Monitor allows attackers to access keystroke records
Discovery	File and Directory Discovery	`rezet.cmd` gets all files on the system disk that match the mask `.doc` as well as all the files in the folder `C:\Users\[user]\AppData\Roaming\Telegram Desktop\tdata`
	Process Discovery	Mipko Employee Monitor allows attackers to access the processes running on the system
	Log Enumeration	Mipko Employee Monitor accesses Windows logs to collect information during execution
Collection	Archive Collected Data	The resulting files collected by `rezet.exe` are archived with `driver.exe` and sent to the attacker’s email account
	Automated Collection	Mipko Employee Monitor collects data on a compromised device without the intervention of the attacker
	Clipboard Data	Mipko Employee Monitor allows attackers to access clipboard history
	Data from Local System	`rezet.cmd` gets all files on the system disk that match the mask `.doc` as well as all the files in the folder `C:\Users\[user]\AppData\Roaming\Telegram Desktop\tdata`
	Data Staged: Local Data Staging	Archives with the collected files remain on the compromised system until they are sent to the C2 server
	Screen Capture	Mipko Employee Monitor allows attackers to access screenshots taken on a compromised system
	Video Capture	Mipko Employee Monitor allows attackers to access screenshots taken on a compromised system
Command and Control	Application Layer Protocol: Mail Protocols	`rezet.exe` uses the `blat.exe` utility to send email messages with attachments
	Application Layer Protocol: Web Protocols	Rare Wolf uses HTTP to download tools
	Ingress Tool Transfer	All additional software is downloaded from the C2 as archives
	Remote Access Software	Rare Wolf uses Mipko Employee Monitor to gain access to a compromised system