1. Home
  2. Software
  3. Ferocious

Ferocious

Ferocious is a first stage implant composed of VBS and PowerShell scripts that has been used by WIRTE since at least 2021.[1]

ID: S0679
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 01 February 2022
Last Modified: 01 February 2022
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1546 .015 事件触发执行: Component Object Model Hijacking

Ferocious can use COM hijacking to establish persistence.[1]
Enterprise T1112 修改注册表

Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

Ferocious can use PowerShell scripts for execution.[1]
.005 命令与脚本解释器: Visual Basic

Ferocious has the ability to use Visual Basic scripts for execution.[1]
Enterprise T1120 外围设备发现

Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.[1]
Enterprise T1070 .004 移除指标: File Deletion

Ferocious can delete files from a compromised host.[1]
Enterprise T1082 系统信息发现

Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.[1]
Enterprise T1497 .001 虚拟化/沙盒规避: System Checks

Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function GET.WORKSPACE to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.[1]
Enterprise T1518 .001 软件发现: Security Software Discovery

Ferocious has checked for AV software as part of its persistence process.[1]

Groups That Use This Software

ID Name References
G0090 WIRTE

[1]

References

  1. Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.