MITRE ATT&CKsoftware (malware)

S0140 Shamoon

Published 2017-05-31 Modified 2024-11-17 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Disttrack
Version
2.2
Created
2017-05-31

Description

Shamoon is wiper malware that was first used by an Iranian group known as the "Cutting Sword of Justice" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. Shamoon has also been seen leveraging RawDisk and Filerase to carry out data wiping tasks. Analysis has linked Shamoon with Kwampirs based on multiple shared artifacts and coding patterns. The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.

Related

Uses · MITRE ATT&CK (24)

  • T1071.001 Web Protocols sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1569.002 Service Execution sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1070.006 Timestomp sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1543.003 Windows Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1529 System Shutdown/Reboot technique
  • T1486 Data Encrypted for Impact technique
  • T1485 Data Destruction technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique
  • T1124 System Time Discovery technique

References