WinMM is a backdoor that allows an attacker to gain remote access and control of a victim's machine. It uses a Windows hook to collect information on process creation and NetUser-GetInfo to identify whether it is running under an administrator account. It is usually configured with a primary and backup domain for C2 communications and uses HTTP for C2. It also sets a Windows hook to search for and capture files on the victim.
Table of Contents
WinMM Malware Capabilities
- The WinMM malware may attempt to gather information on running processes and active users on a system in order to determine what actions to take next. This information may be used to determine whether or not to fully infect a target system and/or what specific actions to take. WinMM may use alternate communication channels if the primary channel is compromised or inaccessible.
- WinMM may use application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. It may also enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. WinMM may use the information gathered during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Ways to Mitigate WinMM Malware Attacks
- The WinMM malware mitigation system is designed to protect against potential malicious activity by constantly monitoring for unusual behavior. This includes analyzing network data for any unexpected or suspicious activity, and keeping track of process activity to identify anything out of the ordinary. By doing so, it is hoped that any potential malicious activity can be detected and stopped before it can cause any harm.
- The above text discusses various methods that can be used to mitigate the effects of WinMM malware. These include analyzing network data for unusual activity, monitoring process activity for unusual behavior, and keeping track of system and network changes made by an adversary.
About Apt30 Threat Group
The two groups do not appear to be exact matches, but they share some characteristics.
