Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations
documents.trendmicro.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2017-0213Microsoft Windows Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.3T1548Abuse Elevation Control MechanismT1068Exploitation for Privilege Escalation4 reports84.3%Top 0.3%87.0priority
Where it names them
CVE-2017-0213 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
a clipboard stealer, wherein the content is encrypted with the same algorithm as the type 1 backdoor; a network traffic tunnel named EarthWorm;13 a public IP address retriever; 14 an NBTScan tool for enumerating NetBIOS shares; a brute-force tool; 15 and an elevation of privilege tool for exploiting CVE-2017-0213.
“CVE-2017-0213.cpp.”
windows-kernel-exploits/blob/master/CVE-2017-0213/CVE-2017-0213.cpp.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.