A glimpse into the shadowy realm of a Chinese APT

ShadowPad intrusion

research.nccgroup.com/2022/09/30/a-glimpse-into-the-shadowy-realm-of-a-chinese-apt-detailed-analysis-of-a-shadowpad-intrusion/

: detailed analysis of a

September 30, 2022

Authors: William Backhouse (

Summary

tl;dr

This post explores some of the TTPs employed by a threat actor who was observed deploying ShadowPad during an incident response
engagement.

Below provides a summary of findings which are presented in this blog post:

@Will0x04), Michael Mullen (@DropTheBase64) and Nikolaos Pantazopoulos

Initial access via CVE-2022-29464.
Successive backdoors installed – PoisonIvy, a previously undocumented backdoor and finally ShadowPad.
Establishing persistence via Windows Services to execute legitimate binaries which sideloads backdoors, including ShadowPad.
Use of information gathering tools such as ADFind and PowerView.
Lateral movement leveraging RDP and ShadowPad.
Use of 7zip for data collection.
ShadowPad used for Command and Control. 
Exfiltration of data.

ShadowPad

This blog looks to build on the work of other security research done by SecureWorks and PwC with firsthand experience of TTPs used in a
recent incident where ShadowPad was deployed. ShadowPad is a modular remote access trojan (RA
exclusively by China-Based threat actors.

Attribution

Based on the findings of our Incident Response investigation, NCC Group assesses with high confidence that the threat actor detailed in
this article was a China-based Advanced Persistent Threat (APT).

This is based on the following factors

T) which is thought to be used almost

1/13

ShadowPad – Public reporting has previously indicated the distribution of ShadowPad is tightly controlled and is typically exclusive to
China-based threat actors for use during espionage campaigns.
TTPs – Specific TTPs observed during the attack were found to match those previously observed by China-based threat actors, both
within NCC Group incident response engagements and the wider security community.
Activity pattern analysis – The threat actor was typically active during the hours of 01:00 – 09:00 (UTC) which matches the working
hours of China

TTPs

Initial Access

A recent vulnerability in WSO2, CVE-2022-29464 [3], was the root cause of the incident. The actor, amongst other attackers, was able to
exploit the vulnerability soon after it was published to create web shells on a server.

The actor leveraged a web shell to load a backdoor, in this case PoisonIvy
Search Order Hijacking, a tactic which was continuously leveraged throughout the attack.

Execution

Certutil.exe was used via commands issued on web shells to install the PoisonIvy backdoor on patient zero.

The threat actor leveraged command prompt and PowerShell throughout the incident.

Additionally, several folders named _MEI<random digits> were observed within the Windows\T
change each time a binary is compiled. These folders are created on a host when a python executable is compiled. Within these folders
were the .pyd library files and DLL files. The created time for these folders matched the last modified time stamp of the complied binary
within the shimcache.

Persistence

Run Keys and Windows services were used throughout in order to ensure the backdoors deployed obtained persistence.

Defense Evasion

The threat actor undertook significant anti-forensic actions on ShadowPad related files to evade detection. This included timestomping the
malicious DLL and applying the NTFS attributes of hidden and system to the files. Legitimate but renamed Windows binaries were used to
load the configuration file. The threat actor also leveraged a legitimate Windows DLL, 
for the ShadowPad backdoor.

All indicators of compromise, aside from backdoor modules and loaders, were removed from the hosts by the threat actor.

Credential Access

The threat actor was observed collecting all web browser credentials from all hosts across the environment. It is unclear at this stage how
this was achieved with the evidence available.

Discovery

A vast array of tooling was used to scan and enumerate the network as the actor negotiated their way through it, these included but were
not limited to the following:

AdFind
NbtScan
PowerView
PowerShell scripts to enumerate hosts on port 445
Tree.exe

Lateral Movement

Lateral movement was largely carried out using Windows services, particularly leveraging SMB pipes. The only interactive sessions
observed were onward RDP sessions to customer connected sites.

Collection

. This was deployed via a malicious DLL and leveraged DLL

emp folder. The digits in the folder name

secur32.dll , as the name of the configuration file

2/13

In addition to the automated collection of harvested credentials, the ShadowPad keylogger module was used in the attack, storing the
keystrokes in encrypted database files for exfiltration. The output of which was likely included in archive files created by the attacker, along
with the output of network scanning and reconnaissance.

Command and Control

In total, three separate command and control infrastructures were identified, all of which utilised DLL search order hijacking / DLL side
loading. The initial payload was PoisonIvy, this was only observed on patient zero. The threat actor went on to deploy a previously
undocumented backdoor once they gained an initial foothold in the network, this framework established persistence via a service called
K7AVWScn, masquerading as an older anti-virus product. Finally, once a firm foothold was established within the network the threat actor
deployed ShadowPad. Notably, the ShadowPad module for the proxy feature was also observed during the attack to proxy C2
communications via a less conspicuous server.

Exfiltration

Due to the exfiltration capabilities of ShadowPad, it is highly likely to have been the method of exfiltration to steal data from the customer
network. This is further cemented by a small, yet noticeable spike in network traffic to threat actor controlled infrastructure.

Recommendations

Searches for the documented IOCs should be conducted
If IOCs are identified a full incident response investigation should be conducted

ShadowPad Technical Analysis

Initialisation phase

Upon execution, the ShadowPad core module enters an initialisation phase at which it decrypts its configuration and determines which
mode it runs. In summary, we identified the following modes:

Mode Description 
ID

3  Injects itself to a specified process (specified in the ShadowPad configuration) and adds persistence to the compromised host.  
  In addition, if the compromised user belongs to a group with a SID starting with S-1-5-80- then the specified target process
uses the token of ‘lsass’.

4  Injects itself to a specified process (specified in the ShadowPad configuration) and executes the core code in a new thread.    In
addition, if the compromised user belongs to a group with a SID starting with S-1-5-80 then the specified target process uses
the token of ‘lsass’.

5  Injects itself to a specified process (specified in the ShadowPad configuration).     In addition, if the compromised user belongs
to a group with a SID starting with S-1-5-80 then the specified target process uses the token of ‘lsass’.

16  Injects itself to a specified process (specified in the ShadowPad configuration) and creates/starts a new service (details are
specified in the ShadowPad configuration), which executes the core code.     In addition, if the compromised user belongs to a
group with a SID starting with S-1-5-80 then the specified target process uses the token of ‘lsass’.

Table 1 – ShadowPad Modes
ANALYST NOTE: The shellcode is decrypted using a combination of bitwise XOR operations.

Configuration storage and structure

ShadowPad comes with an embedded encrypted configuration, which it locates by scanning its own shellcode (core module) with the
following method (Python representation):

3/13

for dword in range( len(data) ):

first_value = data[dword :dword+4]

second_value = data[dword+4:dword+8]

third_value = data[dword+8:dword+12]

fourth_value = data[dword+12:dword+16]

fifth_value = data[dword+16:dword+20]

sixth_value = data[dword+20:dword+24]

xor1 = int.from_bytes(second_value,'little') ^ 0x8C4832F1

xor2 = int.from_bytes(fourth_value,'little') ^ 0xC3BF9669

xor3 = int.from_bytes(sixth_value,'little') ^  0x9C2891BA

if xor1 == int.from_bytes(first_value,'little') and xor2 ==    int.from_bytes(third_value,'little') and xor3 == 
int.from_bytes(fifth_value,'little'):

print(f"found: {dword:02x}")

encrypted = data[dword:]

break

After locating it successfully, it starts searching in it for a specified byte that represents the type of data (e.g., 0x02 represents an
embedded module). In total, we have identified the following types:

ID  Description

0x02  Embedded ShadowPad module.

0x80  ShadowPad configuration. It should start with the DWORD value 0x9C9D22EC.

0x90  XOR key used during the generation of unique names (e.g., registry key name)

0x91  DLL loader file data.

0x92  DLL loader file to load. File might have random appended data (Depends on the config’s flag at offset 0x326).

0xA0  Loader’s filepath

Table 2 – Shadowpad Data Types 
Once one of the above bytes are located, ShadowPad reads the data (size is defined before the byte identifier) and appends the last
DWORD value to the hardcoded byte array ‘1A9115B2D21384C6DA3C21FCCA5201A4’. Then it hashes (MD5) the constructed byte array
and derives an AES-CBC 128bits key and decrypts the data.

In addition, ShadowPad stores, in an encrypted format, the following data in the registry with the registry key name being unique (based
on volume serial number of C:\) for each compromised host:

1. ShadowPad configuration (0x80) data. 
2. Proxy configuration. Includes proxy information that ShadowPad requires. These are the network communication protocol, domain/IP
proxy and the proxy port. 
3. Downloaded modules.

ShadowPad Network Servers

ShadowPad starts two TCP/UDP servers at 0.0.0.0. The port(s) is/are specified in the ShadowPad configuration. These servers work as a
proxy between other compromised hosts in the network.

In addition, ShadowPads starts a raw socket server, which receives data and does one of the following tasks (depending on the received
data):

1. Updates and sets proxy configuration to SOCKS4 mode. 
2. Updates and sets proxy configuration to SOCKS5 mode. 
3. Updates and sets proxy configuration to HTTP mode.

Network Communication

ShadowPad supports a variety of network protocols (supported by dedicated modules). For all of them, ShadowPad uses the same
procedure to store and encrypt network data. The procedure’s steps are:

1. Compress the network data using the QuickLZ library module. 
2. Generates a random DWORD value, which is appended to the byte array                  ‘1A91
Then, the constructed byte array is        hashed (MD5) and an AES-CBC 128bits key is derived (CryptDeriveKey). 
15B2D21384C6DA3C21FCCA5201A4’.

4/13

3. The data is then encrypted using the generated AES key
XOR operations:

1. Command/Module ID:  Command/Module ID ^  ( 0x1FFFFF * Hashing_Key – 0x2C7BEECE ) 
2. Data_Size: Data_Size ^ ( 0x1FFFFFF * 0x7FFFFF * ( 0x1FFFFF * Hashing_Key – 0x2C7BEECE ) – 0x536C9757 – 0x7C06303F )  
3. Command_Execution_State: Command_Execution_State ^ 0x7FFFFF * (0x1FFFFF * Hashing_Key – 0x2C7BEECE) – 0x536C9757

As a last step, ShadowPad encapsulates the above generated data into the following        structure:

struct Network_Packet 
{ 
DWORD Hashing_Key; 
DWORD Command_ID_Module_ID; 
DWORD Command_Execution_State; //Usually contains any error codes. 
DWORD Data_Size;

byte data[Data_Size]; 
};

If any server responds, it should have the same format as above.

Network Commands and Modules

During our analysis, we managed to extract a variety of ShadowPad modules with most of them having their own set of network
commands. The table below summarises the identified commands of the modules, which we managed to recover.

Module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Main module

Files manager module

Command ID

0xC49D0031

0xC49D0032

0xC49D0033

0xC49D0032

0xC49D0034

0xC49D0037

0xC49D0039

0xC49D0016

0xC49D0035

0xC49D0036

0xC49D0010

0xC49D0012

0xC49D0014

0xC49D0015

0xC49D0020

0xC49D0021

0xC49D0022

0xC49D0050

0xC49D0051

0xC49D0052

0xC49D0053

Any Module ID

0x67520006

. In addition, Shadowpad        encrypts the following data fields using bitwise

Description

First command sent to the C2 if the commands fetcher function does not run in a
dedicated thread.

First command sent to the C2 if the commands fetcher function does run in a
dedicated thread.

Fingerprints the compromised host and sends the information to the C2.

(Received) Executes the network command fetcher function in a thread.

Sents an empty reply to the C2.

Echoes the server’s reply.

Sends number of times the Shadowpad files were detected to be deleted.

Deletes Shadowpad registry keys.

Enters sleep mode for 3 seconds in total.

Enters sleep mode for 5 seconds in total.

Retrieves Shadowpad execution information.

Updates Shadowpad configuration (in registry).

Deletes Shadowpad module from registry.

Unloads a Shadowpad module.

Retrieves Shadowpad current configuration (from registry).

Updates the Shadowpad configuration in registry and (re)starts the TCP/UDP
servers.

Deletes Shadowpad registry entries and starts the TCP/UDP servers.

Retrieves Shadowpad proxy configuration from registry.

Updates Shadowpad proxy configuration.

Updates Shadowpad proxy configuration by index.

Sets Shadowpad proxy configuration bytes to 0

Loads and initialises the specified module ID.

File operations (copy,delete,move,rename).

5/13

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

Files manager module

TCP/UDP module

TCP/UDP module

Desktop module

Desktop module

Desktop module

Desktop module

Desktop module

Desktop module

Processes manager
module

Processes manager
module

Network Connections
module

Network Connections
module

PIPEs module

Propagation module

Propagation module

Propagation module

Propagation module

Propagation module

Propagation module

Propagation module

Propagation module

Propagation module

Scheduled tasks module

Scheduled tasks module

Wi-Fi stealer module

Network discovery
module

0x67520007

0x67520008

0x6752000A

0x6752000C

0x67520005

0x67520000

0x67520001

0x67520002

0x67520003

0x67520004

0x54BD0000

0x54BD0001

0x62D50000

0x62D50001

0x62D50002

0x62D50010

0x62D50011

0x62D50012

0x70D0000

0x70D0001

0x6D0000

0x6D0001

0x23220000

0x2C120010

0x2C120011

0x2C120012

0x2C120013

0x2C120014

0x2C120015

0x2C120016

0x2C120017

0x2C120018

0x71CD0000

0x71CD0001

0xDC320000

0xF36A0000

Executes a file.

Uploads/Downloads file to/from C2.

Searches for a specified file.

Downloads a file from a specified URL.

Timestomp a file.

Get logical drives information.

Searches recursively for a file.

Checks if file/directory is writable.

Creates a directory.

Gets files list in a given directory

Loads TCP module and proxy data via it.

Proxies UDP network data.

Enumerates monitors.

Takes desktop screenshot.

Captures monitor screen.

Gets desktop module local database file path.

Reads and sends the contents of local database file to the C2.

Writes to local database file and starts a thread that constantly takes desktop
screenshots.

Gets processes list along with their information

Terminates a specified process

Gets TCP network table.

Gets UDP network table.

Reads/Writes data to PIPEs.

Get module’s configuration.

Transfer network data between C2 and PIPEs.

Constant transfer of network data between C2 and PIPEs.

Transfer network data between C2 and PIPEs.

Constant transfer of network data between C2 and PIPEs.

Transfer network data between C2 and PIPEs.

Constant transfer of network data between C2 and PIPEs.

Transfer network data between C2 and PIPEs.

Transfer network data between C2 and PIPEs.

Gets a list of the scheduled tasks.

Gets information of a specified scheduled task.

Collects credentials/information of available Wi-Fi devices.

Collects MAC addresses.

6/13

Network discovery
module

Network discovery
module

Console module

Keylogger module

Keylogger module

0xF36A0001

0xF36A0003

0x329A0000

0x63CA0000

0x63CA0001

Table 3 – Modules Network Commands 
Below are listed the available modules, which do not have network commands (T

Module ID

E8B5

7D82

C7BA

Table 4 – Available modules without network commands 
Below are listed the modules that we identified after analysing the main module of ShadowPad but were not recovered.

Module ID

0x25B2

0x1FE2

0x9C8A

0x92CA

0x64EA

Table 5 – Non-Recovered ShadowPad Modules
Misc

1. ShadowPad uses a checksum method to compare certain values (e.g., if it runs under        certain access rights). This method has
been implemented below in Python:

Description

QUICKLZ library module.

Sockets connection module (supports SOCKS4, SOCKS5 and HTTP).

TCP module.

Description

UDP network module.

HTTP network module.

HTTPS network module.

ICMP network module

Unknown

ror = lambda val, r_bits, max_bits: \

((val & (2**max_bits-1)) >> r_bits%max_bits) | \ 
(val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1)) 
rounds = 0x80

data = b""

output = 0xB69F4F21

max_bits = 32

counter = 0

for i in range( len(data) ):

data_character = data[counter]

if (data_character - 97)&0xff <= 0x19:

data_character &= ~0x20&0xfffffff

counter +=1

output = (data_character + ror(output, 8,32)) ^ 0xF90393D1 
 print ( hex( output ))

Under certain modes, ShadowPad chooses to download and inject a payload from its        command-and-control server
parses its command-and-control server        domain/IP address and sends a HTTP request. The reply is expected to be a payload,
       which ShadowPad injects into another process.

ANALYST NOTE: In case the IP address/Domain includes the character ‘@’, 
algorithm.

Indicators of Compromise

Collects IP addresses information.

Port scanning.

Starts a console mode in the compromised host.

Reads the keylogger file and sends its content to the C2.

Deletes keylogger file.

able 3).

. ShadowPad

ShadowPad decrypts it with a custom

7/13

IOC

C:\wso2is-4.6.0\BVRPDiag.exe

C:\wso2is-4.6.0\BVRPDiag.tsi

C:\wso2is-4.6.0\BVRPDiag.dll

C:\wso2is-4.6.0\ModemMOH.dll

C:\Windows\System32\spool\drivers\color\K7AVWScn.dll

C:\Windows\System32\spool\drivers\color\K7AVWScn.doc

C:\Windows\System32\spool\drivers\color\K7AVWScn.exe

C:\Windows\System32\spool\drivers\color\secur32.dll

C:\Windows\System32\spool\drivers\color\secur32.dll.dat

C:\Windows\System32\spool\drivers\color\WindowsUpdate.exe

C:\Windows\Temp\WinLog\secur32.dll

C:\Windows\Temp\WinLog\secur32.dll.dat

C:\Windows\Temp\WinLog\WindowsEvents.exe

C:\ProgramData\7z.dll

C:\ProgramData\7z.exe

C:\Users\Public\AdFind.exe

C:\Users\Public\nbtscan.exe

C:\Users\Public\start.bat

Indicator Description
Type

File Legitimate
Path executable to
sideload
PoisonIvy

File  
Path

File PoisonIvy
Path

File
Path

File Previously
Path undocumented
C2 framework

File Unknown file in
Path the same
location as
PosionIvy

File Legitimate
Path executable to
sideload
PoisonIvy

File ShadowPad
Path DLL

File ShadowPad
Path Encrypted
Configuration

File Legitimate
Path executable to
sideload
ShadowPad

File ShadowPad
Path DLL

File ShadowPad
Path Encrypted
Configuration

File Legitimate
Path executable to
sideload
ShadowPad

File Archiving tool
Path

File Archiving tool
Path

File Reconnaissance
Path tooling

File Reconnaissance
Path tooling

File Unknown batch
Path script,
suspected to
start execution
of mimikatz

8/13

C:\Users\Public\t\64.exe File
Path

C:\Users\Public\t\7z.exe File
Path

C:\Users\public\t\browser.exe File
Path

C:\Users\Public\t\nircmd.exe File
Path

C:\users\public\t\test.bat File
Path

C:\Users\Public\test.bat File
Path

C:\Users\Public\test.exe File
Path

C:\Users\Public\test\Active Directory\ntds.dit File
Path

C:\Users\Public\test\registry\SECURITY File
Path

C:\Users\Public\test\registry\SYSTEM File
Path

C:\Users\Public\WebBrowserPassView.exe File
Path

C:\Windows\debug\adprep\P.bat File
Path

C:\Windows\system32\spool\drivers\affair.exe File
Path

C:\Windows\System32\spool\drivers\color\SessionGopher.ps1 File
Path

C:\windows\system32\spool\drivers\color\tt.bat File
Path

C:\Windows\Temp\best.exe File
Path

ip445.ps1 File
Name

Unknown
executable,
suspected
mimikatz

Archiving tool

Unknown
attacker
executable

NirCmd is a
small command-
line utility that
allows you to do
some useful
tasks without
displaying any
user interface.

Unknown
attacker batch
script

Unknown
attacker batch
script

Unknown
attacker
executable

Staging location
for NTDS dump

Staging location
for registry
dump

Staging location
for registry
dump

NirSoft tool for
recovering
credentials from
web browsers.

Unknown
attacker batch
script

Unknown
attacker
executable

Decrypts saved
session
information for
remote access
tools.

Unknown
attacker batch
script

Tree.exe

Unknown
PowerShell
script suspected
to be related to
network
reconnaissance

9/13

ip445.txt

nbtscan.exe

SOFTWARE: Classes\CLSID\*\42BF3891

SOFTWARE: Classes\CLSID\*\45E6A5BE

SOFTWARE: Classes\CLSID\*\840EE6F6

SOFTWARE: Classes\CLSID\*\9003BDD0

Software:Classes\CLSID\*\51E27247

Software\Microsoft\*\*\009F24BCCEA54128C2344E03CEE577E12504DD569C8B48AB8B7EAD5249778643

Software\Microsoft\*\*\5F336A90564002BE360DF63106AA7A7568829C6C084E793D6DC93A896C476204

Software\Microsoft\*\*\FF98EFB4C7680726BF336CEC477777BB3BEB73C7BAA1A5A574C39E7F4E804585

D1D0E39004FA8138E2F2C4157FA3B44B

54B419C2CAC1A08605936E016D460697

B426C17B99F282C13593954568D86863

7504DEA93DB3B8417F16145E8272BA08

D99B22020490ECC6F0237EFB2C3DEF27

1E6E936A0A862F18895BC7DD6F607EB4

A6A19804248E9CC5D7DE5AEA86590C63

4BFE4975CEAA15ED0031941A390FAB55

87F9D1DE3E549469F918778BD637666D

8E9F8E8AB0BEF7838F2A5164CF7737E4

Mitre Att&ck

Tactic Technique ID Description

File Suspected
Name output file for
ip445.ps1

File Attacker tooling
Name

Registry Encrypted
Key ShadowPad
configuration

Registry Encrypted
Key ShadowPad
configuration

Registry Encrypted
Key ShadowPad
configuration

Registry Encrypted
Key ShadowPad
configuration

Registry Encrypted
Key ShadowPad
configuration

Registry Encrypted
Key ShadowPad
module

Registry Encrypted
Key ShadowPad
module

Registry Encrypted
Key ShadowPad
module

MD5 PoisenIvy DLL
Hash

MD5 Undocumented
Hash backdoor DLL

MD5 Undocumented
Hash backdoor
related file

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

MD5 ShadowPad
Hash DLL

10/13

Initial Exploit Public-Facing
Access Applications

Execution Command and
Scripting Interpreter:
PowerShell

Execution Command and
Scripting Interpreter:
Windows Command
Shell

Execution Command and
Scripting Interpreter:
Python

Execution Scheduled Task/Job:
Scheduled Task

Execution Exploitation for Client
Execution

Execution Windows
Management
Instrumentation
(WMI)

Persistence Boot or Logon
Autostart Execution:
Registry Run Keys /
Startup Folder

Persistence Create or Modify
System Process:
Windows Service

Privilege Valid Accounts:
Escalation Domain Accounts

Defence Impair Defenses:
Evasion Downgrade Attack

Defence Indicator Removal on
Evasion Host: File Deletion

Defence Indicator Removal on
Evasion Host: Timestomp

Defence Modify Registry
Evasion

Defence Obfuscated Files or
Evasion Information

Defence Masquerading:
Evasion Rename System
Utilities

Defence Process Injection:
Evasion Process Hollowing

Defence Hide Artefacts:
Evasion Hidden Files and
Directories

Defence Hijack Execution
Evasion Flow: DLL Search
Order Hijacking

T1190 Initial access was gained via the threat actor exploiting CVE-2022-29464 to create a
web shell

T1059:001 PowerShell based tools PowerView and SessionGopher were executed across the
estate for reconnaissance and credential harvesting. Additionally, hands on keyboard
commands were identified as being executed to confirm which version of the
malware was present.

T1059:003 A scheduled task used by the threat actor was used to launch a Windows Command
Shell. The purpose is not known.

T1059:006 Several compiled python binaries were identified. It is likely the binaries related to the
creation of an FTP server.

T1053 A scheduled task named “update” was observed and configured to execute a
command prompt on multiple hosts throughout the environment. Upon successful
execution of the task the threat actor then deleted the task from the host

T1203 The threat actor leveraged CVE-2022-29464 to deploy web shells and allow remote
command execution on patient zero.

T1047 WMI was used by the threat actor to carry out reconnaissance activity.

T1547.001 A run key for the local administrator was created to execute the malicious backdoor.

T1543.003 Two malicious services were deployed widely across the estate for persistence of the
backdoors. Both services execute a legitimate binary which is stored in the same
location as a malicious DLL, when executed the legitimate binary would side load the
malicious DLL containing the backdoor.

T1078.002 The threat actor was primarily using domain administrator credentials to move
laterally throughout the attack, allowing them to blend in with legitimate administrator
activity.

T1562.010 The threat actor was observed utilising PowerShell downgrades, this is typically used
by threat actors to avoid the script logging capabilities of PowerShell version 5+

T1070.004 The threat actor routinely removed the majority of tooling deployed throughout the
attack from hosts upon completion of their objectives.

T1070.006 The threat actor timestomped all files relating to the backdoors including the
legitimate binary and the malicious DLL.

T1112 The modules for ShadowPad were stored within the registry in an encrypted format.
The keys for the stored data are generated depending on the volume serial number
of the host.

T1027 The ShadowPad configuration was stored within an encrypted registry hive. The
keylogger module of ShadowPad created an encrypted output file on the host.

T1036.003 The threat actor leveraged a legitimate Windows DLL, secur32.dll, as the name of
the configuration file for the ShadowPad backdoor.

T1055.012 Upon execution ShadowPad spawns a sacrificial process, which then utilises the
technique of process hollowing to inject into the process.

T1564.001 Several malicious files were identified as having the NTFS attribute of hidden.

T1574.001 The backdoors leveraged DLL Search Order Hijacking.

11/13

Credential Credentials from
Access Password Stores:
Credentials from
Web Browsers

Credential Credentials from
Access Password Stores:
Windows Credential
Manager

Credential OS Credential
Access Dumping: LSASS
Memory

Credential OS Credential
Access Dumping: NTDS

Credential Unsecured
Access Credentials:
Credentials in Files

Credential Input Capture:
Access Keylogging

Discovery File and Directory
Discovery

Discovery Network Share
Discovery

Discovery System Network
Configuration
Discovery

Discovery Account Discovery:
Domain Account

Discovery Domain Trust
Discovery

Discovery Permission Groups
Discovery: Domain
Groups

Discovery Remote System
Discovery

Lateral Remote Services:
Movement Remote Desktop
Protocol

Lateral Remote Services:
Movement SMB/Windows
Admin Shares

Lateral Remote Services:
Movement Windows Remote
Management

Lateral Remote Services:
Movement Distributed
Component Object
Model

Collection Automated
Collection

Collection Data Staged:
Remote Data
Staging

Collection Input Capture:
Keylogging

T1555:003 The NirSoft tool WebBrowserPassView.exe was also identified as being executed by
the attacker.

T1555.004 Credential harvesting which indicated credentials from Windows Credential Manager
were collected was identified on a domain controller.

T1003.001 ProcDump.exe was leveraged on patient zero during the attack in order to dump
credentials stored in the process memory of Local Security Authority Subsystem
Service (LSASS).

T1003.003 The NTDS.dit was dumped and exfiltrated from a domain controller for each domain.

T1552.001 Several instances of passwords in plaintext files were observed on hosts where
ShadowPad was installed/

T1056:001 ShadowPad instances had a Keylogger module installed.

T1083 Tree.exe was used to enumerate files and directories on compromised hosts.

T1135 A PowerShell script named ip445.ps1 was used throughout the attack to enumerate
network shares across the Windows estate.

T016 AdFind.exe can extract subnet information from Active Directory.

T1087.002 AdFind.exe can enumerate domain users.

T1482 AdFind.exe can gather information about organizational units (OUs) and domain
trusts from Active Directory.

T1069 AdFind.exe can enumerate domain groups.

T1018 AdFind.exe has the ability to query Active Directory for computers.

T1021.001 RDP was used by the threat actor to laterally move. It is unknown whether this was a
deliberate act to move estates or if the threat actor was attempting to move to
another domain.

T1021.002 The Powerview module of Powersploit was used to enumerate all SMB shares
across the environment.

T1021.006 WinRM was used by the actor during periods of network reconnaissance.

T1021.003 Anti-virus alerts showed the threat actor as utilising WMI to laterally move to hosts
across the network.

T1119 Large scale credential harvesting was conducted against remote hosts from a
domain controller.

T1074.002 Credentials harvested by the threat actor were collected on a domain controller, prior
to exfiltration.

T1056.001 ShadowPad instances had a Keylogger module installed which allowed them to
capture the input of interactive sessions. The output was stored on disk in encrypted
database files.

12/13

Collection Archive Collected
Data: Archive via
Utility

Command Encrypted Channel
and Control

Command Proxy: Internal Proxy
and Control

Exfiltration Exfiltration Over C2
Channel

[1] https://www.secureworks.com/research/shadowpad-malware-analysis

[2] https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html

[3] https://nvd.nist.gov/vuln/detail/CVE-2022-29464

T1560.001 The actor was routinely observed archiving collected data via 7zip.

T1573 ShadowPad configurations indicated Command and Control communications were
sent via port 443.

T1090.001 ShadowPad instances had a Proxy module installed. It was identified that a proxy
module was installed and was interacting via port 445.

T1041 ShadowPad has the capability to exfiltrate data.

13/13