Open Hunting - Threat Library

Openhunting Threat Library

H1N1 Loader

H1N1 Loader, H1N1

(Type: Loader)

(Cisco) H1N1 is a loader malware variant that has been known to deliver Pony DLLs and Vawtrak executables to infected machines. Upon infection, H1N1 previously only provided loading and system information reporting capabilities.

[News Analysis] Trends:

Total Trend: 1

Trend Per Year

2016

Trend Per Month

Sep 2016

[News Analysis] News Mention Another Threat Name:

[TTP Analysis] Technique Performance:

reconnaissance

0/43

resource development

0/45

initial access

1/19

execution

1/36

persistence

0/113

privilege escalation

1/96

defense evasion

5/184

credential access

1/63

discovery

0/44

lateral movement

2/22

collection

0/37

command and control

3/39

exfiltration

0/18

impact

1/26

[TTP Analysis] Mitre Attack Matrix:

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
		T1091 Replication Through Removable Media	T1059.003 Command And Scripting Interpreter : Windows Command Shell		T1548.002 Abuse Elevation Control Mechanism : Bypass User Account Control	T1548.002 Abuse Elevation Control Mechanism : Bypass User Account Control T1562.001 Impair Defenses : Disable Or Modify Tools T1562.004 Impair Defenses : Disable Or Modify System Firewall T1027 Obfuscated Files Or Information T1027.002 Obfuscated Files Or Information : Software Packing	T1555.003 Credentials From Password Stores : Credentials From Web Browsers		T1091 Replication Through Removable Media T1080 Taint Shared Content		T1132 Data Encoding T1573.001 Encrypted Channel : Symmetric Cryptography T1105 Ingress Tool Transfer		T1490 Inhibit System Recovery

[Infrastructure Analysis] Based on Related IOC:

IP:Port	Timestamp

Domain	Timestamp

URL	Timestamp

[Target Analysis] Region/Sector:

No information

References:

News Basic Information Indicator of Compromise Mitre Attack

News Article (Credit @Malpedia)

H1N1: Technical analysis reveals new capabilities

2016-09-13 by Josh Reynolds from Cisco

Basic Information (Credit @etda.or.th)

Tool: H1N1 Loader

Names: H1N1 Loader, H1N1

Description: (Cisco) H1N1 is a loader malware variant that has been known to deliver Pony DLLs and Vawtrak executables to infected machines. Upon infection, H1N1 previously only provided loading and system information reporting capabilities.

Category: Malware

Type: Loader

Information: https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities

Mitre-attack: https://attack.mitre.org/software/S0132/

Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.h1n1

Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:H1N1

Last-card-change: 2020-04-23

Source: https://apt.etda.or.th/cgi-bin/listtools.cgi

TTP Info (Credit @Mitre)

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
		T1091 REPLICATION THROUGH REMOVABLE MEDIA h1n1 has functionality to copy itself to removable media.	T1059.003 COMMAND AND SCRIPTING INTERPRETER : WINDOWS COMMAND SHELL h1n1 kills and disables services by using cmd.exe.		T1548.002 ABUSE ELEVATION CONTROL MECHANISM : BYPASS USER ACCOUNT CONTROL h1n1 bypasses user access control by using a dll hijacking vulnerability in the windows update standalone installer (wusa.exe).	T1548.002 ABUSE ELEVATION CONTROL MECHANISM : BYPASS USER ACCOUNT CONTROL h1n1 bypasses user access control by using a dll hijacking vulnerability in the windows update standalone installer (wusa.exe). T1562.001 IMPAIR DEFENSES : DISABLE OR MODIFY TOOLS h1n1 kills and disables services for windows security center, and windows defender. T1562.004 IMPAIR DEFENSES : DISABLE OR MODIFY SYSTEM FIREWALL h1n1 kills and disables services for windows firewall. T1027 OBFUSCATED FILES OR INFORMATION h1n1 uses multiple techniques to obfuscate strings, including xor. T1027.002 OBFUSCATED FILES OR INFORMATION : SOFTWARE PACKING h1n1 uses a custom packing algorithm.	T1555.003 CREDENTIALS FROM PASSWORD STORES : CREDENTIALS FROM WEB BROWSERS h1n1 dumps usernames and passwords from firefox, internet explorer, and outlook.		T1091 REPLICATION THROUGH REMOVABLE MEDIA h1n1 has functionality to copy itself to removable media. T1080 TAINT SHARED CONTENT h1n1 has functionality to copy itself to network shares.		T1132 DATA ENCODING h1n1 obfuscates c2 traffic with an altered version of base64. T1573.001 ENCRYPTED CHANNEL : SYMMETRIC CRYPTOGRAPHY h1n1 encrypts c2 traffic using an rc4 key. T1105 INGRESS TOOL TRANSFER h1n1 contains a command to download and execute a file from a remotely hosted url using wininet http requests.		T1490 INHIBIT SYSTEM RECOVERY h1n1 disable recovery options and deletes shadow copies from the victim.