MalwareExploits 2 CVEs

Thor.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2020-1472Zerologon

Thor.dll This DLL attempts to authenticate with credentials from the previous Zerologon dump and create domain accounts attempting to masquerade as healthmailbox accounts. It also creates a role-based access control (RBAC) assignment within Exchange that gives it the ApplicationImpersonation role built into Microsoft Exchange.

via fortinet threat researchfortinet.com

CVE-2021-34473ProxyShell pre-auth path confusion in Microsoft Exchange Server

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

FortiGuard Labs recently discovered an unidentified threat actor leveraging ProxyShell exploits... web shells created from ProxyShell vulnerabilities.

Persistence

2 techniques

T1136Create AccountEvidence1

This DLL is used to authenticate to the domain, modify security permissions, create domain accounts... Thor.dll attempts to authenticate with credentials from the previous Zerologon dump and create domain accounts attempting to masquerade as healthmailbox accounts.

T1505.003Web ShellEvidence1

Exploit details, from the directories to the types of web shells used, matched almost verbatim. The difference was when web shells performed post-exploitation activity via DLLs loaded into memory...

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

FortiEDR detected these DLLs because they loaded into memory space allocated for vbc.exe... The figure below shows w3wp.exe injecting a thread into the vbc.exe process

Stealth

2 techniques

T1036MasqueradingEvidence1

create domain accounts attempting to masquerade as healthmailbox accounts.

T1055Process InjectionEvidence1

FortiEDR detected these DLLs because they loaded into memory space allocated for vbc.exe... The figure below shows w3wp.exe injecting a thread into the vbc.exe process

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The figure below shows w3wp.exe injecting a remote thread and accessing services on an Exchange server.

Lateral Movement

1 technique

T1550.002Pass the HashEvidence1

The DLLs... were used to perform active reconnaissance, obtain hashed passwords via Zerologon, and perform pass-the-hash authentication to establish persistence via Exchange Application Impersonation.

Collection

1 technique

T1114Email CollectionEvidence1

This allows the actor to access and send email from any mailbox within the environment.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Sep 14, 2021

More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs

A malicious post-exploitation DLL used after ProxyShell compromise to authenticate with dumped credentials, create masquerading domain accounts, assign Exchange ApplicationImpersonation privileges, and establish persistent access to organizational mailboxes.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

Thor.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2020-1472Zerologon

via fortinet threat researchfortinet.com

CVE-2021-34473ProxyShell pre-auth path confusion in Microsoft Exchange Server

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

FortiGuard Labs recently discovered an unidentified threat actor leveraging ProxyShell exploits... web shells created from ProxyShell vulnerabilities.

Persistence

2 techniques

T1136Create AccountEvidence1

T1505.003Web ShellEvidence1

Exploit details, from the directories to the types of web shells used, matched almost verbatim. The difference was when web shells performed post-exploitation activity via DLLs loaded into memory...

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

FortiEDR detected these DLLs because they loaded into memory space allocated for vbc.exe... The figure below shows w3wp.exe injecting a thread into the vbc.exe process

Stealth

2 techniques

T1036MasqueradingEvidence1

create domain accounts attempting to masquerade as healthmailbox accounts.

T1055Process InjectionEvidence1

FortiEDR detected these DLLs because they loaded into memory space allocated for vbc.exe... The figure below shows w3wp.exe injecting a thread into the vbc.exe process

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The figure below shows w3wp.exe injecting a remote thread and accessing services on an Exchange server.

Lateral Movement

1 technique

T1550.002Pass the HashEvidence1

Collection

1 technique

T1114Email CollectionEvidence1

This allows the actor to access and send email from any mailbox within the environment.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Sep 14, 2021

More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.