Higaisa

Targets

Sectors: Government

Regions: Japan

Known techniques

• T1001.003Protocol or Service Impersonation
• T1016System Network Configuration Discovery
• T1027.001Binary Padding
• T1027.013Encrypted/Encoded File
• T1027.015Compression
• T1029Scheduled Transfer
• T1036.004Masquerade Task or Service
• T1041Exfiltration Over C2 Channel
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.007JavaScript
• T1071.001Web Protocols
• T1082System Information Discovery
• T1090.001Internal Proxy
• T1106Native API
• T1124System Time Discovery
• T1140Deobfuscate/Decode Files or Information
• T1203Exploitation for Client Execution
• T1204.002Malicious File
• T1220XSL Script Processing
• T1547.001Registry Run Keys / Startup Folder
• T1564.003Hidden Window
• T1566.001Spearphishing Attachment
• T1573.001Symmetric Cryptography
• T1574.001DLL
• T1680Local Storage Discovery

Malware and tools used