menuPass

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.^[12][13][8]

menuPass has collected various files from the compromised computers.^[1][8]

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.^[6]

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.^[10]

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.^{[12][7][8][1][2]}

menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.^[14]

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.^[9][10]

menuPass has encrypted files and information before exfiltration.^[1][2]

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.^[8]

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.^{[6][8][2][14]}

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.^[8]

menuPass has used net use to conduct connectivity checks to machines.^[6]

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.^[12]

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.^[12]

menuPass has used the Csvde tool to collect Active Directory files and data.^[8]

menuPass has installed updates and new malware on victims.^[6][2]

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).^[8]

menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.^[12][7]