Hikit

Hikit is malware that has been used by Axiom for late-stage persistence and exfiltration after the initial compromise.^[1]^[2]

ID: S0009

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Contributors: Christopher Glyer, Mandiant, @cglyer

Version: 1.3

Created: 31 May 2017

Last Modified: 20 March 2023

Techniques Used

Domain	ID		Name	Use
Enterprise	T1014		Rootkit	Hikit is a Rootkit that has been used by Axiom.^[2] ^[3]
Enterprise	T1005		从本地系统获取数据	Hikit can upload files from compromised machines.^[1]
Enterprise	T1090	.001	代理: Internal Proxy	Hikit supports peer connections.^[1]
Enterprise	T1573	.001	加密通道: Symmetric Cryptography	Hikit performs XOR encryption.^[1]
Enterprise	T1574	.001	劫持执行流: DLL Search Order Hijacking	Hikit has used DLL Search Order Hijacking to load `oci.dll` as a persistence mechanism.^[2]
Enterprise	T1059	.003	命令与脚本解释器: Windows Command Shell	Hikit has the ability to create a remote shell and run given commands.^[3]
Enterprise	T1071	.001	应用层协议: Web Protocols	Hikit has used HTTP for C2.^[3]
Enterprise	T1105		输入工具传输	Hikit has the ability to download files to a compromised host.^[1]
Enterprise	T1566		钓鱼	Hikit has been spread through spear phishing.^[1]
Enterprise	T1553	.004	颠覆信任控制: Install Root Certificate	Hikit installs a self-generated certificate to the local trust store as a root CA and Trusted Publisher.^[4]
		.006	颠覆信任控制: Code Signing Policy Modification	Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.^[3]

ID	Name	References
G0001	Axiom	^[1]^[5]