FIN7 Carbanak: Spear-Phish to Backdoor Intrusion

An account in the accounting team opened a document attachment that should never have reached their inbox. Before you can trace the intrusion forward, establish where that delivery came from.

The document was opened and executed code on the recipient's machine. Identify the workstation where the initial execution occurred.

After executing code on the beachhead, the operator established a mechanism to survive a reboot. Identify the service name used for that persistence.

The implant did not run as its own process. It hid inside a legitimate Windows system process. Name the executable that was injected.

Before moving laterally, the operator staged and ran a credential-harvesting tool against the Windows credential store on the beachhead. Identify its SHA-256 hash.

Armed with domain-admin credentials, the operator moved beyond the beachhead and reached the most sensitive asset in the environment. Identify the internal IP address of the server they pivoted to using PsExec.

Once the operator had access to the financial server, a fresh C2 channel was established from that host to a different external address. Identify it.

Hours into the intrusion, a custom tool ran on the financial server and accessed the organization's SWIFT transaction interface. Identify the SHA-256 hash of that tool.

Throughout this intrusion the operator used a specific technique to hide the backdoor's activity inside a legitimate Windows process. Map that technique to its MITRE ATT&CK identifier.