Top 3 Most Popular Malware TTPs of the Past Year

Cyber threats evolve rapidly, but some tactics stand out for their widespread use and effectiveness. In its latest 2024 trends report, ANY.RUN identified the top malware Tactics, Techniques, and Procedures (TTPs) employed by cyber attackers for malicious purposes.

Let’s dive into the three most notable TTPs, exploring their methodologies and real-world examples within an interactive sandbox.

1. Command and Scripting Interpreter: PowerShell and CMD

TTPs: T1059.001 (PowerShell) and T1059.003 (CMD)

PowerShell and Command Prompt (CMD) are powerful tools built into Windows systems, widely used for legitimate administrative and scripting purposes. However, threat actors exploit these interpreters to execute malicious commands and scripts, making them key components in many cyberattacks.

Why it’s effective:

These tools are trusted by the operating system, enabling attackers to bypass security measures. They allow direct execution of commands, download and execution of payloads, and manipulation of files and processes, all without requiring external executables.

How attackers use it:

Attackers exploit PowerShell and CMD to execute commands, automate malicious actions, and evade detection.

1. Execution of malicious scripts: Attackers use PowerShell to run scripts directly in memory, avoiding detection and bypassing antivirus software. CMD is used to execute batch commands, manipulate files, or establish network connections.
2. Living Off the Land (LOLBins): By using trusted tools like PowerShell and CMD, attackers blend malicious activity with legitimate system operations, reducing the need for external malware.
3. Obfuscation and automation: Scripts are often obfuscated to evade detection and automate tasks like lateral movement or data exfiltration.

Let’s take a closer look at how attackers exploit PowerShell and CMD in a secure, controlled environment using ANY.RUN’s malware analysis sandbox. This example highlights how a seemingly harmless document can trigger a chain of malicious events.

View analysis session

A phishing email contains a password-protected ZIP file with an attached document. The document, disguised as an “Invoice,” instructs the user to enable macros. 

Upon enabling macros, the following occurs:

1.PowerShell or CMD execution: An embedded macro calls a PowerShell script.

2.Payload delivery: The script downloads a malicious file from a remote server filetransfer[.]io.

3.Payload execution: The downloaded file is executed, initiating further malicious activity.

Analyze malware tactics in a secure, interactive environment. Get your 14-day free trial of ANY.RUN today!

2. Virtualization/Sandbox Evasion: Time-Based

TTP: T1497.003

Time-based evasion is a technique where malware introduces deliberate delays to avoid detection in sandbox environments. By “sleeping” for a specific period, malware attempts to outlast the short runtime of many automated analysis systems, ensuring its malicious activity goes unnoticed.

Why it’s effective:

Sandboxes often operate on time constraints, running malware for a limited duration to observe its behavior. By introducing delays, malware can stall its execution, appearing inactive until the analysis window has passed. This technique effectively conceals malicious intent in environments designed to detect threats.

How attackers use it:

Attackers use time-based evasion to bypass sandbox detection by:

• Delaying execution of malicious actions using sleep commands.
• Stalling specific processes to avoid triggering alarms during the initial sandbox runtime.
• Combining time delays with other evasion techniques, such as obfuscation, to further complicate analysis.

In the following analysis, DarkCrystal RAT uses a sleep command to introduce a delay of 10 seconds before proceeding to the next stage of its attack. This tactic helps it avoid triggering sandbox detections that operate within short time frames.

View sandbox session

The sleep command (10000 milliseconds) aligns with the RAT’s strategy to evade short-lived analysis environments. However, ANY.RUN’s sandbox could easily detect this threat.

3. Masquerading: Legitimate Binary Execution

TTP: Т1036.003

Masquerading is a technique where attackers disguise malicious files as legitimate executables to bypass detection. By manipulating trusted system binaries, malware blends into normal operations, avoiding scrutiny by security tools and system administrators.

Why it’s effective:

• Legitimate binaries are trusted by the operating system and security software.
• Antivirus solutions and system permissions often overlook such files unless unusual behavior is detected.
• By mimicking known processes, malware can avoid raising immediate red flags.

How attackers use it:

Attackers often copy and rename legitimate files into locations like %temp%, altering their behavior with injected malicious code. These renamed binaries can then be executed without needing elevated privileges, evading both system and user-level checks.

Let’s examine how Lokibot malware uses masquerading in a controlled environment with ANY.RUN’s malware analysis sandbox.

View analysis session

There is a legitimate system file: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe. Lockbit uses this file for its purposes by copying it to the directory C:\Users\admin\AppData\Roaming\F3F363\ and renaming it to 3C28B3.exe. 

This allows the malware to execute the file with injected code because running files from the Windows system directory requires privileges that may not be available. Additionally, antivirus software closely monitors activity in system directories.

On the other hand, temporary folders, like %temp%, are considered less secure, making them convenient for such malicious operations. As a result, 3C28B3.exe is simply a renamed and modified version of RegSvcs.exe that the malware uses for its malicious actions.

Remember that all the TTPs of a specific analysis session can be easily accessed by clicking the “ATT&CK” button in the top-right corner of ANY.RUN’s sandbox interface.

Identify TTPs Faster with ANY.RUN

Detecting relevant TTPs helps you understand what attackers are doing giving you the tools to strengthen your defenses and act fast when threats arise.

With ANY.RUN, spotting these tactics is easier and faster. The interactive sandbox maps TTPs in real time, so you can see exactly how an attack unfolds. Tools like the ATT&CK feature make it simple to connect the dots and stay a step ahead.

See it in action, Get your 14-day free trial of ANY.RUN today!