Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.(Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

Patchwork has used BITS jobs to download malicious payloads.(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Patchwork used Visual Basic Scripts (VBS) on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Patchwork encrypted the collected files' path with AES and then encoded them with base64.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|A

Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|A

Patchwork .dll that contains

BADNEWS is loaded and executed using DLL side-loading.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

Patchwork leveraged the DDE protocol to deliver their malware.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|