Patchwork apparently altered

NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Patchwork removed certain files and replaced them so they could not be retrieved.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Patchwork has obfuscated a script with Crypto Obfuscator.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Patchwork apparently altered

NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|A

Patchwork file stealer can run a TaskScheduler DLL to add persistence.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Patchwork developed a file stealer to search C:\ and collect files with certain extensions.