Article Content FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7 FireEye recently observed a FIN7 spear phishing campaign targeting personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations In a newly-identified campaign, FIN7 modified their phishing techniques to implement unique infection and persistence mechanisms FIN7 has moved away from weaponized Microsoft Office macros in order to evade detection These lures originate from external email addresses that the attacker rarely re-used, and they were sent to various locations of large restaurant chains, hospitality, and financial service organizations The subjects and attachments were themed as complaints, catering orders, or resumes As with previous campaigns, and as highlighted in our annual M-Trends 2017 report, FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process Infection Chain While FIN7 has embedded VBE as OLE objects for over a year, they continue to update their script launching mechanisms In the current lures, both the malicious DOCX and RTF attempt to convince the user to double-click on the image in the document, as seen in Figure 1 Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object By requiring this unique interaction – double-clicking on the image and clicking the “Open” button in the security warning popup – the phishing lure attempts to evade dynamic detection as many sandboxes are not configured to simulate that specific user action This VBScript checks if the “58d2a83f777942.26535794.ps1” PowerShell script is running using WMI queries and, if not, launches it HALFBAKED Backdoor Variant The HALFBAKED malware family consists of multiple components designed to establish and maintain a foothold in victim networks, with the ultimate goal of gaining access to sensitive financial information Click here for more information Example Phishing Lures  Filename: Doc33.docx MD5: 6a5a42ed234910121dbb7d1994ab5a5e   Filename: Mail.rtf MD5: 1a9e113b2f3caa7a141a94c8bc187ea7  FIN7 April 2017 Community Protection Event On April 12, in response to FIN7 actively targeting multiple clients, FireEye kicked off a Community Protection Event (CPE) – a coordinated effort by FireEye as a Service (FaaS), Mandiant, FireEye iSight Intelligence, and our product team – to secure all clients affected by this campaign 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7 FireEye recently observed a FIN7 spear phishing campaign targeting personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations In a newly-identified campaign, FIN7 modified their phishing techniques to implement unique infection and persistence mechanisms FIN7 has moved away from weaponized Microsoft Office macros in order to evade detection These lures originate from external email addresses that the attacker rarely re-used, and they were sent to various locations of large restaurant chains, hospitality, and financial service organizations The subjects and attachments were themed as complaints, catering orders, or resumes As with previous campaigns, and as highlighted in our annual M-Trends 2017 report, FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process Infection Chain While FIN7 has embedded VBE as OLE objects for over a year, they continue to update their script launching mechanisms In the current lures, both the malicious DOCX and RTF attempt to convince the user to double-click on the image in the document, as seen in Figure 1 Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object By requiring this unique interaction – double-clicking on the image and clicking the “Open” button in the security warning popup – the phishing lure attempts to evade dynamic detection as many sandboxes are not configured to simulate that specific user action This VBScript checks if the “58d2a83f777942.26535794.ps1” PowerShell script is running using WMI queries and, if not, launches it HALFBAKED Backdoor Variant The HALFBAKED malware family consists of multiple components designed to establish and maintain a foothold in victim networks, with the ultimate goal of gaining access to sensitive financial information Click here for more information Example Phishing Lures  Filename: Doc33.docx MD5: 6a5a42ed234910121dbb7d1994ab5a5e   Filename: Mail.rtf MD5: 1a9e113b2f3caa7a141a94c8bc187ea7  FIN7 April 2017 Community Protection Event On April 12, in response to FIN7 actively targeting multiple clients, FireEye kicked off a Community Protection Event (CPE) – a coordinated effort by FireEye as a Service (FaaS), Mandiant, FireEye iSight Intelligence, and our product team – to secure all clients affected by this campaign  ### Response: .