Article Content Introduction From January 2018 to March 2018, through FireEye’s Dynamic Threat Intelligence, we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017 This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia When successfully executed, the malicious documents install a backdoor we track as POWERSTATS One of the more interesting observations during the analysis of these files was the re-use of the latest AppLocker bypass, and lateral movement techniques for the purpose of indirect code execution Campaign Timeline In this campaign, the threat actor’s tactics, techniques and procedures (TTPs) shifted after about a month, as did their targets A brief timeline of this activity is shown in Figure 1 Figure 1: Timeline of this recently observed spear phishing campaign The first part of the campaign (From Jan 23, 2018, to Feb 26, 2018) used a macro-based document that dropped a VBS file and an INI file The INI file contains the Base64 encoded PowerShell command, which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe The process chain is shown in Figure 2 One such example of the VBS invoking PowerShell via MSHTA is shown in Figure 3 Figure 3: VBS invoking PowerShell via MSHTA The second part of the campaign (from Feb 27, 2018, to March 5, 2018) used a new variant of the macro that does not use VBS for PowerShell code execution Instead, it uses one of the recently disclosed code execution techniques leveraging INF and SCT files, which we will go on to explain later in the blog Infection Vector We believe the infection vector for all of the attacks involved in this campaign are macro-based documents sent as an email attachment What follows is four examples, and a complete list is available in the Indicators of Compromise section at the end of the blog Figure 5 shows a document purporting to be from the National Assembly of Pakistan Figure 5: Document purporting to be from the National Assembly of Pakistan A document purporting to be from the Turkish Armed Forces, with content written in the Turkish language, is shown in Figure 6 Figure 6: Document purporting to be from the Turkish Armed Forces A document purporting to be from the Institute for Development and Research in Banking Technology (established by the Reserve Bank of India) is shown in Figure 7 Figure 7: Document purporting to be from the Institute for Development and Research in Banking Technology Figure 8 shows a document written in Tajik that purports to be from the Ministry of Internal Affairs of the Republic of Tajikistan Figure 8: Document written in Tajik that purports to be from the Ministry of Internal Affairs of the Republic of Tajikistan Each of these macro-based documents used similar techniques for code execution, persistence and communication with the command and control (C2) server The threat group in this recently observed campaign – TEMP.Zagros – weaponized their malware using the following techniques The macro in the Word document drops three files in a hard coded path: C:\programdata Since the path is hard coded, the execution will only be observed in operating systems, Windows 7 and above DefenderService.inf – The INF file that is used to invoke the above scriptlet file After dropping the three files, the macro will set the following registry key to achieve persistence:  \REGISTRY\USER\SID\Software\Microsoft\Windows\CurrentVersio    n\Run\"WindowsDefenderUpdater" = cmstp.exe /s c:\programdata\DefenderService.inf Upon system restart, cmstp.exe will be used to execute the SCT file indirectly through the INF file This is possible because inside the INF file we have the following section: [UnRegisterOCXSection] %11%\scrobj.dll,NI,c:/programdata/Defender.sct That section gets indirectly invoked through the DefaultInstall_SingleUser section of INF, as shown in Figure 9 Figure 9: Indirectly invoking SCT through the DefaultInstall_SingleUser section of INF This method of code execution is performed in an attempt to evade security products FireEye MVX and HX Endpoint Security technology successfully detect this code execution technique Figure 10: Character replacement and string reversing techniques   PowerShell Environment Variables: Nowadays, malware authors commonly mask critical strings such as “IEX” using environment variables The algorithm used for encryption and decryption is RSA, which leverages the public and private key exponents included in Section 1 of the PowerShell script Section 3 The third section of the PowerShell script is the biggest section and has a wide variety of functionalities During analysis, we observed a code section where a message written in Chinese and hard coded in the script will be printed in the case of an error while connecting to the C2 server:   The English translation for this message is: “Cannot connect to website, please wait for dragon” Figure 16: Reboot, shut down and clean commands  Ability to sleep for a given number of seconds The following table summarizes the main C2 commands supported by this PowerShell Script By combining multiple layers of obfuscation, they deter the process of reverse engineering and also attempt to evade security products Indicators of Compromise Macro based Documents and Hashes     SHA256 Hash   Filename   Targeted Region    eff78c23790ee834f773569b52cddb01dc3c4dd9660f5a476af044ef6fe73894  na.doc     Pakistan    76e9988dad0278998861717c774227bf94112db548946ef617bfaa262cb5e338  Invest in Turkey.doc  Turkey    6edc067fc2301d7a972a654b3a07398d9c8cbe7bb38d1165b80ba4a13805e5ac  güvenlik yönergesi
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Introduction From January 2018 to March 2018, through FireEye’s Dynamic Threat Intelligence, we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017 This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia When successfully executed, the malicious documents install a backdoor we track as POWERSTATS One of the more interesting observations during the analysis of these files was the re-use of the latest AppLocker bypass, and lateral movement techniques for the purpose of indirect code execution Campaign Timeline In this campaign, the threat actor’s tactics, techniques and procedures (TTPs) shifted after about a month, as did their targets A brief timeline of this activity is shown in Figure 1 Figure 1: Timeline of this recently observed spear phishing campaign The first part of the campaign (From Jan 23, 2018, to Feb 26, 2018) used a macro-based document that dropped a VBS file and an INI file The INI file contains the Base64 encoded PowerShell command, which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe The process chain is shown in Figure 2 One such example of the VBS invoking PowerShell via MSHTA is shown in Figure 3 Figure 3: VBS invoking PowerShell via MSHTA The second part of the campaign (from Feb 27, 2018, to March 5, 2018) used a new variant of the macro that does not use VBS for PowerShell code execution Instead, it uses one of the recently disclosed code execution techniques leveraging INF and SCT files, which we will go on to explain later in the blog Infection Vector We believe the infection vector for all of the attacks involved in this campaign are macro-based documents sent as an email attachment What follows is four examples, and a complete list is available in the Indicators of Compromise section at the end of the blog Figure 5 shows a document purporting to be from the National Assembly of Pakistan Figure 5: Document purporting to be from the National Assembly of Pakistan A document purporting to be from the Turkish Armed Forces, with content written in the Turkish language, is shown in Figure 6 Figure 6: Document purporting to be from the Turkish Armed Forces A document purporting to be from the Institute for Development and Research in Banking Technology (established by the Reserve Bank of India) is shown in Figure 7 Figure 7: Document purporting to be from the Institute for Development and Research in Banking Technology Figure 8 shows a document written in Tajik that purports to be from the Ministry of Internal Affairs of the Republic of Tajikistan Figure 8: Document written in Tajik that purports to be from the Ministry of Internal Affairs of the Republic of Tajikistan Each of these macro-based documents used similar techniques for code execution, persistence and communication with the command and control (C2) server The threat group in this recently observed campaign – TEMP.Zagros – weaponized their malware using the following techniques The macro in the Word document drops three files in a hard coded path: C:\programdata Since the path is hard coded, the execution will only be observed in operating systems, Windows 7 and above DefenderService.inf – The INF file that is used to invoke the above scriptlet file After dropping the three files, the macro will set the following registry key to achieve persistence:  \REGISTRY\USER\SID\Software\Microsoft\Windows\CurrentVersio    n\Run\"WindowsDefenderUpdater" = cmstp.exe /s c:\programdata\DefenderService.inf Upon system restart, cmstp.exe will be used to execute the SCT file indirectly through the INF file This is possible because inside the INF file we have the following section: [UnRegisterOCXSection] %11%\scrobj.dll,NI,c:/programdata/Defender.sct That section gets indirectly invoked through the DefaultInstall_SingleUser section of INF, as shown in Figure 9 Figure 9: Indirectly invoking SCT through the DefaultInstall_SingleUser section of INF This method of code execution is performed in an attempt to evade security products FireEye MVX and HX Endpoint Security technology successfully detect this code execution technique Figure 10: Character replacement and string reversing techniques   PowerShell Environment Variables: Nowadays, malware authors commonly mask critical strings such as “IEX” using environment variables The algorithm used for encryption and decryption is RSA, which leverages the public and private key exponents included in Section 1 of the PowerShell script Section 3 The third section of the PowerShell script is the biggest section and has a wide variety of functionalities During analysis, we observed a code section where a message written in Chinese and hard coded in the script will be printed in the case of an error while connecting to the C2 server:   The English translation for this message is: “Cannot connect to website, please wait for dragon” Figure 16: Reboot, shut down and clean commands  Ability to sleep for a given number of seconds The following table summarizes the main C2 commands supported by this PowerShell Script By combining multiple layers of obfuscation, they deter the process of reverse engineering and also attempt to evade security products Indicators of Compromise Macro based Documents and Hashes     SHA256 Hash   Filename   Targeted Region    eff78c23790ee834f773569b52cddb01dc3c4dd9660f5a476af044ef6fe73894  na.doc     Pakistan    76e9988dad0278998861717c774227bf94112db548946ef617bfaa262cb5e338  Invest in Turkey.doc  Turkey    6edc067fc2301d7a972a654b3a07398d9c8cbe7bb38d1165b80ba4a13805e5ac  güvenlik yönergesi ### Response: .