Article Content Summary Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010 The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare While we don’t have information on the intended targets in this case, previous reports on this activity have identified targeting primarily among the “Five Poisons” which are movements the Chinese government perceives as dangerous They are:  Uyghurs, particularly those supporting East Turkestan independence Tibetans, particularly those supportive of Tibetan independence Falun Gong practitioners Supporters of Taiwan independence Supporters of Chinese democracy  The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting.  We explore those ties and provide an in-depth analysis of the new malware below Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver” As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3 The flow for Reaver is as shown:  Figure 1 Reaver execution flow diagram Reaver.v1 The earliest variant of Reaver begins by attempting to enable the SeDebugPrivilege privilege for the running process The malware proceeds to identify the file path of either the common startup folder, or the user’s startup folder depending on if the SeDebugPrivilege privilege was obtained Reaver.v2 Reaver.v2 begins by attempting to enable the SeDebugPrivilege privilege for the running process At this stage the malware will identify the correct startup path using the same technique witnessed in earlier variants It will specifically load this CPL file via a call to the built-in Microsoft Windows ‘control.exe’ utility Reaver.v3 Like Reaver.v2, Reaver.v3 begins by attempting to enable the SeDebugPrivilege privilege for the running process In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\credentials\  Reaver.v3 proceeds to write an embedded Microsoft Cabinet (CAB) file to the following location:  %TEMP%\winhelp.dat  This cabinet file is then extracted to the previously identified file path The contents of this cabinet file consist of a Microsoft Control Panel item with a filename of ‘winhelp.cpl’ Finally, the malware calls the ‘winhelp.cpl’ file in a new process via the following command:  control [path_previously_identified]\winhelp.cpl   Reaver HTTP Payload The malicious CPL payload of Reaver has the following two exported functions:  CPlApplet DllEntryPoint  When the CPlApplet function is loaded, Reaver will initially determine if the SeDebugPrivilege privilege is able to be obtained The following example decrypted configuration is as follows:       00000000: 77 77 77 2E 74 61 73 68  64 71 64 78 70 2E 63 6F  www.tashdqdxp.co00000010: 6D 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  m...............00000020: 38 30 00 00 00 00 00 00  00 00 00 00 00 00 00 00  80..............00000030: 33 30 00 00 00 00 00 00  00 00 00 00 00 00 00 00  30..............00000040: 57 69 6E 64 6F 77 73 20  55 70 64 61 74 65 00 00  Windows Update..00000050: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................00000060: 41 70 70 6C 65 74 00 00  00 00 00 00 00 00 00 00  Applet..........00000070: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ..............
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010 The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare While we don’t have information on the intended targets in this case, previous reports on this activity have identified targeting primarily among the “Five Poisons” which are movements the Chinese government perceives as dangerous They are:  Uyghurs, particularly those supporting East Turkestan independence Tibetans, particularly those supportive of Tibetan independence Falun Gong practitioners Supporters of Taiwan independence Supporters of Chinese democracy  The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting.  We explore those ties and provide an in-depth analysis of the new malware below Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver” As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3 The flow for Reaver is as shown:  Figure 1 Reaver execution flow diagram Reaver.v1 The earliest variant of Reaver begins by attempting to enable the SeDebugPrivilege privilege for the running process The malware proceeds to identify the file path of either the common startup folder, or the user’s startup folder depending on if the SeDebugPrivilege privilege was obtained Reaver.v2 Reaver.v2 begins by attempting to enable the SeDebugPrivilege privilege for the running process At this stage the malware will identify the correct startup path using the same technique witnessed in earlier variants It will specifically load this CPL file via a call to the built-in Microsoft Windows ‘control.exe’ utility Reaver.v3 Like Reaver.v2, Reaver.v3 begins by attempting to enable the SeDebugPrivilege privilege for the running process In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\credentials\  Reaver.v3 proceeds to write an embedded Microsoft Cabinet (CAB) file to the following location:  %TEMP%\winhelp.dat  This cabinet file is then extracted to the previously identified file path The contents of this cabinet file consist of a Microsoft Control Panel item with a filename of ‘winhelp.cpl’ Finally, the malware calls the ‘winhelp.cpl’ file in a new process via the following command:  control [path_previously_identified]\winhelp.cpl   Reaver HTTP Payload The malicious CPL payload of Reaver has the following two exported functions:  CPlApplet DllEntryPoint  When the CPlApplet function is loaded, Reaver will initially determine if the SeDebugPrivilege privilege is able to be obtained The following example decrypted configuration is as follows:       00000000: 77 77 77 2E 74 61 73 68  64 71 64 78 70 2E 63 6F  www.tashdqdxp.co00000010: 6D 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  m...............00000020: 38 30 00 00 00 00 00 00  00 00 00 00 00 00 00 00  80..............00000030: 33 30 00 00 00 00 00 00  00 00 00 00 00 00 00 00  30..............00000040: 57 69 6E 64 6F 77 73 20  55 70 64 61 74 65 00 00  Windows Update..00000050: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................00000060: 41 70 70 6C 65 74 00 00  00 00 00 00 00 00 00 00  Applet..........00000070: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  .............. ### Response: .