Article Content Summary In the past few months, Unit 42 has observed the Patchwork group, alternatively known as Dropping Elephant and Monsoon, conducting campaigns against targets located in the Indian subcontinent Patchwork threat actors utilized a pair of EPS exploits rolled into legitimate, albeit malicious, documents in order to propagate their updated BADNEWS payload The use of weaponized legitimate documents is a longstanding operational standard of this group The malicious documents seen in recent activity refer to a number of topics, including recent military promotions within the Pakistan Army, information related to the Pakistan Atomic Energy Commission, as well as Pakistan’s Ministry of the Interior The BADNEWS malware payload, which these malicious documents ultimately deliver, has been updated since the last public report in December 2017 BADNEWS acts as a backdoor for the attackers, providing them with full control over the victim machine We’ve observed modifications to how the malware obtains its (C2) server information, as well as modifications to the C2 communication These changes to BADNEWS, as well as the use of recent EPS-based exploits, demonstrate that the group are actively updating their toolsets in efforts to stay ahead of the security community In this posting, we detail our findings and document these changes Delivery The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities These vulnerabilities are well covered in previous public works, which can be found from PWC and FireEye After the files are dropped, the VMwareCplLauncher.exe executable is run, which in turn loads the vmtools.dll DLL file The flow of execution from the time the victim opens the malicious Microsoft Word document, to the execution of BADNEWS, may be seen below:  Figure 5 Side-loading technique employed to deliver BADNEWS   The following image demonstrates the scheduled task created by the modified vmtools.dll to ensure BADNEWS runs and remains running on the victim machine Figure 6 Scheduled task created to load BADNEWS   BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016 Additionally, recent analysis by Trend Micro notes some minor changes during 2017 To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP The malware collects C2 information when it is originally executed via “Dead Drop Resolvers” Dead drop resolvers have been used by multiple threat actor groups using various malware families and those behind Patchwork are well versed with this tactic For the remainder of the analysis in this research blog, we are discussing the following file:    SHA256 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2   MD5 79ad2084b057847ce2ec2e48fda64073   Compile Date 2017-12-22 11:54:03 UTC    One of the first modifications we witnessed in this new variant of BADNEWS is a new mutex that is created to ensure a single instance of BADNEWS is running at a given moment This malware family used the new mutex ‘com_mycompany_apps_appname_new’ This variant of BADNEWS uses different filenames compared to previous versions The following filenames are used by BADNEWS throughout its execution Previous variants of BADNEWS looked for data between ‘{{‘ and ‘}}’, and used a simple cipher to decode this data This new variant now looks for data between ‘[[‘ and ‘]]’ in a number of hardcoded URLs In the example shown above, we are presented with a result of 185.203.118[.]115 after all four steps are taken BADNEWS performs many of the expected functions associated with previous versions including keylogging and identifying files of interest Instead, it looks at fixed drives only It continues to seek out files with the following extensions:  .xls .xlsx .doc .docx .ppt .pptx .pdf  In order to prepare for C2 communication, BADNEWS will aggregate various victim information, which is appended to two strings Additionally, the hardcoded version string of ‘1.0’ is different from previous samples Spawn a new instance of BADNEWS after 5 Upload the file specified by the C2 The following hardcoded URI is used for normal communication with the C2 (note the additional forward slashes):  //e3e7e71a0b28b5e96cc492e636722f73//4sVKAOvu3D//ABDYot0NxyG.php  In the event data is uploaded to the attacker, the following hardcoded URI is used (note the use of backslashes):  \e3e7e71a0b28b5e96cc492e636722f73\4sVKAOvu3D\UYEfgEpXAOE.php    When initial pings are sent to the remote server, BADNEWS includes one of the two previously created strings containing the victim’s information An example request in a sandboxed environment may be seen below:  Figure 8 Example request made by BADNEWS   To decrypt the data provided in the POST request, a number of steps are required First, the attackers include a series of extra ‘=’ and ‘&’ characters within the data stream Once these are removed, the data is decoded with base64 Finally, the result is decrypted using AES-128 and the following static key (hex-encoded):  DD1876848203D9E10ABCEEC07282FF37    Conclusion The Patchwork group continues to plague victims located within the Indian subcontinent Through the use of relatively new exploits, as well as a constantly evolving malware toolset, they aim to compromise prominent organizations and individuals to further their goals Recent activity has shown a number of lures related to the Pakistan Army, the Pakistan Atomic Energy Commission, as well as the Ministry of the Interior Palo Alto Networks customers are protected against this threat in a number of ways:  Traps blocks the exploit documents witnessed during this campaign WildFire accurately identifies the samples mentioned in this blog as malicious The Patchwork and BADNEWS tags in AutoFocus may be used for continued monitoring and tracking of this threat Additionally, the providers being used for dead drops have been notified 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary In the past few months, Unit 42 has observed the Patchwork group, alternatively known as Dropping Elephant and Monsoon, conducting campaigns against targets located in the Indian subcontinent Patchwork threat actors utilized a pair of EPS exploits rolled into legitimate, albeit malicious, documents in order to propagate their updated BADNEWS payload The use of weaponized legitimate documents is a longstanding operational standard of this group The malicious documents seen in recent activity refer to a number of topics, including recent military promotions within the Pakistan Army, information related to the Pakistan Atomic Energy Commission, as well as Pakistan’s Ministry of the Interior The BADNEWS malware payload, which these malicious documents ultimately deliver, has been updated since the last public report in December 2017 BADNEWS acts as a backdoor for the attackers, providing them with full control over the victim machine We’ve observed modifications to how the malware obtains its (C2) server information, as well as modifications to the C2 communication These changes to BADNEWS, as well as the use of recent EPS-based exploits, demonstrate that the group are actively updating their toolsets in efforts to stay ahead of the security community In this posting, we detail our findings and document these changes Delivery The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities These vulnerabilities are well covered in previous public works, which can be found from PWC and FireEye After the files are dropped, the VMwareCplLauncher.exe executable is run, which in turn loads the vmtools.dll DLL file The flow of execution from the time the victim opens the malicious Microsoft Word document, to the execution of BADNEWS, may be seen below:  Figure 5 Side-loading technique employed to deliver BADNEWS   The following image demonstrates the scheduled task created by the modified vmtools.dll to ensure BADNEWS runs and remains running on the victim machine Figure 6 Scheduled task created to load BADNEWS   BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016 Additionally, recent analysis by Trend Micro notes some minor changes during 2017 To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP The malware collects C2 information when it is originally executed via “Dead Drop Resolvers” Dead drop resolvers have been used by multiple threat actor groups using various malware families and those behind Patchwork are well versed with this tactic For the remainder of the analysis in this research blog, we are discussing the following file:    SHA256 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2   MD5 79ad2084b057847ce2ec2e48fda64073   Compile Date 2017-12-22 11:54:03 UTC    One of the first modifications we witnessed in this new variant of BADNEWS is a new mutex that is created to ensure a single instance of BADNEWS is running at a given moment This malware family used the new mutex ‘com_mycompany_apps_appname_new’ This variant of BADNEWS uses different filenames compared to previous versions The following filenames are used by BADNEWS throughout its execution Previous variants of BADNEWS looked for data between ‘{{‘ and ‘}}’, and used a simple cipher to decode this data This new variant now looks for data between ‘[[‘ and ‘]]’ in a number of hardcoded URLs In the example shown above, we are presented with a result of 185.203.118[.]115 after all four steps are taken BADNEWS performs many of the expected functions associated with previous versions including keylogging and identifying files of interest Instead, it looks at fixed drives only It continues to seek out files with the following extensions:  .xls .xlsx .doc .docx .ppt .pptx .pdf  In order to prepare for C2 communication, BADNEWS will aggregate various victim information, which is appended to two strings Additionally, the hardcoded version string of ‘1.0’ is different from previous samples Spawn a new instance of BADNEWS after 5 Upload the file specified by the C2 The following hardcoded URI is used for normal communication with the C2 (note the additional forward slashes):  //e3e7e71a0b28b5e96cc492e636722f73//4sVKAOvu3D//ABDYot0NxyG.php  In the event data is uploaded to the attacker, the following hardcoded URI is used (note the use of backslashes):  \e3e7e71a0b28b5e96cc492e636722f73\4sVKAOvu3D\UYEfgEpXAOE.php    When initial pings are sent to the remote server, BADNEWS includes one of the two previously created strings containing the victim’s information An example request in a sandboxed environment may be seen below:  Figure 8 Example request made by BADNEWS   To decrypt the data provided in the POST request, a number of steps are required First, the attackers include a series of extra ‘=’ and ‘&’ characters within the data stream Once these are removed, the data is decoded with base64 Finally, the result is decrypted using AES-128 and the following static key (hex-encoded):  DD1876848203D9E10ABCEEC07282FF37    Conclusion The Patchwork group continues to plague victims located within the Indian subcontinent Through the use of relatively new exploits, as well as a constantly evolving malware toolset, they aim to compromise prominent organizations and individuals to further their goals Recent activity has shown a number of lures related to the Pakistan Army, the Pakistan Atomic Energy Commission, as well as the Ministry of the Interior Palo Alto Networks customers are protected against this threat in a number of ways:  Traps blocks the exploit documents witnessed during this campaign WildFire accurately identifies the samples mentioned in this blog as malicious The Patchwork and BADNEWS tags in AutoFocus may be used for continued monitoring and tracking of this threat Additionally, the providers being used for dead drops have been notified  ### Response: .