Article Content Introduction FireEye researchers recently observed threat actors leveraging relatively new vulnerabilities in Microsoft Office to spread Zyklon HTTP malware Zyklon has been observed in the wild since early 2016 and provides myriad sophisticated capabilities The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so The malware can download several plugins, some of which include features such as cryptocurrency mining and password recovery, from browsers and email software Zyklon also provides a very efficient mechanism to monitor the spread and impact Infection Vector We have observed this recent wave of Zyklon malware being delivered primarily through spam emails The email typically arrives with an attached ZIP file containing a malicious DOC file (Figure 1 shows a sample lure) The following industries have been the primary targets in this campaign:  Telecommunications Insurance Financial Services     Figure 1: Sample lure documents Attack Flow  Spam email arrives in the victim’s mailbox as a ZIP attachment, which contains a malicious DOC file The document files exploit at least three known vulnerabilities in Microsoft Office, which we discuss in the Infection Techniques section A visual representation of the attack flow and execution chain can be seen in Figure 2 Figure 6: PowerShell command to download the Pause.ps1 payload Dynamic Data Exchange (DDE) Dynamic Data Exchange (DDE) is the interprocess communication mechanism that is exploited to perform remote code execution With the help of a PowerShell script (shown in Figure 7), the next payload (Pause.ps1) is downloaded Figure 7: DDE technique used to download the Pause.ps1 payload One of the unique approaches we have observed is the use of dot-less IP addresses (example: hxxp://258476380) The Pause.ps1 script is responsible for resolving the APIs required for code injection It also contains the injectable shellcode The APIs contain VirtualAlloc(), memset(), and CreateThread() Figure 9 shows the decoded Base64 code Figure 9: Base64 decoded Pause.ps1 The injected code is responsible for downloading the final payload from the server (see Figure 10) The final stage payload is a PE executable compiled with .Net framework The unpacked code is Zyklon This file is decrypted and injected into an instance of InstallUtiil.exe, and functions as a Tor anonymizer Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network The malware sends a POST request to the C2 server The C2 server is appended by the gate.php, which is stored in file memory The parameter passed to this request is getkey=y Figure 12: Zyklon public RSA key After the connection is established with the C2 server, the malware can communicate with its control server using the commands shown in Table 1 Zyklon Pricing Researchers identified different versions of Zyklon HTTP being advertised in a popular underground marketplace for the following prices:  Normal build: $75 (USD) Tor-enabled build: $125 (USD) Rebuild/Updates: $15 (USD) Payment Method: Bitcoin (BTC)  Conclusion Threat actors incorporating recently discovered vulnerabilities in popular software – Microsoft Office, in this case – only increases the potential for successful infections These types of threats show why it is very important to ensure that all software is fully updated Additionally, all industries should be on alert, as it is highly likely that the threat actors will eventually move outside the scope of their current targeting At this time of writing, FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat Table 2 lists the current detection and blocking capabilities by product MD5  Name    76011037410d031aa41e5d381909f9ce  accounts.doc    4bae7fb819761a7ac8326baf8d8eb6ab  Courrier.doc    eb5fa454ab42c8aec443ba8b8c97339b  doc.doc    886a4da306e019aa0ad3a03524b02a1c  Pause.ps1    04077ecbdc412d6d87fc21e4b3a4d088  words.exe    Table 3: Sample Zyklon lures Network Indicators  154.16.93.182 85.214.136.179 178.254.21.218 159.203.42.107 217.12.223.216 138.201.143.186 216.244.85.211 51.15.78.0 213.251.226.175 93.95.100.202 warnono.punkdns.top
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Introduction FireEye researchers recently observed threat actors leveraging relatively new vulnerabilities in Microsoft Office to spread Zyklon HTTP malware Zyklon has been observed in the wild since early 2016 and provides myriad sophisticated capabilities The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so The malware can download several plugins, some of which include features such as cryptocurrency mining and password recovery, from browsers and email software Zyklon also provides a very efficient mechanism to monitor the spread and impact Infection Vector We have observed this recent wave of Zyklon malware being delivered primarily through spam emails The email typically arrives with an attached ZIP file containing a malicious DOC file (Figure 1 shows a sample lure) The following industries have been the primary targets in this campaign:  Telecommunications Insurance Financial Services     Figure 1: Sample lure documents Attack Flow  Spam email arrives in the victim’s mailbox as a ZIP attachment, which contains a malicious DOC file The document files exploit at least three known vulnerabilities in Microsoft Office, which we discuss in the Infection Techniques section A visual representation of the attack flow and execution chain can be seen in Figure 2 Figure 6: PowerShell command to download the Pause.ps1 payload Dynamic Data Exchange (DDE) Dynamic Data Exchange (DDE) is the interprocess communication mechanism that is exploited to perform remote code execution With the help of a PowerShell script (shown in Figure 7), the next payload (Pause.ps1) is downloaded Figure 7: DDE technique used to download the Pause.ps1 payload One of the unique approaches we have observed is the use of dot-less IP addresses (example: hxxp://258476380) The Pause.ps1 script is responsible for resolving the APIs required for code injection It also contains the injectable shellcode The APIs contain VirtualAlloc(), memset(), and CreateThread() Figure 9 shows the decoded Base64 code Figure 9: Base64 decoded Pause.ps1 The injected code is responsible for downloading the final payload from the server (see Figure 10) The final stage payload is a PE executable compiled with .Net framework The unpacked code is Zyklon This file is decrypted and injected into an instance of InstallUtiil.exe, and functions as a Tor anonymizer Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network The malware sends a POST request to the C2 server The C2 server is appended by the gate.php, which is stored in file memory The parameter passed to this request is getkey=y Figure 12: Zyklon public RSA key After the connection is established with the C2 server, the malware can communicate with its control server using the commands shown in Table 1 Zyklon Pricing Researchers identified different versions of Zyklon HTTP being advertised in a popular underground marketplace for the following prices:  Normal build: $75 (USD) Tor-enabled build: $125 (USD) Rebuild/Updates: $15 (USD) Payment Method: Bitcoin (BTC)  Conclusion Threat actors incorporating recently discovered vulnerabilities in popular software – Microsoft Office, in this case – only increases the potential for successful infections These types of threats show why it is very important to ensure that all software is fully updated Additionally, all industries should be on alert, as it is highly likely that the threat actors will eventually move outside the scope of their current targeting At this time of writing, FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat Table 2 lists the current detection and blocking capabilities by product MD5  Name    76011037410d031aa41e5d381909f9ce  accounts.doc    4bae7fb819761a7ac8326baf8d8eb6ab  Courrier.doc    eb5fa454ab42c8aec443ba8b8c97339b  doc.doc    886a4da306e019aa0ad3a03524b02a1c  Pause.ps1    04077ecbdc412d6d87fc21e4b3a4d088  words.exe    Table 3: Sample Zyklon lures Network Indicators  154.16.93.182 85.214.136.179 178.254.21.218 159.203.42.107 217.12.223.216 138.201.143.186 216.244.85.211 51.15.78.0 213.251.226.175 93.95.100.202 warnono.punkdns.top ### Response: .