These new documents have appeared throughout 2018 and escalated from May onwards The attacks are still ongoing The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros The attackers rely on a range of compromised hosts to deliver their attacks In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers The initial infection vector The initial infection starts with macro-enabled Office 97-2003 Word files whose macros are usually password-protected to hinder static analysis In some cases, the malicious macro is also executed when the user activates a fake text box The macro payload analysis, dropped files and registry keys The macro payload, which is Base64 encoded, does the following:  Drops two or three files into the “ProgramData” folder \EventManager.dll \EventManager.logs \WindowsDefenderService.inil   Adds a registry entry in the current user’s RUN key (HKCU) for later execution when the user next logs in In some cases, the macro spawns the malicious payload/process instantly without waiting for the next time the user logs in The registry keys and executables may vary from one version of the malware to another Name:WindowsDefenderUpdater Type:REG_EXPAND_SZ Data:c:\windows\system32\rundll32.exe advpack.dll,LaunchINFSection C:\ProgramData\EventManager.logs,Defender,1,  The next time the user logs in, the dropped payload will be executed The executables have been chosen specifically for bypassing whitelisting solutions since they are all from Microsoft and very likely whitelisted Case 1: INF, SCT and text files dropped by the macro  INF is launched via the advpack.dll “LaunchINFSection” function INF registers the SCT file (scriptlet file) via scrobj.dll (Microsoft Scriptlet library) The resulting code has multiple layers of obfuscation The first thing the PowerShell code does is to disable office “Macro Warnings” and “Protected View“ This is to ensure future attacks don’t require user interaction The names are linked to various tools used by malware researchers CnC communication A URL is selected at random from a long list of embedded URLs held in an array named $dragon_middle The selected URL is subsequently used for communication with the CnC server If it can’t send data to the chosen CnC URL, it tries to obtain another random URL from $middle_dragon, then sleeps from one to 30 seconds and loops again This allows the attackers to accept or reject victims depending on their IPs, countries, geolocations, target enterprises, etc Depending on the response from the attacker’s CnC, the victim is assigned an ID $sysid These commands vary from one version to another The “Outlook” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Outlook via COM, via MSHTA.exe, to execute it The “risk” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Explorer.exe via COM interaction to execute it The “clean” command destroys the victim’s disk drives C, D, E, F and then reboots The “reboot” and “shutdown” commands immediately reboot and shut down the victim’s machine Victimology  Most victims of MuddyWater were found in Jordan, Turkey, Iraq, Pakistan, Saudi Arabia, Afghanistan and Azerbaijan Other victims were also recorded in Russia, Iran, Bahrain, Austria and Mali The malicious decoy documents used in the attacks suggest they are geopolitically motivated, targeting sensitive personnel and organizations Multiple documents used in the attacks also contain embedded paths from their authors’ machines These paths are embedded by Office under various circumstances, for instance, when somebody adds a binary object (an OLE control, e.g text box or command button) into a Word document Turk could point to a person of Turkish origin Poopak is a Persian girl’s name or might suggest the authors are not entirely happy with “Pak”, which could be short for Pakistan Leo could be one of the attacker’s names We also don’t rule out the possibility of false flags, with the attackers using random usernames to confuse researchers In multiple instances, we have also found Chinese text inside the samples, possibly indicating the reuse of code by the attackers 无法连接到网址，请等待龙… 无法访问本地计算机寄存器 任务计划程序访问被拒绝  Chinese text found in PowerShell code in multiple samples  Unable to connect to the URL, please wait for the dragon… Unable to access local computer register Task Scheduler access denied  Translation of Chinese text We have also noticed that for some samples, e.g 5a42a712e3b3cfa1db32d9e3d832f8f1, the PowerShell code had only three CnC URLs, which leads us to believe that most of the CnC URLs in $dragon_middle found in other samples could actually be ‘noise’ to distract researchers or trigger false positives The best way to prevent attackers from finding and leveraging security holes, is to eliminate the holes altogether, including those related to improper system configurations or errors in proprietary applications Organizations are also recommended to implement the following steps for an enhanced level of protection at their premises Use PowerShell Constrained Language Mode as it uses IEX, Add-Type, and New-Object A whitelisting solution to prevent certain process child-parent execution hierarchies Conclusion The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering, in addition to the active development of attacks, infrastructure and the use of new methods and techniques The attackers are actively improving their toolkit in an effort to minimize their exposure to security products and services Kaspersky Lab expects these types of attacks to intensify in the near future In order to protect your company from malware, Kaspersky Lab researchers recommend implementing the following measures:  Educate generic staff to be able to distinguish malicious behavior like phishing links Educate information security staff to have full configuration, investigative and hunting abilities Use a proven corporate-grade security solution in combination with anti-targeted attack solutions capable of detecting attacks by analyzing network anomalies Provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack prevention and discovery, such as indicators of compromise and YARA rules Make sure enterprise-grade patch management processes are well established and executed High-profile organizations should have elevated levels of cybersecurity, attacks against them are inevitable and are unlikely to ever cease Further details about the attackers’ arsenal, additional indicators of compromise, YARA rules and attribution information is available to customers of Kaspersky Intelligence Reporting
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These new documents have appeared throughout 2018 and escalated from May onwards The attacks are still ongoing The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros The attackers rely on a range of compromised hosts to deliver their attacks In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers The initial infection vector The initial infection starts with macro-enabled Office 97-2003 Word files whose macros are usually password-protected to hinder static analysis In some cases, the malicious macro is also executed when the user activates a fake text box The macro payload analysis, dropped files and registry keys The macro payload, which is Base64 encoded, does the following:  Drops two or three files into the “ProgramData” folder \EventManager.dll \EventManager.logs \WindowsDefenderService.inil   Adds a registry entry in the current user’s RUN key (HKCU) for later execution when the user next logs in In some cases, the macro spawns the malicious payload/process instantly without waiting for the next time the user logs in The registry keys and executables may vary from one version of the malware to another Name:WindowsDefenderUpdater Type:REG_EXPAND_SZ Data:c:\windows\system32\rundll32.exe advpack.dll,LaunchINFSection C:\ProgramData\EventManager.logs,Defender,1,  The next time the user logs in, the dropped payload will be executed The executables have been chosen specifically for bypassing whitelisting solutions since they are all from Microsoft and very likely whitelisted Case 1: INF, SCT and text files dropped by the macro  INF is launched via the advpack.dll “LaunchINFSection” function INF registers the SCT file (scriptlet file) via scrobj.dll (Microsoft Scriptlet library) The resulting code has multiple layers of obfuscation The first thing the PowerShell code does is to disable office “Macro Warnings” and “Protected View“ This is to ensure future attacks don’t require user interaction The names are linked to various tools used by malware researchers CnC communication A URL is selected at random from a long list of embedded URLs held in an array named $dragon_middle The selected URL is subsequently used for communication with the CnC server If it can’t send data to the chosen CnC URL, it tries to obtain another random URL from $middle_dragon, then sleeps from one to 30 seconds and loops again This allows the attackers to accept or reject victims depending on their IPs, countries, geolocations, target enterprises, etc Depending on the response from the attacker’s CnC, the victim is assigned an ID $sysid These commands vary from one version to another The “Outlook” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Outlook via COM, via MSHTA.exe, to execute it The “risk” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Explorer.exe via COM interaction to execute it The “clean” command destroys the victim’s disk drives C, D, E, F and then reboots The “reboot” and “shutdown” commands immediately reboot and shut down the victim’s machine Victimology  Most victims of MuddyWater were found in Jordan, Turkey, Iraq, Pakistan, Saudi Arabia, Afghanistan and Azerbaijan Other victims were also recorded in Russia, Iran, Bahrain, Austria and Mali The malicious decoy documents used in the attacks suggest they are geopolitically motivated, targeting sensitive personnel and organizations Multiple documents used in the attacks also contain embedded paths from their authors’ machines These paths are embedded by Office under various circumstances, for instance, when somebody adds a binary object (an OLE control, e.g text box or command button) into a Word document Turk could point to a person of Turkish origin Poopak is a Persian girl’s name or might suggest the authors are not entirely happy with “Pak”, which could be short for Pakistan Leo could be one of the attacker’s names We also don’t rule out the possibility of false flags, with the attackers using random usernames to confuse researchers In multiple instances, we have also found Chinese text inside the samples, possibly indicating the reuse of code by the attackers 无法连接到网址，请等待龙… 无法访问本地计算机寄存器 任务计划程序访问被拒绝  Chinese text found in PowerShell code in multiple samples  Unable to connect to the URL, please wait for the dragon… Unable to access local computer register Task Scheduler access denied  Translation of Chinese text We have also noticed that for some samples, e.g 5a42a712e3b3cfa1db32d9e3d832f8f1, the PowerShell code had only three CnC URLs, which leads us to believe that most of the CnC URLs in $dragon_middle found in other samples could actually be ‘noise’ to distract researchers or trigger false positives The best way to prevent attackers from finding and leveraging security holes, is to eliminate the holes altogether, including those related to improper system configurations or errors in proprietary applications Organizations are also recommended to implement the following steps for an enhanced level of protection at their premises Use PowerShell Constrained Language Mode as it uses IEX, Add-Type, and New-Object A whitelisting solution to prevent certain process child-parent execution hierarchies Conclusion The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering, in addition to the active development of attacks, infrastructure and the use of new methods and techniques The attackers are actively improving their toolkit in an effort to minimize their exposure to security products and services Kaspersky Lab expects these types of attacks to intensify in the near future In order to protect your company from malware, Kaspersky Lab researchers recommend implementing the following measures:  Educate generic staff to be able to distinguish malicious behavior like phishing links Educate information security staff to have full configuration, investigative and hunting abilities Use a proven corporate-grade security solution in combination with anti-targeted attack solutions capable of detecting attacks by analyzing network anomalies Provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack prevention and discovery, such as indicators of compromise and YARA rules Make sure enterprise-grade patch management processes are well established and executed High-profile organizations should have elevated levels of cybersecurity, attacks against them are inevitable and are unlikely to ever cease Further details about the attackers’ arsenal, additional indicators of compromise, YARA rules and attribution information is available to customers of Kaspersky Intelligence Reporting ### Response: .