Article Content We assess this activity was carried out by a suspected Iranian cyber espionage threat group, whom we refer to as APT34, using a custom PowerShell backdoor to achieve its objectives We believe APT34 is involved in a long-term cyber espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 This threat group has conducted broad targeting across a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts, sometimes coupled with social engineering tactics We now attribute that campaign to APT34 In July 2017, we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER, based on strings within the malware The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 The full report on APT34 is available to our MySIGHT customer community. APT34 loosely aligns with public reporting related to the group "OilRig" As individual organizations may track adversaries using varied data sets, it is possible that our classifications of activity may not wholly align The vulnerability was patched by Microsoft on Nov 14, 2017 A full proof of concept (POC) was publicly released a week later by the reporter of the vulnerability The vulnerability exists in the old Equation Editor (EQNEDT32.EXE), a component of Microsoft Office that is used to insert and evaluate mathematical formulas The Equation Editor is embedded in Office documents using object linking and embedding (OLE) technology If a crafted formula is passed to the Equation Editor, it does not check the data length properly while copying the data, which results in stack memory corruption As the EQNEDT32.exe is compiled using an older compiler and does not support address space layout randomization (ASLR), a technique that guards against the exploitation of memory corruption vulnerabilities, the attacker can easily alter the flow of program execution The malicious file exploits CVE-2017-11882, which corrupts the memory on the stack and then proceeds to push the malicious data to the stack The malware then overwrites the function address with the address of an existing instruction from EQNEDT32.EXE Figure 1: Disassembly of overwritten function address After exploitation, the ‘WinExec’ function is successfully called to create a child process, “mshta.exe”, in the context of current logged on user The process “mshta.exe” downloads a malicious script from hxxp://mumbai-m[.]site/b.txt and executes it, as seen in Figure 2 Figure 2: Attacker data copied to corrupt stack buffer Execution Workflow The malicious script goes through a series of steps to successfully execute and ultimately establish a connection to the command and control (C2) server The full sequence of events starting with the exploit document is illustrated in Figure 3 The malware overwrites the function address with an existing instruction from EQNEDT32.EXE The malware creates a child process, “mshta.exe,” which downloads a file from: hxxp://mumbai-m[.]site/b.txt b.txt contains a PowerShell command to download a dropper from: hxxp://dns-update[.]club/v.txt The PowerShell command also renames the downloaded file from v.txt to v.vbs and executes the script GoogleUpdateschecker.vbs is executed after sleeping for five seconds cUpdateCheckers.bat and *.base are deleted from the staging directory Figure 4 contains an excerpt of the v.vbs script pertaining to the Execution Workflow section POWRUNER is executed every minute by the Task Scheduler Figure 5 contains an excerpt of the POWRUNER backdoor Figure 5: POWRUNER PowerShell script hUpdateCheckers.ps1 POWRUNER begins by sending a random GET request to the C2 server and waits for a response The server will respond with either “not_now” or a random 11-digit number If the response is a random number, POWRUNER will send another random GET request to the server and store the response in a string POWRUNER will then check the last digit of the stored random number response, interpret the value as a command, and perform an action based on that command The command values and the associated actions are described in Table 1 Figure 6 shows the PowerShell “Get-Screenshot” function sent by the C2 server Figure 6: Powershell Screenshot Functionality dUpdateCheckers.ps1 (BONDUPDATER) One of the recent advancements by APT34 is the use of DGA to generate subdomains DGA Implementation Figure 7 provides a breakdown of how an example domain (456341921300006B0C8B2CE9C9B007.mumbai-m[.]site) is generated using BONDUPDATER’s custom DGA Figure 7: Breakdown of subdomain created by BONDUPDATER  This is a randomly generated number created using the following expression: $rnd = -join (Get-Random -InputObject (10..99) -Count (%{ Get-Random -InputObject (1..6)})); This value is either 0 or 1 It is initially set to 0 Initially set to 000, then incremented by 3 after every DNS request First 12 characters of system UUID “B007” hardcoded string BONDUPDATER will evaluate the last character of the file name and perform the corresponding action found in Table 2 Figure 8: Domain Generation Algorithm Some examples of the generated subdomains observed at time of execution include: 143610035BAF04425847B007.mumbai-m[.]site 835710065BAF04425847B007.mumbai-m[.]site 376110095BAF04425847B007.mumbai-m[.]site Network Communication Figure 9 shows example network communications between a POWRUNER backdoor client and server As the response is a random number that ends with ‘0’, POWRUNER sends another random GET request to receive  an additional command string If the server had sent the string “not_now” as response, as shown in Figure 10, POWRUNER would have ceased any further requests and terminated its execution Figure 10: Example "not now" server response Batch Commands POWRUNER may also receive batch commands from the C2 server to collect host information from the system An example batch command is provided in Figure 11 Figure 11: Batch commands sent by POWRUNER C2 server Additional Use of POWRUNER / BONDUPDATER APT34 has used POWRUNER and BONDUPDATER to target Middle East organizations as early as July 2017 In July 2017, a FireEye Web MPS appliance detected and blocked a request to retrieve and install an APT34 POWRUNER / BONDUPDATER downloader file During the same month, FireEye observed APT34 target a separate Middle East organization using a malicious .rtf file (MD5: 63D66D99E46FB93676A4F475A65566D8) that exploited CVE-2017-0199 The file also contains a comment by the malware author that appears to be an apparent taunt to security researchers Figure 12: Contents of dupdatechecker.doc script The dupatechecker.exe file (MD5: C9F16F0BE8C77F0170B9B6CE876ED7FB) drops both BONDUPDATER and POWRUNER These files connect to proxychecker[.]pro for C2 Outlook and Implications Recent activity by APT34 demonstrates that they are capable group with potential access to their own development resources We assess that APT34’s efforts to continuously update their malware, including the incorporation of DGA for C2, demonstrate the group’s commitment to pursing strategies to deter detection We expect APT34 will continue to evolve their malware and tactics as they continue to pursue access to entities in the Middle East region
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content We assess this activity was carried out by a suspected Iranian cyber espionage threat group, whom we refer to as APT34, using a custom PowerShell backdoor to achieve its objectives We believe APT34 is involved in a long-term cyber espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 This threat group has conducted broad targeting across a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts, sometimes coupled with social engineering tactics We now attribute that campaign to APT34 In July 2017, we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER, based on strings within the malware The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 The full report on APT34 is available to our MySIGHT customer community. APT34 loosely aligns with public reporting related to the group "OilRig" As individual organizations may track adversaries using varied data sets, it is possible that our classifications of activity may not wholly align The vulnerability was patched by Microsoft on Nov 14, 2017 A full proof of concept (POC) was publicly released a week later by the reporter of the vulnerability The vulnerability exists in the old Equation Editor (EQNEDT32.EXE), a component of Microsoft Office that is used to insert and evaluate mathematical formulas The Equation Editor is embedded in Office documents using object linking and embedding (OLE) technology If a crafted formula is passed to the Equation Editor, it does not check the data length properly while copying the data, which results in stack memory corruption As the EQNEDT32.exe is compiled using an older compiler and does not support address space layout randomization (ASLR), a technique that guards against the exploitation of memory corruption vulnerabilities, the attacker can easily alter the flow of program execution The malicious file exploits CVE-2017-11882, which corrupts the memory on the stack and then proceeds to push the malicious data to the stack The malware then overwrites the function address with the address of an existing instruction from EQNEDT32.EXE Figure 1: Disassembly of overwritten function address After exploitation, the ‘WinExec’ function is successfully called to create a child process, “mshta.exe”, in the context of current logged on user The process “mshta.exe” downloads a malicious script from hxxp://mumbai-m[.]site/b.txt and executes it, as seen in Figure 2 Figure 2: Attacker data copied to corrupt stack buffer Execution Workflow The malicious script goes through a series of steps to successfully execute and ultimately establish a connection to the command and control (C2) server The full sequence of events starting with the exploit document is illustrated in Figure 3 The malware overwrites the function address with an existing instruction from EQNEDT32.EXE The malware creates a child process, “mshta.exe,” which downloads a file from: hxxp://mumbai-m[.]site/b.txt b.txt contains a PowerShell command to download a dropper from: hxxp://dns-update[.]club/v.txt The PowerShell command also renames the downloaded file from v.txt to v.vbs and executes the script GoogleUpdateschecker.vbs is executed after sleeping for five seconds cUpdateCheckers.bat and *.base are deleted from the staging directory Figure 4 contains an excerpt of the v.vbs script pertaining to the Execution Workflow section POWRUNER is executed every minute by the Task Scheduler Figure 5 contains an excerpt of the POWRUNER backdoor Figure 5: POWRUNER PowerShell script hUpdateCheckers.ps1 POWRUNER begins by sending a random GET request to the C2 server and waits for a response The server will respond with either “not_now” or a random 11-digit number If the response is a random number, POWRUNER will send another random GET request to the server and store the response in a string POWRUNER will then check the last digit of the stored random number response, interpret the value as a command, and perform an action based on that command The command values and the associated actions are described in Table 1 Figure 6 shows the PowerShell “Get-Screenshot” function sent by the C2 server Figure 6: Powershell Screenshot Functionality dUpdateCheckers.ps1 (BONDUPDATER) One of the recent advancements by APT34 is the use of DGA to generate subdomains DGA Implementation Figure 7 provides a breakdown of how an example domain (456341921300006B0C8B2CE9C9B007.mumbai-m[.]site) is generated using BONDUPDATER’s custom DGA Figure 7: Breakdown of subdomain created by BONDUPDATER  This is a randomly generated number created using the following expression: $rnd = -join (Get-Random -InputObject (10..99) -Count (%{ Get-Random -InputObject (1..6)})); This value is either 0 or 1 It is initially set to 0 Initially set to 000, then incremented by 3 after every DNS request First 12 characters of system UUID “B007” hardcoded string BONDUPDATER will evaluate the last character of the file name and perform the corresponding action found in Table 2 Figure 8: Domain Generation Algorithm Some examples of the generated subdomains observed at time of execution include: 143610035BAF04425847B007.mumbai-m[.]site 835710065BAF04425847B007.mumbai-m[.]site 376110095BAF04425847B007.mumbai-m[.]site Network Communication Figure 9 shows example network communications between a POWRUNER backdoor client and server As the response is a random number that ends with ‘0’, POWRUNER sends another random GET request to receive  an additional command string If the server had sent the string “not_now” as response, as shown in Figure 10, POWRUNER would have ceased any further requests and terminated its execution Figure 10: Example "not now" server response Batch Commands POWRUNER may also receive batch commands from the C2 server to collect host information from the system An example batch command is provided in Figure 11 Figure 11: Batch commands sent by POWRUNER C2 server Additional Use of POWRUNER / BONDUPDATER APT34 has used POWRUNER and BONDUPDATER to target Middle East organizations as early as July 2017 In July 2017, a FireEye Web MPS appliance detected and blocked a request to retrieve and install an APT34 POWRUNER / BONDUPDATER downloader file During the same month, FireEye observed APT34 target a separate Middle East organization using a malicious .rtf file (MD5: 63D66D99E46FB93676A4F475A65566D8) that exploited CVE-2017-0199 The file also contains a comment by the malware author that appears to be an apparent taunt to security researchers Figure 12: Contents of dupdatechecker.doc script The dupatechecker.exe file (MD5: C9F16F0BE8C77F0170B9B6CE876ED7FB) drops both BONDUPDATER and POWRUNER These files connect to proxychecker[.]pro for C2 Outlook and Implications Recent activity by APT34 demonstrates that they are capable group with potential access to their own development resources We assess that APT34’s efforts to continuously update their malware, including the incorporation of DGA for C2, demonstrate the group’s commitment to pursing strategies to deter detection We expect APT34 will continue to evolve their malware and tactics as they continue to pursue access to entities in the Middle East region ### Response: .