Article Content In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East It was carried out by a previously unpublished threat group we track as DarkHydrus Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016 Once opened, Excel will retrieve whatever object is at the URL inside the file These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy In DarkHydrus’s case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin Attack Analysis The actors sent the spear-phishing emails between July 15 and 16 The body of the message, seen in Figure 1 was written in Arabic and asks the recipient to review the document within the archive The message also includes the password 123456 that is required to open the RAR archive The credential.rar archive contained a malicious .iqy file named credential.iqy Figure 1 Message body in delivery email Google Translate renders the Arabic message as: Hi Please review and review the attached file Gratefully Password: 123456 Payload Analysis The credential.iqy is an .iqy file (SHA256: cc1966eff7bed11c1faada0bb0ed0c8715404abd936cfa816cef61863a0c1dd6) that contains nothing more than the following text string: hxxp://micrrosoft[.]net/releasenotes.txt Microsoft Excel natively opens .iqy files and will use the URL in the file to obtain remote data to include in the spreadsheets By default, Excel will not launch the command prompt application, but will do so with the user’s consent via the following dialog box in Figure 3:  Figure 3 Confirmation of access of remote data The winupdate.ps1 script (SHA256: 36862f654c3356d2177b5d35a410c78ff9803d1d7d20da0b82e3d69d640e856e) is the main payload of this attack that we call RogueRobin Before carrying out any of its functionality the payload checks to see if it is executing in a sandbox Using WMI to check the BIOS manufacturer for XEN Using WMI to check if the total physical memory is less than 2900000000 Using WMI to check if the number of CPU cores is less than or equal to 1 If the payload determines it is not running in a sandbox, it will attempt to install itself to the system to persistently execute To persistently execute when the system starts, the script will create the following shortcut in the Windows startup folder, which will run the OneDrive.ps1 script each time the user logs in: $env:SystemDrive\Users\$env:USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk The payload itself communicates with its configured command and control (C2) servers using a custom DNS tunneling protocol The domains configured within this payload are:  Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The DNS tunneling protocol can use multiple different DNS query types to interact with the C2 server To establish communications with the C2, the payload will first get a system specific identifier issued by the C2 server Table 1 explains how the payload obtains the system identifier from the C2 server’s answer depending on the query type:    DNS Type Description   A Uses the regular expression ‘(\d+)\-.$Global:domain’ to get the decimal value from the answer   AAAA The payload will split the IPv6 answer on “:” take the [0] and [1] digits treat them as a hexadecimal value to obtain an integer The tunneling protocol transmits data by sending a series of DNS queries with the data within the subdomain of the C2 domain The C2 will provide a string that the payload will use to determine the command to execute based on its command handler We analyzed the payload to determine the commands available, which provide a variety of remote administration capabilities Thematically, each domain appeared to be attempting to spoof the legitimate domain of an existing technology provider with an emphasis on security vendors These IPs provided insufficient data for additional investigations However, each of the listed domains used ns102.kaspersky[.]host and ns103.kaspersky[.]host as their name servers Examination of ns102/ns103.kaspersky[.]host revealed that the second level domain kaspersky[.]host was illegitimate and not owned by the legitimate Kaspersky Labs Passive DNS resolution of kaspersky[.]host revealed two IPs of interest, 107.175.150[.]113 and 94.130.88[.]9 94.130.88[.]9 showed passive DNS resolutions of two additional domains, 0utlook[.]bid and hotmai1[.]com 107.175.150[.]113 showed one other domain resolution, <redacted>.0utl00k[.]net We were able to link this specific domain as a C2 for another weaponized document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) containing a PowerShell script very similar to the one found in this attack Examining the second level domain of 0utl00k[.]net revealed another IP of interest, 195.154.41[.]150 This IP contained two other domain resolutions following the vendor spoofing theme: allexa[.]net and cisc0[.]net Expanding upon cisc0[.]net, we discovered several weaponized documents and payloads using this domain as a C2, from mid to late 2017 Open source intelligence provided by ClearSky Security indicates the domain cisc0[.]net is possibly related to the adversary group known as Copy Kittens While there are significant tactical overlaps such as similarity of techniques used as well as victimology, we were unable to uncover significant evidence of relational overlaps Further information regarding the Copy Kittens adversary can be found in a paper titled Operation Wilted Tulip Our own dataset provides a solid grouping of the DarkHydrus group, with significant overlaps in C2 infrastructure as well as similarities in weaponized binaries C2 domains were also left online and reused over an extended amount of time, such as the domain micrrosoft[.]net which was used in this attack in addition to two other payloads in January 2017 and July 2017 Studying the other samples, we have attributed to DarkHydrus, we are able to ascertain that this adversary has mainly leveraged weaponized Microsoft Office documents using tools available freely or from open source repositories such as Meterpreter, Mimikatz, PowerShellEmpire, Veil, and CobaltStrike The documents generally do not contain malicious code and instead are weaponized to retrieve remote files containing malicious code on execution Due to the modular nature of the delivery document, available data for analysis for these attacks are dependent upon the operational nature of the C2 server at the time of execution Conclusion The DarkHydrus group carried out an attack campaign on at least one government agency in the Middle East using malicious .iqy files DarkHydrus leveraged this obscure file format to run a command to ultimately install a PowerShell scripts to gain backdoor access to the system The PowerShell backdoor delivered in this current attack may have been custom developed by the threat group, however, it is possible that DarkHydrus pieced together this tool by using code from legitimate open source tools Palo Alto Networks customers are protected by:  The micrrosoft[.]net domain has had a malicious classification since March 3, 2017 All C2 domains associated with this payload have a command and control classification
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East It was carried out by a previously unpublished threat group we track as DarkHydrus Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016 Once opened, Excel will retrieve whatever object is at the URL inside the file These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy In DarkHydrus’s case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin Attack Analysis The actors sent the spear-phishing emails between July 15 and 16 The body of the message, seen in Figure 1 was written in Arabic and asks the recipient to review the document within the archive The message also includes the password 123456 that is required to open the RAR archive The credential.rar archive contained a malicious .iqy file named credential.iqy Figure 1 Message body in delivery email Google Translate renders the Arabic message as: Hi Please review and review the attached file Gratefully Password: 123456 Payload Analysis The credential.iqy is an .iqy file (SHA256: cc1966eff7bed11c1faada0bb0ed0c8715404abd936cfa816cef61863a0c1dd6) that contains nothing more than the following text string: hxxp://micrrosoft[.]net/releasenotes.txt Microsoft Excel natively opens .iqy files and will use the URL in the file to obtain remote data to include in the spreadsheets By default, Excel will not launch the command prompt application, but will do so with the user’s consent via the following dialog box in Figure 3:  Figure 3 Confirmation of access of remote data The winupdate.ps1 script (SHA256: 36862f654c3356d2177b5d35a410c78ff9803d1d7d20da0b82e3d69d640e856e) is the main payload of this attack that we call RogueRobin Before carrying out any of its functionality the payload checks to see if it is executing in a sandbox Using WMI to check the BIOS manufacturer for XEN Using WMI to check if the total physical memory is less than 2900000000 Using WMI to check if the number of CPU cores is less than or equal to 1 If the payload determines it is not running in a sandbox, it will attempt to install itself to the system to persistently execute To persistently execute when the system starts, the script will create the following shortcut in the Windows startup folder, which will run the OneDrive.ps1 script each time the user logs in: $env:SystemDrive\Users\$env:USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk The payload itself communicates with its configured command and control (C2) servers using a custom DNS tunneling protocol The domains configured within this payload are:  Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The DNS tunneling protocol can use multiple different DNS query types to interact with the C2 server To establish communications with the C2, the payload will first get a system specific identifier issued by the C2 server Table 1 explains how the payload obtains the system identifier from the C2 server’s answer depending on the query type:    DNS Type Description   A Uses the regular expression ‘(\d+)\-.$Global:domain’ to get the decimal value from the answer   AAAA The payload will split the IPv6 answer on “:” take the [0] and [1] digits treat them as a hexadecimal value to obtain an integer The tunneling protocol transmits data by sending a series of DNS queries with the data within the subdomain of the C2 domain The C2 will provide a string that the payload will use to determine the command to execute based on its command handler We analyzed the payload to determine the commands available, which provide a variety of remote administration capabilities Thematically, each domain appeared to be attempting to spoof the legitimate domain of an existing technology provider with an emphasis on security vendors These IPs provided insufficient data for additional investigations However, each of the listed domains used ns102.kaspersky[.]host and ns103.kaspersky[.]host as their name servers Examination of ns102/ns103.kaspersky[.]host revealed that the second level domain kaspersky[.]host was illegitimate and not owned by the legitimate Kaspersky Labs Passive DNS resolution of kaspersky[.]host revealed two IPs of interest, 107.175.150[.]113 and 94.130.88[.]9 94.130.88[.]9 showed passive DNS resolutions of two additional domains, 0utlook[.]bid and hotmai1[.]com 107.175.150[.]113 showed one other domain resolution, <redacted>.0utl00k[.]net We were able to link this specific domain as a C2 for another weaponized document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) containing a PowerShell script very similar to the one found in this attack Examining the second level domain of 0utl00k[.]net revealed another IP of interest, 195.154.41[.]150 This IP contained two other domain resolutions following the vendor spoofing theme: allexa[.]net and cisc0[.]net Expanding upon cisc0[.]net, we discovered several weaponized documents and payloads using this domain as a C2, from mid to late 2017 Open source intelligence provided by ClearSky Security indicates the domain cisc0[.]net is possibly related to the adversary group known as Copy Kittens While there are significant tactical overlaps such as similarity of techniques used as well as victimology, we were unable to uncover significant evidence of relational overlaps Further information regarding the Copy Kittens adversary can be found in a paper titled Operation Wilted Tulip Our own dataset provides a solid grouping of the DarkHydrus group, with significant overlaps in C2 infrastructure as well as similarities in weaponized binaries C2 domains were also left online and reused over an extended amount of time, such as the domain micrrosoft[.]net which was used in this attack in addition to two other payloads in January 2017 and July 2017 Studying the other samples, we have attributed to DarkHydrus, we are able to ascertain that this adversary has mainly leveraged weaponized Microsoft Office documents using tools available freely or from open source repositories such as Meterpreter, Mimikatz, PowerShellEmpire, Veil, and CobaltStrike The documents generally do not contain malicious code and instead are weaponized to retrieve remote files containing malicious code on execution Due to the modular nature of the delivery document, available data for analysis for these attacks are dependent upon the operational nature of the C2 server at the time of execution Conclusion The DarkHydrus group carried out an attack campaign on at least one government agency in the Middle East using malicious .iqy files DarkHydrus leveraged this obscure file format to run a command to ultimately install a PowerShell scripts to gain backdoor access to the system The PowerShell backdoor delivered in this current attack may have been custom developed by the threat group, however, it is possible that DarkHydrus pieced together this tool by using code from legitimate open source tools Palo Alto Networks customers are protected by:  The micrrosoft[.]net domain has had a malicious classification since March 3, 2017 All C2 domains associated with this payload have a command and control classification ### Response: .