Article Content Introduction  On May 18, 2016, FireEye Labs observed a suspected Pakistan-based APT group sending spear phishing emails to Indian government officials This threat actor has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets This group frequently uses a toolset that consists of a downloader and modular framework that uses plugins to enhance functionality, ranging from keystroke logging to targeting USB devices We initially reported on this threat group and their UPDATESEE malware in our FireEye Intelligence Center in February 2016 Proofpoint also discussed the threat actors, whom they call Transparent Tribe, in a March blog post In this latest incident, the group registered a fake news domain, timesofindiaa[.]in, on May 18, 2016, and then used it to send spear phishing emails to Indian government officials on the same day The emails referenced the Indian Government’s 7th Central Pay Commission (CPC) These Commissions periodically review the pay structure for Indian government and military personnel, a topic that would be of interest to government employees In previous incidents involving this threat actor, we observed them using malicious documents hosted on websites about the Indian Army, instead of sending these documents directly as an email attachment The email (Figure 1) pretends to be from an employee working at Times of India (TOI) and requests the recipient to open the attachment associated with the 7th Pay Commission Only one of the recipient email addresses was publicly listed on a website, suggesting that the actor harvested the other non-public addressees through other means This exploit file made use of the same shellcode that we have observed this actor use across a number of spear phishing incidents After decoding is complete, the shellcode proceeds to save the executable payload into %temp%\svchost.exe and calls WinExec to execute the payload Figure 3: Decoy Document related to 7th Pay Commission   The decoy document's metadata (Figure 4) suggests that it was created fairly recently by the user “Bhopal” Figure 4: Metadata of the Document The payload is a backdoor that we call the Breach Remote Administration Tool (BreachRAT) written in C++ We had not previously observed this payload used by these threat actors The malware name is derived from the hardcoded PDB path found in the RAT: C:\Work\Breach Remote Administration Tool\Release\Client.pdb The following is a brief summary of the activities performed by the dropped payload: 1 Decrypts resource 1337 using a hard-coded 14-byte key "MjEh92jHaZZOl3" A python script, which can be used for decrypting this resource, is provided in the appendix below 2 The decrypted resource contains the C2 server’s IP address as well as the mutex name 3 4 Once a successful connection is made, the malware tries to fetch a response from the server through its custom protocol 5 Once data is received, the malware skips over the received bytes until the start byte 0x99 is found in the server response The start byte is followed by a DWORD representing the size of the following data string 6 The data string is encrypted with the above-mentioned encryption scheme with the hard-coded key “AjN28AcMaNX” 7 The data string can contain various commands sent by the C2 server These commands and their string arguments are expected to be in Unicode The following commands are accepted by the malware:    Conclusion  As with previous spear-phishing attacks seen conducted by this group, topics related to Indian Government and Military Affairs are still being used as the lure theme in these attacks and we observed that this group is still actively expanding their toolkit It comes as no surprise that cyber attacks against the Indian government continue, given the historically tense relations in the region Appendix   Encryption / Decryption algorithm translated into Python
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Introduction  On May 18, 2016, FireEye Labs observed a suspected Pakistan-based APT group sending spear phishing emails to Indian government officials This threat actor has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets This group frequently uses a toolset that consists of a downloader and modular framework that uses plugins to enhance functionality, ranging from keystroke logging to targeting USB devices We initially reported on this threat group and their UPDATESEE malware in our FireEye Intelligence Center in February 2016 Proofpoint also discussed the threat actors, whom they call Transparent Tribe, in a March blog post In this latest incident, the group registered a fake news domain, timesofindiaa[.]in, on May 18, 2016, and then used it to send spear phishing emails to Indian government officials on the same day The emails referenced the Indian Government’s 7th Central Pay Commission (CPC) These Commissions periodically review the pay structure for Indian government and military personnel, a topic that would be of interest to government employees In previous incidents involving this threat actor, we observed them using malicious documents hosted on websites about the Indian Army, instead of sending these documents directly as an email attachment The email (Figure 1) pretends to be from an employee working at Times of India (TOI) and requests the recipient to open the attachment associated with the 7th Pay Commission Only one of the recipient email addresses was publicly listed on a website, suggesting that the actor harvested the other non-public addressees through other means This exploit file made use of the same shellcode that we have observed this actor use across a number of spear phishing incidents After decoding is complete, the shellcode proceeds to save the executable payload into %temp%\svchost.exe and calls WinExec to execute the payload Figure 3: Decoy Document related to 7th Pay Commission   The decoy document's metadata (Figure 4) suggests that it was created fairly recently by the user “Bhopal” Figure 4: Metadata of the Document The payload is a backdoor that we call the Breach Remote Administration Tool (BreachRAT) written in C++ We had not previously observed this payload used by these threat actors The malware name is derived from the hardcoded PDB path found in the RAT: C:\Work\Breach Remote Administration Tool\Release\Client.pdb The following is a brief summary of the activities performed by the dropped payload: 1 Decrypts resource 1337 using a hard-coded 14-byte key "MjEh92jHaZZOl3" A python script, which can be used for decrypting this resource, is provided in the appendix below 2 The decrypted resource contains the C2 server’s IP address as well as the mutex name 3 4 Once a successful connection is made, the malware tries to fetch a response from the server through its custom protocol 5 Once data is received, the malware skips over the received bytes until the start byte 0x99 is found in the server response The start byte is followed by a DWORD representing the size of the following data string 6 The data string is encrypted with the above-mentioned encryption scheme with the hard-coded key “AjN28AcMaNX” 7 The data string can contain various commands sent by the C2 server These commands and their string arguments are expected to be in Unicode The following commands are accepted by the malware:    Conclusion  As with previous spear-phishing attacks seen conducted by this group, topics related to Indian Government and Military Affairs are still being used as the lure theme in these attacks and we observed that this group is still actively expanding their toolkit It comes as no surprise that cyber attacks against the Indian government continue, given the historically tense relations in the region Appendix   Encryption / Decryption algorithm translated into Python ### Response: .