Article Content Introduction In July 2018, FireEye devices detected and blocked what appears to be APT10 (Menupass) activity targeting the Japanese media sector APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009, and they have a history of targeting Japanese entities This backdoor is well-known in the security community as ANEL, and it used to come in beta or RC (release candidate) until recently Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor Although the contents of the malicious documents are unreadable (see Figure 3), the Japanese titles are related to maritime, diplomatic, and North Korean issues Table 1 shows the UPPERCUT indicators of compromise (IoCs) File Name   MD5   Size   C2    自民党海洋総合戦略小委員会が政府に提言申し入れ.doc Government Recommendations from the Liberal Democratic Party’s Comprehensive Strategic Maritime Subcommittee  4f83c01e8f7507d23c67ab085bf79e97  843022  eservake.jetos[.]com 82.221.100.52 151.106.53.147    グテマラ大使講演会案内状.doc Invitation to Lecture by Guatemalan Ambassador  f188936d2c8423cf064d6b8160769f21  720384    eservake.jetos[.]com 151.106.53.147 153.92.210.208     米国接近に揺れる北朝鮮内部.doc North Korean interior swayed by the approach of the United States  cca227f70a64e1e7fcf5bccdc6cc25dd  733184  eservake.jetos[.]com 153.92.210.208 167.99.121.203    Table 1: UPPERCUT IoCs For the North Korean lure, a news article with an identical title was readily available online It’s also worth noting that in the Guatemalan lure, the attacker used an unusual spelling of Guatemala in Japanese The top result of a Google search using the same spelling led us to the event website for the lecture of the Guatemalan Ambassador, held in August 2018 Figure 1 shows the screenshot of the event page Figure 1: Event Website for the Lecture of Guatemala Ambassador Figure 2 shows the macro function that displays the lure document At the bottom of this function, we can see the readable text that matches the contact information found in Figure 1 Thus, people who would have an interest in Latin American issues may have been the targets of this campaign Figure 2: Macro to display lure document The initial Word documents were password protected, likely in an effort to bypass detection Figure 3: Lure document Figure 4 shows what happens when the malicious macro is executed Figure 4: Macro to install UPPERCUT The execution workflow is as follows: 1.     The macro drops three PEM files, padre1.txt, padre2.txt, and padre3.txt, to the victim’s %TEMP% folder and then copies them from %TEMP% to the %AllUserProfile% folder libcurl.dll: Malicious Loader DLL 3F2E3AB9: Encrypted shellcode     Figure 5: Notepad++ signed updater 4.     The macro launches the legitimate executable GUP.exe The executable sideloads the malicious DLL (libcurl.dll), which decrypts and runs shellcode (3F2E3AB9) located in the same folder Before decoding the DLL, the shellcode uses an anti-debug technique based on ntdll_NtSetInformationThread which causes the thread to be detached from the debugger, as shown in Figure 6 The DLL is then loaded into memory and the randomly named exported function is called Figure 6: Anti-debug technique used by shellcode 5.     The macro deletes the initially dropped .txt files using Windows esentutl.exe and changes the document text to an embedded message The complete attack overview is shown in Figure 7 Figure 7: Attack overview Several threat actors leverage the technique of using Windows certutil.exe for payload decoding, and APT10 continues to employ this technique Evolution of UPPERCUT Figure 8 shows the timeline of updates for UPPERCUT The compile time of loaders in the newer version(s) are not shown here since the timestamps are overwritten and filled with zeroes We don’t have visibility into UPPERCUT 5.2.x series, but it’s possible that minor revisions were released every few months between December 2017 and May 2018 Figure 8: Timeline of UPPERCUT updates Unlike previous versions, the exported function names are randomized in the latest version (Table 2) The error code is the value returned by the GetLastError function and sent in the next beacon This was likely included to help the attackers understand the problem if the backdoor is unable to receive a response (Figure 9) This Cookie header is a unique indicator that can be used for network-based detection However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10 Figure 10: Blowfish key generation For instance, Table 3 lists the hard-coded C2 addresses, their MD5 hash, and the corresponding Blowfish key in the decoded payload of 126067d634d94c45084cbe1d9873d895 C2   MD5   Blowfish Key    hxxp[:]//151.106.53[.]147/VxQG  f613846eb5bed227ec1a5f8df7e678d0  bdc4b9f5af9868e028dd0adc10099a4e6656e9f0ad12b2e75a30f5ca0e34489d    hxxp[:]//153.92.210[.]208/wBNh1  50c60f37922ff2ff8733aaeaa9802da5  fb9f7fb3c709373523ff27824ed6a31d800e275ec5217d8a11024a3dffb577dd    hxxp[:]//eservake.jetos[.]com/qIDj  c500dae1ca41236830b59f1467ee96c1  d3450966ceb2eba93282aace7d7684380d87c6621bbd3c4f621caa079356004a    Default   Default  f12df6984bb65d18e2561bd017df29ee1cf946efa5e510802005aeee9035dd53    Table 3: Example of Blowfish keys In this example, the MD5 hash of hxxp[:]//151.106.53[.]147/VxQG will be f613846eb5bed227ec1a5f8df7e678d0 When the malware interacts with this URL, bdc4b9f5af9868e028dd0adc10099a4e6656e9f0ad12b2e75a30f5ca0e34489d will be selected as a Blowfish key If the MD5 hash of the URL does not match any of the listed hashes, then the default key f12df6984bb65d18e2561bd017df29ee1cf946efa5e510802005aeee9035dd53 will be used Table 4 shows the parameters sent to C2 server from the backdoor in the newer versions These are sent via POST request, as shown in Figure 9 Two more commands, 0xD290626C85FB1CE3 and 0x409C7A89CFF0A727, are supported in the newer versions (Table 5) In the newer versions of UPPERCUT, there is a significant change in the way backdoor initializes the Blowfish encryption key, which makes it harder for analysts to detect and decrypt the backdoor’s network communications This shows that APT10 is very capable of maintaining and updating their malware To mitigate the threat, users are advised to disable Office macros in their settings and not to open documents from unknown sources FireEye Multi-Vector Execution (MVX) engine is able to recognize and block this threat with the following detection names:  APT.Backdoor.Win.UPPERCUT FE_APT_Backdoor_Win32_UPPERCUT
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Introduction In July 2018, FireEye devices detected and blocked what appears to be APT10 (Menupass) activity targeting the Japanese media sector APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009, and they have a history of targeting Japanese entities This backdoor is well-known in the security community as ANEL, and it used to come in beta or RC (release candidate) until recently Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor Although the contents of the malicious documents are unreadable (see Figure 3), the Japanese titles are related to maritime, diplomatic, and North Korean issues Table 1 shows the UPPERCUT indicators of compromise (IoCs) File Name   MD5   Size   C2    自民党海洋総合戦略小委員会が政府に提言申し入れ.doc Government Recommendations from the Liberal Democratic Party’s Comprehensive Strategic Maritime Subcommittee  4f83c01e8f7507d23c67ab085bf79e97  843022  eservake.jetos[.]com 82.221.100.52 151.106.53.147    グテマラ大使講演会案内状.doc Invitation to Lecture by Guatemalan Ambassador  f188936d2c8423cf064d6b8160769f21  720384    eservake.jetos[.]com 151.106.53.147 153.92.210.208     米国接近に揺れる北朝鮮内部.doc North Korean interior swayed by the approach of the United States  cca227f70a64e1e7fcf5bccdc6cc25dd  733184  eservake.jetos[.]com 153.92.210.208 167.99.121.203    Table 1: UPPERCUT IoCs For the North Korean lure, a news article with an identical title was readily available online It’s also worth noting that in the Guatemalan lure, the attacker used an unusual spelling of Guatemala in Japanese The top result of a Google search using the same spelling led us to the event website for the lecture of the Guatemalan Ambassador, held in August 2018 Figure 1 shows the screenshot of the event page Figure 1: Event Website for the Lecture of Guatemala Ambassador Figure 2 shows the macro function that displays the lure document At the bottom of this function, we can see the readable text that matches the contact information found in Figure 1 Thus, people who would have an interest in Latin American issues may have been the targets of this campaign Figure 2: Macro to display lure document The initial Word documents were password protected, likely in an effort to bypass detection Figure 3: Lure document Figure 4 shows what happens when the malicious macro is executed Figure 4: Macro to install UPPERCUT The execution workflow is as follows: 1.     The macro drops three PEM files, padre1.txt, padre2.txt, and padre3.txt, to the victim’s %TEMP% folder and then copies them from %TEMP% to the %AllUserProfile% folder libcurl.dll: Malicious Loader DLL 3F2E3AB9: Encrypted shellcode     Figure 5: Notepad++ signed updater 4.     The macro launches the legitimate executable GUP.exe The executable sideloads the malicious DLL (libcurl.dll), which decrypts and runs shellcode (3F2E3AB9) located in the same folder Before decoding the DLL, the shellcode uses an anti-debug technique based on ntdll_NtSetInformationThread which causes the thread to be detached from the debugger, as shown in Figure 6 The DLL is then loaded into memory and the randomly named exported function is called Figure 6: Anti-debug technique used by shellcode 5.     The macro deletes the initially dropped .txt files using Windows esentutl.exe and changes the document text to an embedded message The complete attack overview is shown in Figure 7 Figure 7: Attack overview Several threat actors leverage the technique of using Windows certutil.exe for payload decoding, and APT10 continues to employ this technique Evolution of UPPERCUT Figure 8 shows the timeline of updates for UPPERCUT The compile time of loaders in the newer version(s) are not shown here since the timestamps are overwritten and filled with zeroes We don’t have visibility into UPPERCUT 5.2.x series, but it’s possible that minor revisions were released every few months between December 2017 and May 2018 Figure 8: Timeline of UPPERCUT updates Unlike previous versions, the exported function names are randomized in the latest version (Table 2) The error code is the value returned by the GetLastError function and sent in the next beacon This was likely included to help the attackers understand the problem if the backdoor is unable to receive a response (Figure 9) This Cookie header is a unique indicator that can be used for network-based detection However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10 Figure 10: Blowfish key generation For instance, Table 3 lists the hard-coded C2 addresses, their MD5 hash, and the corresponding Blowfish key in the decoded payload of 126067d634d94c45084cbe1d9873d895 C2   MD5   Blowfish Key    hxxp[:]//151.106.53[.]147/VxQG  f613846eb5bed227ec1a5f8df7e678d0  bdc4b9f5af9868e028dd0adc10099a4e6656e9f0ad12b2e75a30f5ca0e34489d    hxxp[:]//153.92.210[.]208/wBNh1  50c60f37922ff2ff8733aaeaa9802da5  fb9f7fb3c709373523ff27824ed6a31d800e275ec5217d8a11024a3dffb577dd    hxxp[:]//eservake.jetos[.]com/qIDj  c500dae1ca41236830b59f1467ee96c1  d3450966ceb2eba93282aace7d7684380d87c6621bbd3c4f621caa079356004a    Default   Default  f12df6984bb65d18e2561bd017df29ee1cf946efa5e510802005aeee9035dd53    Table 3: Example of Blowfish keys In this example, the MD5 hash of hxxp[:]//151.106.53[.]147/VxQG will be f613846eb5bed227ec1a5f8df7e678d0 When the malware interacts with this URL, bdc4b9f5af9868e028dd0adc10099a4e6656e9f0ad12b2e75a30f5ca0e34489d will be selected as a Blowfish key If the MD5 hash of the URL does not match any of the listed hashes, then the default key f12df6984bb65d18e2561bd017df29ee1cf946efa5e510802005aeee9035dd53 will be used Table 4 shows the parameters sent to C2 server from the backdoor in the newer versions These are sent via POST request, as shown in Figure 9 Two more commands, 0xD290626C85FB1CE3 and 0x409C7A89CFF0A727, are supported in the newer versions (Table 5) In the newer versions of UPPERCUT, there is a significant change in the way backdoor initializes the Blowfish encryption key, which makes it harder for analysts to detect and decrypt the backdoor’s network communications This shows that APT10 is very capable of maintaining and updating their malware To mitigate the threat, users are advised to disable Office macros in their settings and not to open documents from unknown sources FireEye Multi-Vector Execution (MVX) engine is able to recognize and block this threat with the following detection names:  APT.Backdoor.Win.UPPERCUT FE_APT_Backdoor_Win32_UPPERCUT ### Response: .