Article Content CozyDuke (aka CozyBear, CozyCar or “Office Monkeys”) is a precise attacker Kaspersky Lab has observed signs of attacks against government organizations and commercial entities in the US, Germany, South Korea and Uzbekistan In 2014, targets included the White House and the US Department of State, as believed The operation presents several interesting aspects extremely sensitive high profile victims and targets evolving crypto and anti-detection capabilities strong malware functional and structural similarities mating this toolset to early MiniDuke second stage components, along with more recent CosmicDuke and OnionDuke components The actor often spearphishes targets with e-mails containing a link to a hacked website In other highly successful runs, this actor sends out phony flash videos directly as email attachments A clever example is “Office Monkeys LOL Video.zip” The executable within not only plays a flash video, but drops and runs another CozyDuke executable These videos are quickly passed around offices with delight while systems are infected in the background silently Recent CozyDuke APT activity attracted significant attention in the news: Sources: State Dept hack the ‘worst ever’, CNN News, March 2015White House computer network ‘hacked’, BBC News, October 2014Three Months Later, State Department Hasn’t Rooted Out Hackers, Wall Street Journal, February 2015State Department shuts down its e-mail system amid concerns about hacking, Washington Post, November 2014  Let’s examine a smattering of representative CozyDuke files and data There is much to their toolset Office Monkeys dropper analysis CozyDuke droppers and spyware components often maintain fairly common characteristics, but these files’ functionality are modified in slight ways depending on the team’s needs This rapid development and deployment is interesting The cab file is decompressed and its contents are created on disk It runs atiumdag.dll with two parameter values, it’s only export and an arbitrary pid,  i.e.: “C:\Documents and Settings\user\Application Data\ATI_Subsystem\amdocl_as32.exe” “C:\Documents and Settings\user\Application Data\ATI_Subsystem\atiumdag.dll””, ADL2_ApplicationProfiles_System_Reload 1684″ This dll is built with anti-AV protections as well However, it looks for a different but overlapping set, and the random duplication suggests that this component was cobbled together with its dropper, partly regionally based on target selection K7 KASPERSKY AVG The code collects information about the system and xml formats this data prior to encryption for proper parsing:  Finally, this process beacons to www.sanjosemaristas.com, which appears to be a site that has been compromised and misused multiple times in the past couple of years It uses standard Win32 base cryptography functions to generate a CALG_RC4 session key to encrypt the collected data communications and POSTs it to the server Here’s how it looks decrypted:  Second stage malware and communications: The attackers send commands and new modules to be executed to the victims through the C&Cs The C&C scripts store these temporarily until the victim next connects to retrieve local files Decoding them resulted in the following payloads: 59704bc8bedef32709ab1128734aa846, ChromeUpdate.ex_ 5d8835982d8bfc8b047eb47322436c8a, cmd_task.dll e0b6f0d368c81a0fb197774d0072f759, screenshot_task.dll Decoding them also resulted in a set of tasking files maintaining agent commands and parameter values: conf.xml And a set of “reporting” files, maintaining stolen system “info”, error output, and “AgentInfo” output, from victim systems: DCOM_amdocl_ld_API_.raw Util_amdave_System_.vol Last_amdpcom_Subsystem_.max Data_amdmiracast_API_.aaf 7.txt screenshot_task.dll is a 32-bit dll used to take a screenshot of the full desktop window and save it as a bitmap in %temp% The number of times the screenshot is repeated is configurable within the xml task file cmd_task.dll is a 32-bit dll that maintains several primitives Each of these payloads is delivered together with a configuration file that explains how to run it, for instance:  In another tasking, we notice a tracked victim:  Attackers map a network drive use Microsoft OneDrive to run further tools:  They copy down a base64 encoded document from Microsoft OneDrive to the victim system and decode it there:  Not everything works as planned, so they maintain error reporting facility for the c2 communications:  Furthermore, ChromeUpdate is a 64-bit executable (which appears to be a WEXTRACT package) that oddly drops a 32-bit Dll Cache.dll is simply stored as a cabinet file in the ChromeUpdate’s resource section It maintains eight exports, including DllMain: ADB_Add ADB_Cleanup ADB_Initnj ADB_Load ADB_Release ADB_Remove ADB_Setup ADB_Setup is a entry point that simply spawns another thread and waits for completion Above, we see a new thread created with the start address of Cache.dll export  “ADB_Load” by the initial thread This exported function is passed control while the initial thread runs a Windows message loop Observed keys that remind us of the Cosmicduke communications include: status= k= mode= ajax= name= subNodeId= nodeId= r= t= id= item= item_id= js= j= v= json= i= c= x= a=   Connections with MiniDuke/CosmicDuke/OnionDuke: One of the second stage modules of CozyDuke/Cozy Bear, Show.dll, is particularly interesting because it appears to have been built onto the same platform as OnionDuke Below we compare Show.dll with the OnionDuke sample MD5: c8eb6040fd02d77660d19057a38ff769 Both have exactly the same export tables and appear to be called internally “UserCache.dll”:  This seems to indicate the authors of OnionDuke and CozyDuke / Cozy Bear are the same, or working together Another interesting comparison of two other files matches a recent second stage tool from the CozyDuke attacks with a second stage component from other Miniduke/Onionduke attacks The table below presents the function matches based on size data, but the calls, jmps and code all match as well The contents of only one of these exports in update.dll has no match whatsoever in cache.dll Unlike the atiumdag.dll file above, however, cache.dll and update.dll do not maintain anti-AV and anti-analysis functionality sets This rotating functionality seems representational for the set, along with other characteristics Their custom backdoor components appear to slightly evolve over time, with modifications to anti-detection, cryptography, and trojan functionality changing per operation This rapid development and deployment reminds us of the APT28/Sofacy toolset, especially the coreshell and chopstick components We expect ongoing and further activity from this group in the near future and variations on the malware used in previous duke-ish incidents For more information about MiniDuke, CosmicDuke and OnionDuke, please see References
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content CozyDuke (aka CozyBear, CozyCar or “Office Monkeys”) is a precise attacker Kaspersky Lab has observed signs of attacks against government organizations and commercial entities in the US, Germany, South Korea and Uzbekistan In 2014, targets included the White House and the US Department of State, as believed The operation presents several interesting aspects extremely sensitive high profile victims and targets evolving crypto and anti-detection capabilities strong malware functional and structural similarities mating this toolset to early MiniDuke second stage components, along with more recent CosmicDuke and OnionDuke components The actor often spearphishes targets with e-mails containing a link to a hacked website In other highly successful runs, this actor sends out phony flash videos directly as email attachments A clever example is “Office Monkeys LOL Video.zip” The executable within not only plays a flash video, but drops and runs another CozyDuke executable These videos are quickly passed around offices with delight while systems are infected in the background silently Recent CozyDuke APT activity attracted significant attention in the news: Sources: State Dept hack the ‘worst ever’, CNN News, March 2015White House computer network ‘hacked’, BBC News, October 2014Three Months Later, State Department Hasn’t Rooted Out Hackers, Wall Street Journal, February 2015State Department shuts down its e-mail system amid concerns about hacking, Washington Post, November 2014  Let’s examine a smattering of representative CozyDuke files and data There is much to their toolset Office Monkeys dropper analysis CozyDuke droppers and spyware components often maintain fairly common characteristics, but these files’ functionality are modified in slight ways depending on the team’s needs This rapid development and deployment is interesting The cab file is decompressed and its contents are created on disk It runs atiumdag.dll with two parameter values, it’s only export and an arbitrary pid,  i.e.: “C:\Documents and Settings\user\Application Data\ATI_Subsystem\amdocl_as32.exe” “C:\Documents and Settings\user\Application Data\ATI_Subsystem\atiumdag.dll””, ADL2_ApplicationProfiles_System_Reload 1684″ This dll is built with anti-AV protections as well However, it looks for a different but overlapping set, and the random duplication suggests that this component was cobbled together with its dropper, partly regionally based on target selection K7 KASPERSKY AVG The code collects information about the system and xml formats this data prior to encryption for proper parsing:  Finally, this process beacons to www.sanjosemaristas.com, which appears to be a site that has been compromised and misused multiple times in the past couple of years It uses standard Win32 base cryptography functions to generate a CALG_RC4 session key to encrypt the collected data communications and POSTs it to the server Here’s how it looks decrypted:  Second stage malware and communications: The attackers send commands and new modules to be executed to the victims through the C&Cs The C&C scripts store these temporarily until the victim next connects to retrieve local files Decoding them resulted in the following payloads: 59704bc8bedef32709ab1128734aa846, ChromeUpdate.ex_ 5d8835982d8bfc8b047eb47322436c8a, cmd_task.dll e0b6f0d368c81a0fb197774d0072f759, screenshot_task.dll Decoding them also resulted in a set of tasking files maintaining agent commands and parameter values: conf.xml And a set of “reporting” files, maintaining stolen system “info”, error output, and “AgentInfo” output, from victim systems: DCOM_amdocl_ld_API_.raw Util_amdave_System_.vol Last_amdpcom_Subsystem_.max Data_amdmiracast_API_.aaf 7.txt screenshot_task.dll is a 32-bit dll used to take a screenshot of the full desktop window and save it as a bitmap in %temp% The number of times the screenshot is repeated is configurable within the xml task file cmd_task.dll is a 32-bit dll that maintains several primitives Each of these payloads is delivered together with a configuration file that explains how to run it, for instance:  In another tasking, we notice a tracked victim:  Attackers map a network drive use Microsoft OneDrive to run further tools:  They copy down a base64 encoded document from Microsoft OneDrive to the victim system and decode it there:  Not everything works as planned, so they maintain error reporting facility for the c2 communications:  Furthermore, ChromeUpdate is a 64-bit executable (which appears to be a WEXTRACT package) that oddly drops a 32-bit Dll Cache.dll is simply stored as a cabinet file in the ChromeUpdate’s resource section It maintains eight exports, including DllMain: ADB_Add ADB_Cleanup ADB_Initnj ADB_Load ADB_Release ADB_Remove ADB_Setup ADB_Setup is a entry point that simply spawns another thread and waits for completion Above, we see a new thread created with the start address of Cache.dll export  “ADB_Load” by the initial thread This exported function is passed control while the initial thread runs a Windows message loop Observed keys that remind us of the Cosmicduke communications include: status= k= mode= ajax= name= subNodeId= nodeId= r= t= id= item= item_id= js= j= v= json= i= c= x= a=   Connections with MiniDuke/CosmicDuke/OnionDuke: One of the second stage modules of CozyDuke/Cozy Bear, Show.dll, is particularly interesting because it appears to have been built onto the same platform as OnionDuke Below we compare Show.dll with the OnionDuke sample MD5: c8eb6040fd02d77660d19057a38ff769 Both have exactly the same export tables and appear to be called internally “UserCache.dll”:  This seems to indicate the authors of OnionDuke and CozyDuke / Cozy Bear are the same, or working together Another interesting comparison of two other files matches a recent second stage tool from the CozyDuke attacks with a second stage component from other Miniduke/Onionduke attacks The table below presents the function matches based on size data, but the calls, jmps and code all match as well The contents of only one of these exports in update.dll has no match whatsoever in cache.dll Unlike the atiumdag.dll file above, however, cache.dll and update.dll do not maintain anti-AV and anti-analysis functionality sets This rotating functionality seems representational for the set, along with other characteristics Their custom backdoor components appear to slightly evolve over time, with modifications to anti-detection, cryptography, and trojan functionality changing per operation This rapid development and deployment reminds us of the APT28/Sofacy toolset, especially the coreshell and chopstick components We expect ongoing and further activity from this group in the near future and variations on the malware used in previous duke-ish incidents For more information about MiniDuke, CosmicDuke and OnionDuke, please see References ### Response: .