We assume that these modifications were performed to avoid detection based on public IOCs.The article describes the malicious document and the Seduploader reconnaissance malware, especially the difference with the previous versions.Malicious Office DocumentDecoy DocumentThe decoy document is a flyer concerning the Cyber Conflict U.S conference with the following filename Conference_on_Cyber_Conflict.doc It contains 2 pages with the logo of the organizer and the sponsors:Due to the nature of the document, we assume that the targeted people are linked or interested by the cybersecurity landscape The exact content of the document can be found online on the conference website The attackers probably copy/pasted it into Word to create the malicious document.VBAThe Office document contains a VBA script Some of this information can be directly extracted from the Windows explorer by looking at the properties of the file The "Hyperlink Base" must be extracted using another tool, strings is capable of obtaining this by looking for long strings Pay close attention to the contents of these fields as they appear base64 encoded.This extracted information is concatenated together to make a single variable This variable is decoded with the base64 algorithm in order to get a Windows library (PE file) which is written to disk We see that this file drops 2 additional files: netwf.bat and netwf.dll We can also see 2 VBA variable names: PathPld, probably for Path Payload, and PathPldBt, for Path Payload Batch.Seduploader VariantDropper AnalysisAs opposed to previous campaigns performed by this actor, this latest version does not contain privilege escalation and it simply executes the payload and configures persistence mechanisms In this case, explorer.exe will instance the MMDeviceEnumerator class and will execute the payload.Payload AnalysisThe payload features are similar to the previous versions of Seduploader We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74 Of the 195 functions of the new sample, 149 are strictly identical, 16 match at 90% and 2 match at 80%:In the previous campaign where adversaries used Office document exploits as an infection vector, the payload was executed in the Office word process In this campaign, adversaries did not use any exploit Instead,the payload is executed in standalone mode by rundll32.exe.Adversaries also changed some constants, such as the XOR key used in the previous version The key in our version is:key=b"\x08\x7A\x05\x04\x60\x7c\x3e\x3c\x5d\x0b\x18\x3c\x55\x64"The MUTEX name is different too: FG00nxojVs4gLBnwKc7HhmdK0hHere are some of the Seduploader features:Screenshot capture (with the GDI API);data/configuration exfiltration;Execution of code;File downloading;The Command & Control (CC) of the analysed sample is myinvestgroup[.]com During the investigation, the server did not provide any configuration to the infected machines Based on the metadata of the Office documents and the PE files, the attackers had created the file on Wednesday, the 4th of October We can see, in Cisco Umbrella, a peak in activities 3 days later, Saturday the 7th of October:ConclusionAnalysis of this campaign shows us once more that attackers are creative and use the news to compromise the targets This campaign has most likely been created to allow the targeting of people linked to or interested by cybersecurity, so probably the people who are more sensitive to cybersecurity threats In this case, Group 74 did not use an exploit or any 0-day but simply used scripting language embedded within the Microsoft Office document Due to this change, the fundamental compromise mechanism is different as the payload is executed in a standalone mode The reasons for this are unknown, but, we could suggest that they did not want to utilize any exploits to ensure they remained viable for any other operations Actors will often not use exploits due to the fact that researchers can find and eventually patch these which renders the actors weaponized platforms defunct Additionally the author did some small updates after publications from the security community, again this is common for actors of this sophisticated nature, once their campaigns have been exposed they will often try to change tooling to ensure better avoidance For example the actor changed the XOR key and the MUTEX name We assume that these modifications were performed in order to avoid detection based on public IOCs
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: We assume that these modifications were performed to avoid detection based on public IOCs.The article describes the malicious document and the Seduploader reconnaissance malware, especially the difference with the previous versions.Malicious Office DocumentDecoy DocumentThe decoy document is a flyer concerning the Cyber Conflict U.S conference with the following filename Conference_on_Cyber_Conflict.doc It contains 2 pages with the logo of the organizer and the sponsors:Due to the nature of the document, we assume that the targeted people are linked or interested by the cybersecurity landscape The exact content of the document can be found online on the conference website The attackers probably copy/pasted it into Word to create the malicious document.VBAThe Office document contains a VBA script Some of this information can be directly extracted from the Windows explorer by looking at the properties of the file The "Hyperlink Base" must be extracted using another tool, strings is capable of obtaining this by looking for long strings Pay close attention to the contents of these fields as they appear base64 encoded.This extracted information is concatenated together to make a single variable This variable is decoded with the base64 algorithm in order to get a Windows library (PE file) which is written to disk We see that this file drops 2 additional files: netwf.bat and netwf.dll We can also see 2 VBA variable names: PathPld, probably for Path Payload, and PathPldBt, for Path Payload Batch.Seduploader VariantDropper AnalysisAs opposed to previous campaigns performed by this actor, this latest version does not contain privilege escalation and it simply executes the payload and configures persistence mechanisms In this case, explorer.exe will instance the MMDeviceEnumerator class and will execute the payload.Payload AnalysisThe payload features are similar to the previous versions of Seduploader We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74 Of the 195 functions of the new sample, 149 are strictly identical, 16 match at 90% and 2 match at 80%:In the previous campaign where adversaries used Office document exploits as an infection vector, the payload was executed in the Office word process In this campaign, adversaries did not use any exploit Instead,the payload is executed in standalone mode by rundll32.exe.Adversaries also changed some constants, such as the XOR key used in the previous version The key in our version is:key=b"\x08\x7A\x05\x04\x60\x7c\x3e\x3c\x5d\x0b\x18\x3c\x55\x64"The MUTEX name is different too: FG00nxojVs4gLBnwKc7HhmdK0hHere are some of the Seduploader features:Screenshot capture (with the GDI API);data/configuration exfiltration;Execution of code;File downloading;The Command & Control (CC) of the analysed sample is myinvestgroup[.]com During the investigation, the server did not provide any configuration to the infected machines Based on the metadata of the Office documents and the PE files, the attackers had created the file on Wednesday, the 4th of October We can see, in Cisco Umbrella, a peak in activities 3 days later, Saturday the 7th of October:ConclusionAnalysis of this campaign shows us once more that attackers are creative and use the news to compromise the targets This campaign has most likely been created to allow the targeting of people linked to or interested by cybersecurity, so probably the people who are more sensitive to cybersecurity threats In this case, Group 74 did not use an exploit or any 0-day but simply used scripting language embedded within the Microsoft Office document Due to this change, the fundamental compromise mechanism is different as the payload is executed in a standalone mode The reasons for this are unknown, but, we could suggest that they did not want to utilize any exploits to ensure they remained viable for any other operations Actors will often not use exploits due to the fact that researchers can find and eventually patch these which renders the actors weaponized platforms defunct Additionally the author did some small updates after publications from the security community, again this is common for actors of this sophisticated nature, once their campaigns have been exposed they will often try to change tooling to ensure better avoidance For example the actor changed the XOR key and the MUTEX name We assume that these modifications were performed in order to avoid detection based on public IOCs ### Response: .