Article Content Campaign Details In September 2017, FireEye identified the FELIXROOT backdoor as a payload in a campaign targeting Ukrainians and reported it to our intelligence customers The campaign involved malicious Ukrainian bank documents, which contained a macro that downloaded a FELIXROOT payload, being distributed to targets FireEye recently observed the same FELIXROOT backdoor being distributed as part of a newer campaign Figure 1 shows the attack overview Figure 1: Attack overview The malware is distributed via Russian-language documents (Figure 2) that are weaponized with known Microsoft Office vulnerabilities The malicious document used is named “Seminar.rtf” The downloaded file is weaponized with CVE-2017-11882 Figure 2: Lure documents    Figure 3: Hex dump of embedded URL in Seminar.rtf Figure 4 shows the first payload trying to download the second stage Seminar.rtf This file drops the executable at %temp% (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9), which is used to drop and execute the FELIXROOT dropper component (MD5: 92F63B1227A6B37335495F9BCB939EA2) Figure 5 shows the command in the LNK file to execute the loader component of FELIXROOT Figure 5: Command in LNK file The embedded backdoor component is encrypted using custom encryption The file is decrypted and loaded directly in memory without touching the disk Technical Details After successful exploitation, the dropper component executes and drops the loader component The backdoor component is loaded in memory and has a single exported function Decryption logic used for ASCII strings is shown in Figure 6 Figure 6: ASCII decryption routine Decryption logic used for Unicode strings is shown in Figure 7 Figure 7: Unicode decryption routine Upon execution, a new thread is created where the backdoor sleeps for 10 minutes If the malware was launched by RUNDLL32.exe with parameter #1, then it proceeds with initial system triage before doing command and control (C2) network communications Figure 8 shows the full operation Figure 8: Initial execution process of backdoor component Table 1 shows the classes referred from the “ROOT\CIMV2” and “Root\SecurityCenter2” namespace Table 2 shows FELIXROOT backdoor capabilities Each command is performed in an individual thread Data sent over the network is encrypted and arranged in a custom structure All data is encrypted with AES, converted into Base64, and sent to the C2 server (Figure 10) Figure 10: POST request to C2 server All other fields, such as User-Agents, Content-Type, and Accept-Encoding, that are part of the request / response header are XOR encrypted and present in the malware The value “KdfrJKN” may be used as identification for the campaign and is found in the JOSN object in the file (Figure 11) Figure 11: Host information used in every communication The FELIXROOT backdoor has three parameters for C2 communication Each parameter provides information about the task performed on the target machine (Table 3) ‘&p=’  This parameter contains the information about data associated with the C2 server Figure 15 shows the structure used to send data to the server, and Figure 16 shows the structural representation of data used in C2 communications FELIXROOT backdoor contains several commands for specific tasks Threat actors will increasingly leverage these vulnerabilities in their attacks until they are no longer finding success, so organizations must ensure they are protected. At this time of writing, FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat We also advise that all industries remain on alert, as the threat actors involved in this campaign may eventually broaden the scope of their current targeting
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Campaign Details In September 2017, FireEye identified the FELIXROOT backdoor as a payload in a campaign targeting Ukrainians and reported it to our intelligence customers The campaign involved malicious Ukrainian bank documents, which contained a macro that downloaded a FELIXROOT payload, being distributed to targets FireEye recently observed the same FELIXROOT backdoor being distributed as part of a newer campaign Figure 1 shows the attack overview Figure 1: Attack overview The malware is distributed via Russian-language documents (Figure 2) that are weaponized with known Microsoft Office vulnerabilities The malicious document used is named “Seminar.rtf” The downloaded file is weaponized with CVE-2017-11882 Figure 2: Lure documents    Figure 3: Hex dump of embedded URL in Seminar.rtf Figure 4 shows the first payload trying to download the second stage Seminar.rtf This file drops the executable at %temp% (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9), which is used to drop and execute the FELIXROOT dropper component (MD5: 92F63B1227A6B37335495F9BCB939EA2) Figure 5 shows the command in the LNK file to execute the loader component of FELIXROOT Figure 5: Command in LNK file The embedded backdoor component is encrypted using custom encryption The file is decrypted and loaded directly in memory without touching the disk Technical Details After successful exploitation, the dropper component executes and drops the loader component The backdoor component is loaded in memory and has a single exported function Decryption logic used for ASCII strings is shown in Figure 6 Figure 6: ASCII decryption routine Decryption logic used for Unicode strings is shown in Figure 7 Figure 7: Unicode decryption routine Upon execution, a new thread is created where the backdoor sleeps for 10 minutes If the malware was launched by RUNDLL32.exe with parameter #1, then it proceeds with initial system triage before doing command and control (C2) network communications Figure 8 shows the full operation Figure 8: Initial execution process of backdoor component Table 1 shows the classes referred from the “ROOT\CIMV2” and “Root\SecurityCenter2” namespace Table 2 shows FELIXROOT backdoor capabilities Each command is performed in an individual thread Data sent over the network is encrypted and arranged in a custom structure All data is encrypted with AES, converted into Base64, and sent to the C2 server (Figure 10) Figure 10: POST request to C2 server All other fields, such as User-Agents, Content-Type, and Accept-Encoding, that are part of the request / response header are XOR encrypted and present in the malware The value “KdfrJKN” may be used as identification for the campaign and is found in the JOSN object in the file (Figure 11) Figure 11: Host information used in every communication The FELIXROOT backdoor has three parameters for C2 communication Each parameter provides information about the task performed on the target machine (Table 3) ‘&p=’  This parameter contains the information about data associated with the C2 server Figure 15 shows the structure used to send data to the server, and Figure 16 shows the structural representation of data used in C2 communications FELIXROOT backdoor contains several commands for specific tasks Threat actors will increasingly leverage these vulnerabilities in their attacks until they are no longer finding success, so organizations must ensure they are protected. At this time of writing, FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat We also advise that all industries remain on alert, as the threat actors involved in this campaign may eventually broaden the scope of their current targeting ### Response: .