ChChes

The attackers spoofed several sender email addresses to send spear phishing emails, most notably public addresses associated with the Sasakawa Peace Foundation and The White House.

It employs various poisoned pawns in the form of malware-laden spear-phishing emails containing decoy documents.

Most of the attacks against academics involved webmail addresses using names of academics but are not tied to those academics openly online.

上記PowerShellスクリプトによって、指定されているURLからPowerShellスクリプトを含むファイルがダウンロードされます。ダウンロードされたスクリプトは32bitのpowershell.exe(syswow64\WindowsPowerShell\v1.0\powershell)に読み込まれて実行されます。 | ショートカットファイルを開くと内部に含まれている次のPowerShellスクリプトが実行されます。 powershell.exe -nop -w hidden -exec bypass -enc ...

JPCERT also recently analyzed this family and was able to collect modules that give ChChes the following functions: ... Execute shell command

The ‘Base64-Encoded Data’ field contains a fairly complex structure that will store a module that is to be loaded and subsequently run by ChChes.

今回確認した検体は、ショートカットファイルを悪用してマルウエアの感染を行います。ショートカットファイルが開かれると、PowerShellスクリプトを含むファイルが外部からダウンロードされ、実行されます。

Upon their extraction, malicious code is injected into the process of a legitimate file/application (DLL hijacking). ChessMaster takes it up a notch via load-time dynamic linking to trigger the malicious DLL’s function.

ChChes hides part of the decryption key and payload in registry keys to make it harder to reverse engineer.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

次に、PowerShellスクリプト内に含まれるChChesのコード(バージョン1.6.4)が、powershell.exeにインジェクションされ、実行されます。

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

「-enc」以降のPowerShellスクリプトはエンコードされており、以下がデコードしたものです。

Priority MITRE ATT&CK Mapping ... Defense Evasion T1027.013 Encrypted/Encoded File Encoded malware strings and obfuscation

This malware is provided with an icon that appears to be that of a Microsoft Word document.

次に、PowerShellスクリプト内に含まれるChChesのコード(バージョン1.6.4)が、powershell.exeにインジェクションされ、実行されます。

The latter method makes ChChes a fileless malware.

Upon their extraction, malicious code is injected into the process of a legitimate file/application (DLL hijacking). ChessMaster takes it up a notch via load-time dynamic linking to trigger the malicious DLL’s function.

このPowerShellスクリプトやインジェクションされるChChesは、感染端末上でファイルとして保存されないため、ChChes自身はメモリ上にのみ存在することになります。

ChChes hides part of the decryption key and payload in registry keys to make it harder to reverse engineer.

the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

ChessMaster draws on legitimate email and browser password recovery and dumping tools they’ve misused and modified for their campaign. These can restore forgotten passwords, which are then dumped and retrieved.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

ChChes proceeds to collect the following information about the victim: Hostname Process Identifier (PID) Current working directory (%TEMP%) Window resolution Microsoft Windows version

Additional malware are introduced to the infected system for persistence.

Examples include: "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header," "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers," and "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."

インジェクションされたChChesは前号の分析センターだよりで紹介した通り、C2サーバから命令とモジュールを受信します。

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

JPCERT also recently analyzed this family and was able to collect modules that give ChChes the following functions: ... Uploading and downloading files Loading and executing the DLL

The data is embedded within the ‘Cookie’ HTTP header... The data embedded within the Cookie header is encrypted using a unique technique.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.