EvilPlayout: Attack Against Iran’s State Broadcaster – Check Point Research

MITRE Techniques

• [T1485] Data Destruction – Wiper overwrites file content and can destroy storage, including the MBR. Quote: “The wiper has three modes to corrupt the files, and fills the bytes with random values.” and “DestroyMBR flag enables the malware to wipe the MBR by writing a hardcoded base64-encoded binary to the file precg.exe and then running it.”
• [T1070.001] Clear Windows Event Logs – Wiper deletes Windows Event Logs using the command: “for /F “tokens=*” %1 in (‘wevtutil.exe el’) DO wevtutil.exe cl “%1″”
• [T1059.003] Windows Command Shell – Batch-based payloads and launchers (e.g., playjfalcfgcdq.bat) are used to execute and orchestrate malware steps. Quote: “To kill the video stream already playing, the attackers used a batch script called playjfalcfgcdq.bat.”
• [T1053.005] Scheduled Task – Malicious service launches schedule tasks at startup. Quote: “At start, the service creates a scheduled task with the command: schtasks /create /TN “MicrosoftWindows.NET Framework.NETASM”/TR …”
• [T1543.003] Create or Modify System Process: Windows Service – Malware runs as a Windows Service (e.g., “Service1”). Quote: “If the malware has no arguments, it runs as a service named “Service1”.”
• [T1134] Access Token Manipulation – Privilege escalation via LsaAddAccountRights API call. Quote: “tries to gain privileges using the LsaAddAccountRights API function.”
• [T1113] Screen Capture – Winscreeny backdoor captures screenshots. Quote: “The main purpose of the backdoor is to make screenshots of the victim’s computer.”
• [T1090.001] Proxy – Backdoors use the compromised host as a proxy to the C2 URL. Quote: “After the ‘p=’ or ‘b=’ command is received, the backdoor uses the victim’s computer as a proxy to the URL it gets as an argument.”
• [T1071.001] Web Protocols – HttpCallbackService/C2 communication over HTTP. Quote: “Every 5 seconds, HttpCallbackService sends a request to the C&C URL… to receive the list of commands.”
• [T1560.001] Archive Collected Data – Local file manipulation via zip/unzip. Quote: “zip – Creates a zip file from the directory contents and returns it to the C&C.”
• [T1120] Peripheral Device Discovery – Avar.exe enumerates audio devices and plays a WAV on each one. Quote: “enumerate through all active audio devices and play the WAV file on each one.”