Chasing Chaes Kill Chain – Avast Threat Labs

MITRE Techniques

• [T1059.006] Python – The malware uses Python as part of a multi-stage delivery chain: “The malware is distributed through many compromised websites, including highly credible sites. Chaes is characterized by the multiple-stage delivery that utilizes scripting frameworks such as JScript, Python, and NodeJS.”
• [T1059.007] JavaScript – The campaign relies on JavaScript-based components and Chrome extensions: “malicious Google Chrome extensions.”
• [T1112] Modify Registry – The loader writes the registry path for configuration: “Writes the path of the newly created extensions folder to HKEY_CURRENT_USERSoftwarePythonConfigPath.”
• [T1053.005] Scheduled Task – The loader creates persistence via a scheduled task: “Sched.js accomplishes this by creating a Scheduled Task as its primary means.”
• [T1547.001] Boot or Logon Autostart Execution – as a backup, a Startup link is created: “and creating a Startup link as its backup means.”
• [T1055] Process Injection – The Chaes loader loads into memory: “chaes_vy.dll is loaded into memory by an embedded shellcode.”
• [T1071.001] Web Protocols – The C2 channel uses HTTP/Web protocols to transfer data: “Index.js utilizes two methods of communicating with the attacker: through WebSocket and through HTTP.”
• [T1056.001] Keyboard Input Capture – The malware supports keystroke collection as part of its payload: “Send command such as keystroke, mouseclick.”
• [T1105] Ingress Tool Transfer – The loader downloads additional payloads from C2: “download 32bit and 64bit __init__.py scripts along with 2 encrypted payloads.”
• [T1027] Obfuscated/Encrypted Files and Information – The binaries are encrypted and unpacked by the loader: “All the binaries with dll_filename argument … are encrypted, including the ones inside the RAR archive.”