Clean Rooms, Nuclear Missiles, and SideCopy, Oh My! | FortiGuard Labs

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – The initial infection vector is suspected to be a phishing e-mail. ‘The initial infection vector is suspected to be a phishing e-mail.’
• [T1036] Masquerading – The Windows shortcut file DRDO-K4 Missile Clean room.pptx.lnk masquerades as a PPTX; ‘The Windows shortcut file does not open a PowerPoint file (at least immediately)…’
• [T1218.005] Mshta – The LNK uses mshta.exe to reach out to a domain controlled by the attacker and download Pantomime.hta. ‘…reach out to a domain controlled by the attacker using the utility for Microsoft HTML Applications (HTAs), or “mshta.exe”.’
• [T1574.002] DLL Side-Loading – DUser.dll is dropped in the same directory as cridviz.exe to be loaded by it and executed. ‘sideloading to load its code into memory via dropping the malicious DLL “DUser.dll” in the directory with “cridviz.exe”.’
• [T1055] Process Injection / In-Memory Execution – The newly decoded payloads are deserialized and executed in memory (e.g., ‘punctureTyres’ decoded and deserialized to run ‘PreBot.dll’).
• [T1555.003] Credentials in Windows Credential Manager – The RAT utilizes the Windows Credential Manager via “Credential Backup and Restore Wizard” to access credentials. ‘The Windows Credential Manager to provide a method for backing up and restoring saved credentials on the system.’
• [T1047] Windows Management Instrumentation – The decoded base64 block queries antivirus information via WMI (e.g., ‘Select * From AntiVirusProduct’).
• [T1105] Ingress Tool Transfer – The payload is downloaded from remote servers (e.g., jquery.txt and jquery.hta). ‘getThirdStrike… to download file jquery.hta from cornerstonebeverly.org/js/files/ntfonts/jquery.txt’.
• [T1071.001] Web Protocols – The RAT communicates using HTTP and TCP with a distinct user-agent. ‘The RAT can communicate over TCP using raw sockets or via HTTP.’
• [T1041] Exfiltration Over C2 Channel – Antivirus status and other data is posted to C2 endpoints. ‘via HTTP POST through the “pkg.infinity” function, which will reach out to cornerstonebeverly.org/js/files/ntfonts/avena/’.
• [T1574.002] DLL Side-Loading – Additional dependencies are loaded by cridviz.exe through dropping DUser.dll in its directory, enabling the RAT to load in memory. ‘sideloading to load its code into memory… by dropping the malicious DLL “DUser.dll” in the directory with “cridviz.exe”.’