Targeted Attack on Government Entities in the Middle East | Part 1

MITRE Techniques

• [T1055 ] Process Injection – TELESHIM redirected execution into its payload through an installed hook and ran in the context of the host executable (‘By redirecting execution via an installed hook, the code is executed in the context of the host executable to evade security tools.’)
• [T1574.002 ] DLL Side-Loading – The attack chain began with a legitimate executable loading malicious DLLs such as AsTaskSched.dll and pthreadVC2.dll (‘the legitimate executable… sideloads a malicious DLL named AsTaskSched.dll’ / ‘sideloaded by the legitimate binary’)
• [T1204.002 ] User Execution: Malicious File – The campaign started from an ISO file used to launch the staged infection chain (‘The attack chain begins with an ISO file containing a legitimate RegSchdTask.exe file’)
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – TELESHIM and later stages created recurring tasks for persistence and execution (‘creates a scheduled task named shimgen that runs every 6 minutes’ / ‘schtasks /create …’)
• [T1036 ] Masquerading – The threat actor used benign-looking names and paths to hide malicious components (‘impersonate files related to Microsoft’s Platform Crypto Provider’ / ‘dropped with an appropriate name to blend in’)
• [T1027 ] Obfuscated Files or Information – TELESHIM and MIXEDKEY used encrypted strings, CFF, MBA, and opaque predicates to impede analysis (‘heavy code obfuscation techniques leveraging control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates’)
• [T1027.001 ] Binary Padding – MIXEDKEY bloated the binary with junk instructions and opaque predicates to deter reverse engineering (‘bloating the size of the binary and deterring reverse engineering’)
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – TELESHIM checked for hypervisors and RAM speed to detect analysis environments (‘checks bit 31 of the ECX register to detect the presence of a hypervisor’ / ‘check RAM speed’)
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – TELESHIM performed heavy I/O activity to stall emulation and virtual analysis (‘writes and reads back ~1 MB … in a loop of 1000 iterations’)
• [T1082 ] System Information Discovery – The operator ran commands such as hostname and ver to identify the infected system (‘Discover information about current users… and the hostname’)
• [T1016 ] System Network Configuration Discovery – The operator used ipconfig /all and ipconfig /displaydns to enumerate network settings (‘Discover information about the system’s network configuration’)
• [T1049 ] System Network Connections Discovery – netstat -ano was used to inspect active connections (‘Discover information about active network connections’)
• [T1083 ] File and Directory Discovery – The operator enumerated multiple directories to find staging locations and validate deployment (‘dir c:Users … dir C:ProgramDataIntel’)
• [T1057 ] Process Discovery – The operator used tasklist to list running processes (‘list of running processes’)
• [T1098 ] Account Manipulation – The campaign registered and targeted commands using the victim MAC address as an identifier for tasking (‘only executes commands addressed to its MAC address’)
• [T1105 ] Ingress Tool Transfer – TELESHIM downloaded additional files through Telegram API file retrieval (‘uses document.file_id … to fetch the file via /bot[TOKEN]/getFile’)
• [T1021.006 ] Remote Services: Windows Remote Management – Not observed; no evidence in the article.
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – TELESHIM executed attacker commands via cmd.exe /C (‘parsed as a command and executed using cmd.exe /C’)