TrendMicro Patchwork Dec 2017

BADNEWS copies files with certain extensions from USB devices to
a predefined directory.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Patchwork has obfuscated a script with Crypto Obfuscator.

Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.

NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

Socksbot creates a suspended svchost process and injects its DLL into it.

BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

Socksbot can list all running processes.

Socksbot can write and execute PowerShell scripts.

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.

Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.

BADNEWS is capable of executing commands via cmd.exe.

Patchwork used Visual Basic Scripts (VBS) on victim machines.

Patchwork removed certain files and replaced them so they could not be retrieved.

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.

NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.

Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

NDiskMonitor can obtain a list of all files and directories as well as logical drives.

A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.

BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

Socksbot can start SOCKS proxy threads.

BADNEWS collects C2 information via a dead drop resolver.

BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

Patchwork payloads download additional files from the C2 server.

BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

NDiskMonitor can download and execute a file from given URL.

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.

A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.

Socksbot can take screenshots.

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

BADNEWS encodes C2 traffic with base64.

Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.

Patchwork leveraged the DDE protocol to deliver their malware.

Patchwork encrypted the collected files' path with AES and then encoded them with base64.

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

Patchwork has used spearphishing with links to deliver files with exploits to initial victims.

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.

Patchwork enumerated all available drives on the victim's machine.