Cybereason Chaes Nov 2020

Some versions of Chaes stored its instructions (otherwise in a `instructions.ini` file) in the Registry.

Chaes has collected the username and UID from the infected machine.

Chaes has used an unsigned, crafted DLL module named hha.dll that was designed to look like a legitimate 32-bit Windows DLL.

Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.

Chaes has a module to perform any API hooking it desires.

Chaes has used cmd to execute tasks on the system.

Chaes has used VBscript to execute malicious code.

Chaes has used Python scripts for execution and the installation of additional files.

Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.

Chaes has used HTTP for C2 communications.

Chaes has collected system information, including the machine name and OS version.

Chaes can download additional files onto an infected machine.

Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.

Chaes can modify Registry values to stored information and establish persistence.

Chaes can capture screenshots of the infected machine.

Chaes has used Base64 to encode C2 communications.

Chaes has decrypted an AES encrypted binary file to trigger the download of other files.

Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.

Chaes requires the user to click on the malicious Word document to execute the next part of the attack.

Chaes has used Installutill to download content.

Chaes has used .MSI files as an initial way to start the infection chain.

Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.

Chaes has used a script that extracts the web session cookie and sends it to the C2 server.

Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.

Chaes can steal login credentials and stored financial information from the browser.

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.

Chaes has used encryption for its C2 channel.

Chaes has used search order hijacking to load a malicious DLL.