Loading malware…
ChChes is a modular Windows backdoor associated with the China-linked cyberespionage group APT10, also known as menuPass and Stone Panda. It serves as an initial foothold, collecting victim information and retrieving additional modules to extend its functionality. ChChes has been used in spearphishing campaigns against Japanese academic institutions, pharmaceutical organizations, and manufacturing interests, and as a principal backdoor in the Japan-focused ChessMaster campaign.
ChChes collects host and execution-environment information, including the hostname, process identifier, working directory, screen resolution, and Windows version. It communicates over HTTP using Cookie headers to carry encoded and encrypted command-and-control data. Its communications employ custom Base64-based encoding and RC4 encryption, while additional modules support AES-encrypted communications, shell command execution, file upload and download, DLL loading and execution, and task listing. It can also steal credentials stored in Internet Explorer and modify the victim's proxy configuration.
Delivery chains have used malicious shortcuts and PowerShell scripts, including scripts adapted from PowerSploit, to load ChChes directly into memory or inject it into a PowerShell process. These techniques allow fileless execution, often accompanied by decoy Office documents. Other defense-evasion measures include runtime packing, layered XOR and AES protection, and executable names resembling antivirus software. Some samples were signed using a revoked certificate previously used by HackingTeam and exposed following that company's breach.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earth Yako’s MirrorKey malware uses the same encryption routine as the one used by APT10 malware families RedLeaves and ChChes in the past.
ChessMaster’s name is from pieces of chess/checkers/draughts we found in the resource section of the main backdoor they use against their targets: ChChes, which Trend Micro detects as BKDR_CHCHES.
While the original campaign was comprehensive and used remote access Trojans (RATs) such as ChChes and RedLeaves, this new campaign used a new backdoor.
Tools QuasarRAT, RedLeaves, PoisonIvy, ChChes, QuasarRAT Loader, PlugX, ANEL, Cobalt Strike
38 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers spoofed several sender email addresses to send spear phishing emails, most notably public addresses associated with the Sasakawa Peace Foundation and The White House.
It employs various poisoned pawns in the form of malware-laden spear-phishing emails containing decoy documents.
Most of the attacks against academics involved webmail addresses using names of academics but are not tied to those academics openly online.
"modules with the following functions... Execute shell commands"
上記PowerShellスクリプトによって、指定されているURLからPowerShellスクリプトを含むファイルがダウンロードされます。ダウンロードされたスクリプトは32bitのpowershell.exe(syswow64\WindowsPowerShell\v1.0\powershell)に読み込まれて実行されます。 | ショートカットファイルを開くと内部に含まれている次のPowerShellスクリプトが実行されます。 powershell.exe -nop -w hidden -exec bypass -enc ...
JPCERT also recently analyzed this family and was able to collect modules that give ChChes the following functions: ... Execute shell command
The ‘Base64-Encoded Data’ field contains a fairly complex structure that will store a module that is to be loaded and subsequently run by ChChes.
今回確認した検体は、ショートカットファイルを悪用してマルウエアの感染を行います。ショートカットファイルが開かれると、PowerShellスクリプトを含むファイルが外部からダウンロードされ、実行されます。
Upon their extraction, malicious code is injected into the process of a legitimate file/application (DLL hijacking). ChessMaster takes it up a notch via load-time dynamic linking to trigger the malicious DLL’s function.
ChChes hides part of the decryption key and payload in registry keys to make it harder to reverse engineer.
[ChChes](https://attack.mitre.org/software/S0144) establishes persistence by adding a Registry Run key.(Citation: PWC Cloud Hopper Technical Annex April 2017)
次に、PowerShellスクリプト内に含まれるChChesのコード(バージョン1.6.4)が、powershell.exeにインジェクションされ、実行されます。
[ChChes](https://attack.mitre.org/software/S0144) establishes persistence by adding a Registry Run key.(Citation: PWC Cloud Hopper Technical Annex April 2017)
「-enc」以降のPowerShellスクリプトはエンコードされており、以下がデコードしたものです。
Priority MITRE ATT&CK Mapping ... Defense Evasion T1027.013 Encrypted/Encoded File Encoded malware strings and obfuscation
This malware is provided with an icon that appears to be that of a Microsoft Word document.
[ChChes](https://attack.mitre.org/software/S0144) copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).(Citation: PWC Cloud Hopper Technical Annex April 2017)
次に、PowerShellスクリプト内に含まれるChChesのコード(バージョン1.6.4)が、powershell.exeにインジェクションされ、実行されます。
The latter method makes ChChes a fileless malware.
If executed, the malware begins by removing itself from the current directory and copying itself to the user’s roaming profile under a different name.
Upon their extraction, malicious code is injected into the process of a legitimate file/application (DLL hijacking). ChessMaster takes it up a notch via load-time dynamic linking to trigger the malicious DLL’s function.
このPowerShellスクリプトやインジェクションされるChChesは、感染端末上でファイルとして保存されないため、ChChes自身はメモリ上にのみ存在することになります。
ChChes hides part of the decryption key and payload in registry keys to make it harder to reverse engineer.
[ChChes](https://attack.mitre.org/software/S0144) samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)
[ChChes](https://attack.mitre.org/software/S0144) can alter the victim's proxy configuration.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData
[ChChes](https://attack.mitre.org/software/S0144) steals credentials stored inside Internet Explorer.(Citation: PWC Cloud Hopper Technical Annex April 2017)
ChessMaster draws on legitimate email and browser password recovery and dumping tools they’ve misused and modified for their campaign. These can restore forgotten passwords, which are then dumped and retrieved.
[ChChes](https://attack.mitre.org/software/S0144) collects its process identifier (PID) on the victim.(Citation: Palo Alto menuPass Feb 2017)
[ChChes](https://attack.mitre.org/software/S0144) collects the victim hostname, window resolution, and Microsoft Windows version.(Citation: Palo Alto menuPass Feb 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)
[ChChes](https://attack.mitre.org/software/S0144) collects the victim's %TEMP% directory path and version of Internet Explorer.(Citation: FireEye APT10 April 2017)
Additional malware are introduced to the infected system for persistence.
Examples include: "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header," "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers," and "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."
インジェクションされたChChesは前号の分析センターだよりで紹介した通り、C2サーバから命令とモジュールを受信します。
[ChChes](https://attack.mitre.org/software/S0144) communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
ChChes can alter the victim's proxy configuration... MuddyWater can disable the system's local proxy settings... During Night Dragon, the actors also disabled proxy settings to allow direct communication from victims to the Internet.
[ChChes](https://attack.mitre.org/software/S0144) is capable of downloading files, including additional modules.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)(Citation: FireEye APT10 April 2017)
The data is embedded within the ‘Cookie’ HTTP header... The data embedded within the Cookie header is encrypted using a unique technique.
[ChChes](https://attack.mitre.org/software/S0144) can encode C2 data with a custom technique that utilizes Base64.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
[ChChes](https://attack.mitre.org/software/S0144) can encrypt C2 traffic with AES or RC4.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
"modules with the following functions... Upload files"; "execution results of the received command are sent to C&C servers"
113 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.