Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group is also deploying new malware families like HelloDoor and HttpMalice, variants of PebbleDash, and enhanced versions of AppleSeed, such as HappyDoor, which focuses on data exfiltration and GPKI certificate extraction.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
HappyDoor in this case is also being distributed via an email attachment just like the previous method of distribution. This attachment file contains a compressed file, and the latter carries a JScript or a dropper (executable file). Once that is run, HappyDoor is created and executed along with normal bait files.
install* 1. Add to scheduler (“Intel\Disk\Volume0”) ... schtasks /create /f /tn “ Intel\Disk\Volume0 ” /tr “C:\Windows\system32\regsvr32.exe /s /n /i:init* ...” /sc minute /mo 5
1103 Run with PowerShell Creates a PS1 file and runs the data received as an argument ccmd
1101 Run Command Line Runs the data received as an argument with the command prompt ccmd
This attachment file contains a compressed file, and the latter carries a JScript or a dropper (executable file). Once that is run, HappyDoor is created and executed along with normal bait files.
Kimsuky meticulously crafts and delivers spear-phishing emails to its targets in an attempt to entice them into opening attachments.
install* 1. Add to scheduler (“Intel\Disk\Volume0”) ... schtasks /create /f /tn “ Intel\Disk\Volume0 ” /tr “C:\Windows\system32\regsvr32.exe /s /n /i:init* ...” /sc minute /mo 5
HappyDoor configures the data encoded in two normal registry paths... HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad ... HKEY_CURRENT_USER\Software\Microsoft\FTP
install* 1. Add to scheduler (“Intel\Disk\Volume0”) ... schtasks /create /f /tn “ Intel\Disk\Volume0 ” /tr “C:\Windows\system32\regsvr32.exe /s /n /i:init* ...” /sc minute /mo 5
HappyDoor configures the data encoded in two normal registry paths. The registry paths and the features are as follows: A. NOTEPAD Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad ... B. FTP Path: HKEY_CURRENT_USER\Software\Microsoft\FTP
#Running HappyDoor IWshShell3. Run (“powershell.exe -windowstyle hidden cmd /c cmd /c regsvr32.exe /s /n /i:syrsd* C:\Windows\..\ProgramData\[HappyDoor] “, “0”, “true”);
1105 Run Memory Loads the portable executable (PE) file in the memory and runs it
HappyDoor configures the data encoded in two normal registry paths... HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad ... HKEY_CURRENT_USER\Software\Microsoft\FTP
The malware performs a total of six major infostealing activities, each with the corresponding string: ... keylogger (keylogging) ... KEYLOGGER(KLOG) Saves the current time in addition to the processes and key information entered by the user.
enhanced versions of AppleSeed, such as HappyDoor, which focuses on data exfiltration and GPKI certificate extraction.
The “osi” file collects information such as the OS version, architecture, and the service pack version
FILEMON(FMON) ... collects files that meet certain conditions from the paths below ... “%UserProfile%\Desktop”, “%UserProfile%\Document”, “%UserProfile%\Download”, “%UserProfile%\AppData\Local\Microsoft\Windows\INetCache\IE”
ALARM(AUSB, AMTP) This function collects data such as files, paths, and names of connected portable disks or devices... MTPMON(MMTP) ... collects certain files from “Android” portable devices via Media Transfer Protocol (MTP).
The malware performs a total of six major infostealing activities, each with the corresponding string: ... keylogger (keylogging) ... KEYLOGGER(KLOG) Saves the current time in addition to the processes and key information entered by the user.
The malware performs a total of six major infostealing activities, each with the corresponding string: screenshot (capturing screenshots) ... SCREENSHOT(SSHT) Captures the current screen and saves it as a JPG file.
FILEMON(FMON) This function collects files that meet certain conditions from the paths below and saves them as a compressed file.
MICREC(MREC) This is a function that allows access to microphones and records voices.
HappyDoor has been using HTTP to communicate with the C&C (Command and Control) server for quite a while.
1005 Update Loads a new DLL file (argument) and terminates the old backdoor ... 1132 Download File Creates a file the threat actor desires in the infected PC
enhanced versions of AppleSeed, such as HappyDoor, which focuses on data exfiltration and GPKI certificate extraction.
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.