2 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

3 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−•

ショートカットとファイルを悪用する攻撃キャンペーン

−•日本企業を狙った標的型攻撃キャンペーン
−•サイバーレスキュー隊−−

5 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

活動状況

•−

•−

6 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

••T

7 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

T

???

•
•OFFCLN.EXE•OCLEAN.DLL

DWINTL.DLL−−•−−−

9 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

FILETRANDLL.dll

•−10 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−−

11 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−
•−−−

•

12 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

???

•
•

GoogleToolbar
Notifier.exe•−GTN.dll

espui.dll%appdata%\NVIDIA

−

•−−−

13 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

cttune.exe

DWrite.dll

espui.dll

LoadPlgFromR
emote.dll

•−•••14 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−−•15 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•16 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

17 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

???

Email ???

***** Participant Invitation
Letter_Prof.***.isoExtract•••***** Participant Invitation
Letter_Prof.***.docx.EXE

wwlib.dll

Wordcnv.dll−−123.docx%appdata%\Microsoft\IntelStatup−•iGfx.lnkigfxxe.exe−−−
hxxps://github.com/lettermaker/topsuggestions/blob/main/README.md

18 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

hxxp://45[.]32[.]13[.]214/readme_v1.1.txt

igfx.dll•

MS_word.release_file() exported in Wordcnv.dll

19 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−−

Key = hexstring(MD5(“sidhioos*#hfFD23b!9”))IV = Key[8:24]

20 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•%appdata%\Microsoft\Intel\igfxxe.exe run %appdata%\Microsoft\Intel\igfx.dll 0 C:\AppData\Local\Intel\Games\123;

Check if the first param is “run”

If third param is 0, then invoke given DLL’s
ApplyRecommendedSettings function

21 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−
•−

•−

22 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•

23 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−−−

24 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•Base64 + AES128-CBC
Key=hexstring(MD5(“dsiieio(#ifv49JE39”))
IV=Key[8:24]

hxxp://45[.]32[.]13[.]214/token.txt

25 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

✓
✓✓
✓

✓✓✓

✓
✓✓

✓✓
✓✓✓✓

✓
✓
✓

27 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

✓

•
•−−−
−

•−

28 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−

•−

•

b1bf4111980cf3eaf33433914de10dd6f39f8602−

29 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•−−

•−
•••30 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

✓✓

✓

✓32 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

•••33 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Thank you© 2023 Trend Micro Incorporated. All rights reserved.

sha1

detection

2b6133d54caa9d9b34d5ba9385ed1e8f6c22642c

Trojan.Win32.MIRRORKEY.ZJJH

c1a2799d4f3e4caf62a6e9aa58ea4b8592493221

TrojanSpy.Win32.TRANSBOX.ZJJH.enc

domain / ipt54rf[.]driveshoster[.]com
sourcebc9b[.]driveshoster[.]com
fr5yt[.]driveshoster[.]com
6bfeeb71c[.]disknxt[.]com
fd471sx[.]disknxt[.]com
devbfe2[.]disknxt[.]com
fe6beb71c[.]disknxt[.]com
45[.]32[.]13[.]214

hxxps://github[.]com/lettermaker/topsuggestions/blob/main/README.md
35 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.