Catching the Big
Phish: Earth Preta
Targets Government,
Educational andResearch Institutes
Around the World
2023-01 @ JSAC 2023
Nick Dai, Sunny W Lu and Vickie Su

Who are we?

Nick Dai

Sunny W Lu

Vickie Su

We are threat researchers at Trend Micro.
We are responsible for tracking and detecting APT attacks within APAC region.

2© 2022 Trend Micro Inc.

Agenda
•
•
•
•
•

3

Introduction
Victimology
Infection Chain
Attribution
Conclusion© 2022 Trend Micro Inc.

Introduction
4© 2022 Trend Micro Inc.

Earth Preta (Mustang Panda)

5

Alias

•
•
•

Mustang Panda
TEMP.Hex
TA416

Origin•China

Motivation•

Cyber espionage

TargetedIndustries•••

Diplomatic missions
Military personnel
Political party•••

Research entities
Internet service providers
Aerospace company••

Religious organizations
NGOs

Targeted
Regions•••

United States
Mongolia
Myanmar

•
•
•

Japan
India
Taiwan••Australia
South Africa

Tools

•
•
•

PlugX
PoisonIvy
Cobalt Strike••

NBTscanRCsession

TTPs

•
•
•

Document-looking executables
Archives with decoy documents
LNK files which trigger JScript or VBScript© 2022 Trend Micro Inc.

•••

Bronze President
HoneyMyte
RedDelta

New Campaign Since March 2022
• Spear phishing attacks targeting government, educational andresearch institutes around the world• Various malware is observed in the wild––––

PUBLOADTONEINSTONESHELL
and others• After the threat actors have penetrated the victim's environment,
they start to exfiltrate confidential documents.

6© 2022 Trend Micro Inc.

Victimology
7© 2022 Trend Micro Inc.

Targets – Countries8© 2022 Trend Micro Inc.

Targets – Industries9© 2022 Trend Micro Inc.

Infection Chain
10© 2022 Trend Micro Inc.

Infection Chain
Post-Exploitation
Arrival
Vectors11© 2022 Trend Micro Inc.

Discovery

Privilege
Escalation

LateralMovement

CommandandControl

Exfiltration

Infection Chain -Arrival Vectors
12© 2022 Trend Micro Inc.

Arrival Vectors• Spear phishing emails are the first step of intrusion.
– Each email contains a Google Drive link pointing to a lure archive withmalware and decoy documents

13© 2022 Trend Micro Inc.

Decoys•

14

Japan Society for the Promotion of
Science (JSPS)© 2022 Trend Micro Inc.

•

The agreement in 9th Senior Staff Talks(SST) between Myanmar and Thailand

Types of Arrival Vectors
•
•
•
•

15

Type A: DLL Side Loading
Type B: Shortcut Links
Type C: Fake File Extensions
Type D: DLL Embedded in DOCX

© 2022 Trend Micro Inc.

Type A: DLL Side Loading – 1
🅐 Legitimate executable🅑 Trojan.Win32.PUBLOAD
🅒 Decoy document

A

16© 2022 Trend Micro Inc.

B

C

Type A: DLL Side Loading – 2
🅐 Legitimate executable🅑 Cobalt Strike dropper🅒 Decoy document
A17© 2022 Trend Micro Inc.

B

C

Type B: Shortcut Links
🅐 Installer🅑 Legitimate executable🅒 Backdoor.Win32.TONESHELLB
AC%ComSpec% /c "_¥_¥_¥_¥_¥_¥putty.exe||(forfiles /P %APPDATA%¥..¥..¥ /S /M Desktop.rar /C "cmd /c (c:¥progra~1¥winrar¥winrar.exe x -inul-o+x -inul -o+ @path)&&_¥_¥_¥_¥_¥_¥putty.exe")"
18 @path||c:¥progra~2¥winrar¥winrar.exe© 2022 Trend Micro Inc.

Type C: Fake File Extensions
🅐 First-stage
legitimate executable🅑 Trojan.Win32.TONEINS

A

B

C

D

E

F

🅒 Second-stage
legitimate executable🅓 Backdoor.Win32.TONESHELL
🅔🅕 Decoy document19© 2022 Trend Micro Inc.

Type D – Decoy Documents20© 2022 Trend Micro Inc.

Type D: DLL Embedded in DOCXA🅐 Decoy document embeddedwith a google drive link anda password

🅑 1st-stage legitimate executable
B

C

D

E

F

G

🅒 1st-stage Trojan.Win32.TONEINS
🅓 2nd-stage legitimate executable🅔 2nd-stage Backdoor.Win32.TONESHELL
🅕🅖 Decoy document21© 2022 Trend Micro Inc.

Type D – DLL Embedded in DOCX

22

© 2022 Trend Micro Inc.

Type D: DLL Embedded in DOCXA🅐 Decoy document embeddedwith a google drive link anda password

🅑 1st-stage legitimate executable
B

C

D

E

F

G

🅒 1st-stage Trojan.Win32.TONEINS
🅓 2nd-stage legitimate executable🅔 2nd-stage Backdoor.Win32.TONESHELL
🅕🅖 Decoy document23© 2022 Trend Micro Inc.

Malware Used in Arrival Vectors
•
•
•
•

24

Trojan.Win32.PUBLOAD
Trojan.Win32.TONEINS
Backdoor.Win32.TONESHELL
Backdoor.Win32.COBEACON (Cobalt Strike)© 2022 Trend Micro Inc.

Trojan.Win32.PUBLOAD• A stager• First disclosed by Cisco Talos in May 2022
– https://blog.talosintelligence.com/mustang-panda-targets-europe/• Capabilities– Persistence– Anti-AV: callback function– Special event names/debug strings• C&C protocols– Variant A: Raw TCP– Variant B: HTTP
25

© 2022 Trend Micro Inc.

PUBLOAD – Persistence• Scheduled task
schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1/TR C:¥¥Users¥¥Public¥¥Libraries¥¥Graphics¥¥AdobeLicensing.exe• Registry run key
cmd.exe /C reg add HKCU¥¥Software¥¥Microsoft¥¥Windows¥¥CurrentVersion¥¥Run /v Graphics/t REG_SZ /d ¥"Rundll32.exe
SHELL32.DLL,ShellExec_RunDLL ¥"C:¥¥Users¥¥Public¥¥Libraries¥¥Graphics¥¥AdobeLicensing.exe¥"¥"/f

26© 2022 Trend Micro Inc.

PUBLOAD – Anti-AV: Callback Function27© 2022 Trend Micro Inc.

PUBLOAD – Special Debug Strings/Event Names

28© 2022 Trend Micro Inc.

PUBLOAD – HTTP Variant29© 2022 Trend Micro Inc.

PUBLOAD – Further Payload30© 2022 Trend Micro Inc.

CodeInternal String (Description)

0x03

-

0x01

-

0x1B

UploadBegin error : %d!

0x1D

UploadData error : %d!

0x1A

-

0x1E

CmdStart error : %d!

0x1F

CmdWrite error : %d!

0x30

CmdWrite error : %d!

0x20

-

Trojan.Win32.TONEINS• The installer for TONESHELL backdoors• Use schtasks for persistence
schtasks /create /sc minute /mo 2 /tn "ServiceHub.TestWindowStoreHost"/tr "C:¥Users¥Public¥Pictures¥ServiceHub.TestWindowStoreHost.exe" /f• Two files with fake extensions (Arrival Vector Type C)

31© 2022 Trend Micro Inc.

Backdoor.Win32.TONESHELL• A backdoor with file download/upload/lateral movement functions• Anti-analysis capabilities– Custom exception handler– Foreground window check• There are 3 variants with different C&C protocols.

32© 2022 Trend Micro Inc.

TONESHELL – Custom Exception Handler• The adversary hides the actual code flow with the implementation of
the custom exception handlers.
• The malicious routine is triggered by the _CxxThrowException call.
After it’s invoked, the C++ runtime will find the corresponding
exception handler which contains the real malicious codes.

Figure. _msRttiDscr array33© 2022 Trend Micro Inc.

TONESHELL – Foreground Window Check• This anti-sandbox technique is used in more recent samples• Check foreground windows per second34© 2022 Trend Micro Inc.

TONESHELL – Evolving Variants
First Observed

35

Variant

ProtocolC&C Encryption

2022/05

A

Raw TCP

RC4

2022/07

B

Raw TCP

32-byte XOR

2021/09

C

HTTP

RC4

© 2022 Trend Micro Inc.

Supported Functions••••

File upload
File download
File execution
Lateral movement• File upload• Lateral movement• File upload• File execution

TONESHELL – Backdoor Functions
Table A. TONESHELL variant A

36

Table B. TONESHELL variant B

Table C. TONESHELL variant C

CodeInternal String (Description)

CodeInternal String (Description)

CodeInternal String (Description)

0x1(Reset OnePipeShell & TwoPipeShell)

0x9(Reset OnePipeShell)

0x2(Reset OnePipeShell)

0x7(Reset OnePipeShell & TwoPipeShell)

0xA(Reset OnePipeShell)

0x7(Reset OnePipeShell)

0x3

-

0x3

-

0x3

-

0x4

(Change sleep seconds)

0x4(Change sleep seconds)

0x4(Change sleep seconds)

0x1A

Upload file begin

0x4

Upload file begin

0x1A

Upload file begin

0x1B

Upload file write

0x5

Upload file write

0x1B

Upload file write

0x1D

Upload file cancel

0x7

Upload file cancel

0x1D

Upload file cancel

0x1C

Upload file Endup

0x6

Upload file Endup

0x1C

Upload file Endup

0x10

Exec file

0x3

Create TOnePipeShell

0x10

Exec file

0x21

Create TOnePipeShell

0x22

OnePipeShell Close

0x1E

TwoPipeShell Create

0x1F

TwoPipeShell Write Fie

0x20

TwoPipeShell Close

0x18

Download

0x19

CDownUpLoad

0x21(Exit)©
2022 Trend
Micro Inc.

C&C Protocol (TONESHELL vs. PUBLOAD)
Table A. TONESHELL variant A
Name

OffsetSize

Description

magic

0x0

0x3

17 03 03

size

0x3

0x2

Payload size

type

0x5

0x1

Connection type, 0x0 or 0x1

unique_id

0x6

0x4

Victim ID

payload

0x10[size]

PayloadTable C. PUBLOAD

Table B. TONESHELL variant B

37

Name

OffsetSize

Description

magic

0x0

0x3

17 03 03

size

0x3

0x2

Payload size

key

0x5

0x20

32-byte XOR key

payload

0x25[size]

Payload© 2022 Trend Micro Inc.

•

Name

OffsetSize

Description

magic

0x0

0x3

17 03 03

size

0x3

0x2

Payload size

payload

0x5[size]

Payload"17 03 03" is also the magic header for TLS 1.2.

Infection Chain -Post-Exploitation38© 2022 Trend Micro Inc.

Infection Chain
Post-Exploitation
Arrival
Vectors39© 2022 Trend Micro Inc.

Discovery

Privilege
Escalation

LateralMovement

CommandandControl

Exfiltration

Post-Exploitation -Privilege Escalation40© 2022 Trend Micro Inc.

Privilege Escalation: HackTool.Win32.ABPASS• A hacktool for Windows 10 UAC bypass1.
– It leverages either of the following binaries: fodhelper.exe or ComputerDefaults.exe.
– Both executables will invoke the command set in the Shell object ms-settings, which leads toprivilege escalation.

• Reused codes from the UACME's ucmShellRegModMethod3.
• The following registry keys are set.
Registry Key

Name

Value

HKEY_USERS¥<SID>-1001_Classes¥aaabbb32¥shell¥open¥command(Default)

argv[1]

HKEY_USERS¥<SID>-1001_Classes¥ms-settings¥CurVer(Default)

aaabbb32

1. Introduced in Family Tree: DLL-Sideloading Cases May Be Related by Sophos
41© 2022 Trend Micro Inc.

Privilege Escalation: HackTool.Win32.CCPASS• A hacktool for Windows 10 UAC bypass abusing the fileassociation ms-windows-store.
– It hijacks the ms-windows-store protocol with the specified command and triggers
it by WSReset.exe.

• Reused codes from the UACME's ucmMsStoreProtocolMethod.

42© 2022 Trend Micro Inc.

Privilege Escalation: SilentCleanup• Bypass UAC by abusing a native Windows service SilentCleanup.
– In this service, the environment variable %windir% could be hijacked.
– Thus, override its value with registry and run the SilentCleanup service to trigger
the command.
– In this case, the threat actors used this technique to execute 1.Exe.

43© 2022 Trend Micro Inc.

Post-Exploitation -Lateral Movement44© 2022 Trend Micro Inc.

Trojan.Win32.HIUPAN + Backdoor.Win32.ACNSHELL

45© 2022 Trend Micro Inc.

References:• Always Another Secret: Lifting the Haze on China-nexus Espionage in Southeast Asia by Mandiant​• Family Tree: DLL-Sideloading Cases May Be Related by Sophos

Backdoor.Win32.CLEXEC• A simple backdoor with capabilities to clear event logs and executecommands.

46© 2022 Trend Micro Inc.

Post-Exploitation -Command and Control
47© 2022 Trend Micro Inc.

Command and Control: powershell.exe / certutil.exe

48© 2022 Trend Micro Inc.

Command and Control: Download Site49

© 2022 Trend Micro Inc.

Post-Exploitation -Exfiltration50© 2022 Trend Micro Inc.

Exfiltration• The threat actors stole tons of data from the victims' hosts. Based on
our telemetry, several methods are used including
1. Legitimate tools••

WinRARCurl

2. Customized malware for packing all files••

HackTool.Win32.NUPAKAGE
HackTool.Win32.ZPAKAGE• They focus on highly confidential documents from the victim.

51© 2022 Trend Micro Inc.

Method 1 – WinRAR + Curl
• We observed that the actors abused the installed WinRAR binary andthe uploaded curl executable to exfiltrate the files.
– log.log is the legitimate Curl binary.
– All data is collected to the actor-controlled FTP server.

52© 2022 Trend Micro Inc.

Exfiltrated Data
• The actors focus on sensitive and confidential documents.
– They are collected into password-protected archives.
– These archives are categorized by disk drives.

53© 2022 Trend Micro Inc.

Method 2.1 – HackTool.Win32.NUPAKAGE• A highly-customized tool used for exfiltration.
– Need a unique passcode to be executed.
– Exfiltrated data is wrapped in a custom file format.

• The threat actors keep updating this tool, including adding morecommand line arguments and obfuscations.
• The malware name is derived from its unique PDB string.
– D:¥Project¥NEW_PACKAGE_FILE¥Release¥NEW_PACKAGE_FILE.pdb

54© 2022 Trend Micro Inc.

NUPAKAGE – Usage••

malware.exe passcode start end chunk -s extension_A ...
Argument Name

FormatExample Value

passcode

StringcomeonA unique code in order to execute it

start

String2022-01-01

The start range of the exfiltrated files' modification timestamp

end

String2022-12-31

The end range of the exfiltrated files' modification timestamp

chunk

Integer

4096

Split the generated data in chunks by the specified size (MB)-s

StringDescription

Other file extensions to be collected. It's optional.

By default, documents with the following extensions are collected– .doc, .docx, .ppt, .pptx– .xls, .xlsx, .pdf•

Avoid filenames starting with “$” or “~”– Avoid collecting temporary files and fake Office files (like arrival vectors Type C)

55© 2022 Trend Micro Inc.

NUPAKAGE – Generated Outputs• It generates 2 files.
– xxx.zip: a logging file with a fake ZIP header– xxx.z: the exfiltrated data

• The logging strings are encoded with a single byte in XOR operations.

56© 2022 Trend Micro Inc.

NUPAKAGE – xxx.zip (Logging File)[+] Program ready!
[+] FILE ORIGINAL PATH: C:¥Program Files (x86)¥Adobe¥Acrobat Reader DC¥Reader¥1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf[+] FILE PATH SIZE: 198[+] FILE ORIGINAL SIZE: 186837[+] FILE COMPRESSED SIZE: 183734[+] FILE ORIGINAL PATH: C:¥Program Files (x86)¥Adobe¥Acrobat Reader DC¥Reader¥Click on 'Change' to select default PDF handler.pdf[+] FILE PATH SIZE: 210[+] FILE ORIGINAL SIZE: 186837[+] FILE COMPRESSED SIZE: 183734...
<omitted>...
[*] File or folder access denied!
[*] File or folder access denied!
[+] All completed!

57© 2022 Trend Micro Inc.

NUPAKAGE – .z File Format

58© 2022 Trend Micro Inc.

Method 2.2 – HackTool.Win32.ZPAKAGE••

Usage: malware.exe passcode time
Argument Name

FormatExample Value

passcode

String

start

time

String20221221

Description
A unique code in order to execute it
The start date

Avoid filenames starting with “$” or “~”– Avoid collecting temporary files and fake Office files (like arrival vectors Type C)•

Compare if it’s worth it to be compressed– Type 0: the original file content– Type 1: the compressed file content (zlib)

59© 2022 Trend Micro Inc.

ZPAKAGE – .z File Format

OffsetField Name

Size

0x0

type

1

Compression type, 0x0 or 0x1

0x1

len

4

Length of filename

0x5

reserved

3

0x8

size1

4

Original file size

0xC

size2

4

Compressed file size

0x10

file_namelen

Encoded filename (XOR with“qwerasdf”)

0x10 + len

file_content

size2

Encoded file content (zlib + XOR with“qwerasdf”)

…

…

…

60

© 2022 Trend Micro Inc.

Description

Attribution
61© 2022 Trend Micro Inc.

Attribution – Folder Structure• BRONZE PRESIDENT Targets Government Officials– https://www.secureworks.com/blog/bronze-president-targets-governmentofficials

Left: samples from BRONZE PRESIDENT by SecureWorks, right: samples in this campaign
62© 2022 Trend Micro Inc.

Attribution – Callback Function• EnumThreadWindows• EnumSystemCodePagesW

Earth Preta callback function EnumSystemCodePagesW63© 2022 Trend Micro Inc.

Attribution – C&C• The C&C server 98[.]142[.]251[.]29 found in this campaign could becorrelated to the shortcut file inside the archive mentioned in the
SecureWork's report.
– EU 31st session of the Commission on Crime Prevention and Criminal Justice
United Nations on Drugs and Crime.rar

64© 2022 Trend Micro Inc.

Attribution – Other TTPs
• Lots of TTPs overlap with what's observed in Cisco Talos' report.
––––

https://blog.talosintelligence.com/mustang-panda-targets-europe/
Both use schtasks and registry run key for persistence.
Both use benign executables for DLL sideloading.
Both use malicious archives for arrival vectors.

• Most importantly, the stager (PUBLOAD) mentioned in the Cisco Talos
report uses the same magic header (17 03 03) as TONESHELL does in
the C&C communication protocol.

65© 2022 Trend Micro Inc.

Conclusion
66© 2022 Trend Micro Inc.

Conclusion• Earth Preta is constantly updating its TTPs and arsenals.
• In recent years, they have improved and developed the abilities towrite their own tools for attacks.
• To fly under the radar, they apply various countermeasures:– Hide the payload in a legitimate-looking file
– Tools which requires a unique passcode to run– Protect the archives with a password• They are actively spreading the lures to broaden the affected regions.

67© 2022 Trend Micro Inc.

Research Blog
• https://www.trendmicro.com/en_us/research/22/k/earth-pretaspear-phishing-governments-worldwide.html

68© 2022 Trend Micro Inc.

Q&A
69

© 2022 Trend Micro Inc.

Extended detection and response
across multiple IT layers by Trend
Micro. Created with real data by artist
Brendan Dawes.

Indicator ofCompromise71© 2022 Trend Micro Inc.

Distributed Links
Distributed Links

72

https://drive[.]google[.]com/uc?id=1pJR6hvEcdZFNPS9BIuw2Egcp_gb-pvLR&export=download
https://drive[.]google[.]com/uc?id=1t0Cxanp-cm9bOyOfrfu5BN1ya2CZs-3q&export=download
https://drive[.]google[.]com/uc?id=12ZEERd58S25zxAWUF5tiBSPOswYgtU2j&export=download
https://drive[.]google[.]com/uc?id=1OGNqBZNG57STWtoTIUwoBMFDIcu9AMh1&export=download
https://drive[.]google[.]com/uc?id=1BG0F1NdkPZOY6w2Y0YEs6nMGYLvSJiQo&export=download
https://drive[.]google[.]com/uc?id=1mQGqtxR8XzafPalD7hEUBZw-LHtPHeAG&export=download
https://drive[.]google[.]com/uc?id=1mhv6sOKU1OmqrX3PRB7fme-STM8wCMw4&export=download
https://www[.]dropbox[.]com/s/8zswaln4nm0neap/Action%20Plan%202022.zip?dl=1
http://103[.]75[.]190[.]224/Enable_Adobe_Flash_Player.zip
https://drive[.]google[.]com/uc?id=1xr-NUG2el_8wI6Lnvkp-q17rV3C_vxoC&export=download
https://drive[.]google[.]com/uc?id=1fMn9S7VIn8BszBL-VcNdJF8SkKzwTRov&export=download
https://drive[.]google[.]com/uc?id=14topBrJNM5J1m4h2bO3ihi5M6apWnx8S&export=download
https://drive[.]google[.]com/uc?id=1aTbT-p28UK-KaYttQT3nIdynHnVdPS6w&export=download
https://drive[.]google[.]com/uc?id=1roe1BE_Riy7AVbqtJZUxKTHkNvs3yn3a&export=download
https://drive[.]google[.]com/uc?id=1g36jBkVLHubXsKrf9MaUkbRwBYv6Iu7-&export=download
https://drive[.]google[.]com/uc?id=1UHAuqp6a3qNZfzF51-p3XBDYMkG77aYL&export=download
https://drive[.]google[.]com/uc?id=1zlvioLjo9HjTVqP0fDBrkQnJACW9HABf&export=download
https://drive[.]google[.]com/uc?id=1qWMPrQ_s55Y__9mBIRR1-Nw6oQiFdMII&export=download
https://drive[.]google[.]com/uc?id=1072qv4eeKRZLRfiSsx0OfrRzBLk2f0Xe&export=download
https://drive[.]google[.]com/uc?id=1KJ702ReZ_C_Z6sHzd2W1hciHjhSd9pH&export=download
https://drive[.]google[.]com/uc?id=19eGOwbQZU8Qtvt2t5kqPdvRY7S_1N504&export=download
https://drive[.]google[.]com/uc?id=1A6JFwcE0s9KFdLkdABgZmnavH709XCtM&export=download
https://drive[.]google[.]com/uc?id=1PSKh4XIMoPCsLmsUvmqWJ67lyoQuOBgZ&export=download
https://drive[.]google[.]com/file/d/1S6WhR8iIXTsKxroU6tY_PlJhDlA_0r_-/view?usp=drive_web
https://drive[.]google[.]com/uc?id=1tf0_WX1Qak84rfylGEoo4YvlYU5Dd5vA&export=download
https://drive[.]google[.]com/uc?id=1_kYWY8u9mLqNBfBQh53ZQSxAPFB_hWaf&export=download
https://drive[.]google[.]com/uc?id=1vQWG_GdVcqM_pp_UbbEysuC_AGr4flFP&export=download
https://drive[.]google[.]com/uc?id=1oyY0Fda3sqnogAIQQdkr3yDko5RJX67E&export=download
https://drive[.]google[.]com/uc?id=1qKHgooWqJaaPxtEaPDbhaL0oD_NheOi6&export=download
https://drive[.]google[.]com/file/d/1zHRbWBx1ZXNMetm7RxawRS2b55yF6337/view?usp=drive_web© 2022 Trend Micro Inc.

Decoy Archives – 1/2
Filename

SHA256

Owner's Gmail

20220622.rar

c0b9438186e27a1ebba214724a35195ce1f3fea41b6c0b69a10c649688371ec3-

Assistance and Recovery(china).rar

72b870a6914798b75bd45e483a47bf1c6eabd185ea577b621a23242a13ec58df

uthawtaraung@gmail.com

MRR_67(20220707).rar

186c3d32b3674faaf2c59b780ec2e5aeedc48199beae07c69e7cc14180c3683b

mofapolcoord2020@gmail.com

DA and MAI Call(New).zip

1ba12162a50fd5acbb38d9d0a99efb3b43358457e3279b86954dfff39b5cde4d

qmgrudept@gmail.com

220509 - (Cabinet Meeting 2022).zip

d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a-

ASEAN Leaders_Meeting.rar

492fd69150d0cb6765e5201c144e26783b785242f4cf807d3425f8b8df060062-

Justice and Accountability for People - JPA project.zip

6478cbb620e1a6fe1fb7e9e15b37fdc10668aa5bf2c825b8cd65b129e6443e60

nld.tawtha285@gmail.com

Report-CRPH (NUCC and JCC members).rar

f2b10278aaa2dfc4344119551f624679b5a3d2501b39ec989b87690e0d357f42-

War Bullentin 6.00PM. EST june 22.rar

dcefa4f651108d8371806403da4be9675797940faa580cc64f83116517c55ca7-

Action Plan 2022.zip

ef3966d15af3665ee5126df394cefdf6f78fce77db7a70d5f35c19c234715035-

Enable_Adobe_Flash_Player.zip

2f2a8a001072f14c066bea15388af2155b02e0046180e450268db6bcdafa6e5a-

AFP SRDP Strategic Concept Plan.zip

262c6ad46bacd268900008d6cd32ea5bcfe032ffc0bf82e838e234cdca374d64

imac.afp@gmail.com

至李治安邀請函.rar

b2a86c5e1f0812483b0fdbde162457fd7ee71809a8a03c72762c037b1430115e

yunlike717@gmail.com

24-08-2022.rar

9ef78cdd09a9b6ddb095e2474d9b888f2d4854a1324c46ec1db368dde390fddc

yunlike717@gmail.com

Invitatie -25 7 2022.jar

064fe5bc15828693ac62cfd7e83f705d734e2554d2ff8ed82f701864512e7624

mofapolcoord2020@gmail.com

73© 2022 Trend Micro Inc.

Decoy Archives – 2/2

74

Filename

SHA256

Owner's Gmail

9th SST Agreed Minutes(English).rar

5d5c6d118ee90fe675a7d7bb8af9640bcc76caff9b2ebead4d06f74654f56260

kyawkhainglinn56317@gmail.com

some of my questions.rar

536fa7a7bcc7ba39da329a1656a2ac0448a9f01885bf48de6f15f554ce7994ac

vocational.etd000@gmail.com

nude photos of your lover.rar

8912199477e11df4409f6400ceb7c0e4a91ce77679948372d7d81e07dec68942

yunlike717@gmail.com

ENL_20220711.rar

229508972ad52e0ae1ff2d74fc70ebefd8b816e212ced849fbe6c1c2a1350ef6

zawlynnmyint2020@gmail.com

27-6-2022.rar

447a62c7e29e2da85884b6e4aea80aca2cc5ba86694733ca397a2c8ba0f8e197

qmgrudept@gmail.com

APPROVED DF Re-Consolidation and Presentsation of
PMC Inputs for PN RMPG 2024-2029.rar

1ffee8c9aee944f72aa595c8feb7c745d0a509ca9542e26993076d2052474fc9

htunmin.333@gmail.com

nude photos of your lover.rar

575bffe2a79606bbd91b6bb67224c2efda4fe34b4ce284996cfbf14c1cc79e0e

minmin218111@gmail.com

Ministries(en).zip

aa2a59cbe6f82fb3a0df1e676cb7f5e098133f1f03e595aa28c40a01d0ad5ebd

molnewslabour@gmail.com

China VS Taiwan.rar

04ad7451ee9e7e7fca594adb8d68644943255e3dde6f79d0f49b567420148867

yunlike717@gmail.com

AD to DD (Q&A)FGLLID(EN).zip

dc95ea503b3b2085b24471b96c33bbcdf057baa3970a4080f965033ee862d4f0

kyawmintun.medical@gmail.com

Talk points(EN).rar

ee3b19071abcdeeb47199b60764ae382d21b39633f9755e90abec8fdc0db5ef0

royalacer2020@gmail.com

Invitation.tar

431c9d4093a2def74a5e6a08b749455cb398ceab6cc887593b1d342f803e2027

mofapolcoord2020@gmail.com

Memorandum Circular - Official List of Candidates.rar

05d310c386edcd277b69d4ee8b956d710b966eca961a512f01dc9503a8eae0b6

yunlike717@gmail.com

attachment(EN).rar

2ec0031743443ab69d38d6d3a8b39824a5ae804bbece8cdfc0c6c691fce31349

yunlike717@gmail.com

Letter for Immigration - PH-AU WHV.rar

fdd77d852e2f9fb34724c0ebb5c22acf655fb2787d91c24a7040822aa81b1c81

vocational.etd000@gmail.com

Desktop.rar

a0fb562c8a2697a6d981cd281e661bd88fcec23cce34c9d31d081a942e8a45fe

zegobirdnpt@gmail.com© 2022 Trend Micro Inc.

Trojan.Win32.TONEINS - 1/2

75© 2022 Trend Micro Inc.

Filename

SHA256libcef.dll

9b6c76fa7518727d0031d4df694fb934dd5619a64a736d1643e56d89d32dc428

libcef.dll

6b452b2b1c68fe9957f6b2371898fe39a820cf3b5a6f338f5fb2f9639aaf886e

libcef.dll

d16b3f4cd6271c613a2c9184242b76df96cac0985bf9c4ff330f75e831c1e8f9

libcef.dll

21056092f307fdc39c04459f0caf2402c632cc9270b40a6b9449b0bd7f5047bf

libcef.dll

510ac911c71704d21f5363441571af6f93ab11810aa0900bfc558494521015cf

libcef.dll

fde817b21f7495a28616609b0a87703bf1eb4a2b7c04ef7982d4610166b81eea

libcef.dll

37367b193e5c927976472655d3de5684d3cf3bbb7bccdb380f336d1771a49017

libcef.dll

a54152723492d3efd9e2fbf64d6d8599766962d001cc0f21450bfa956862fbf4

libcef.dll

fa5c1ae296c7d25701a91d8e390b1187481a5143fb10c4c3935a547e6c792d76

libcef.dll

4fe16d20796fb1b1803d4862e74bfee25b77f62a664ae7cb060421a185da8709

libcef.dll

22ab2ec8793d9e51b28a033f7b60fc33c6d7e943f15883913654bff81f6c28eb

libcef.dll

65d2406d9149f6a55a8550ffc72a5ccf1866e293801e9348f1df08a846423fb2

Trojan.Win32.TONEINS - 2/2

76© 2022 Trend Micro Inc.

Filename

SHA256

Secur32.dll

d608e9c9892303fc5c551611d028e6994a198dd77cc4d529911961d10bb4b204

libcef.dll

ce87ae6962e28bb7f904d448d62b0101547dc8cdf37f095a546eb899bfcec5cc

libcef.dll

e6e291dc2906b2167143e3b9b433696f52ae6a95d687f3c72e2f752928fa41ef

libcef.dll

1a30f00ce5b8ce1f05a7938ada8c85e130f25986efcc61432c28a5bc29c47d90

libcef.dll

21f79743184783aeee30bfb06cb585f6b258459a329d07942f5f743d47708e05

libcef.dll

28f9661d8e89741574a39d57b5602f5662ec7950b721d7eb2f91e84e7040ce3b

Backdoor.Win32.TONESHELL - 1/2

77

Filename

Variant

SHA256

coreclr.dll

B

5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a

coreclr.dll

B

21cc217f89008f3f0fbae731671fe4927c9047f59ff3100c7dadf03e62139874

TenioDL_core.dll

B

78c70e6531ab86934d5dca8f100084b326ed0ab74541b1535f4bb7431bfea728

coreclr.dll

B

f731b25c32963507d307255237d4c52095c5714ef15cdcf6f923bb47d717e95f

coreclr.dll

B

02b52914afd13e1c91be5c61936c81a24ce3b4b0de4132d3ac96c5afd254716e

coreclr.dll

B

0f220ebbab71a8568eb0dfff22ea8c77cc05653580dc02ba86ca430c25f285ef

TenioDL_core.dll

B

41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81

coreclr.dll

B

f1aa3e3b09a8c84cbfaaaef076b3e19a79bb1a82ee5905a2358bc4d2167225de

2345DLAgent.dll

B

030aedf498ee37fc9722238e43fd39f5cb984f0e6a86915d30eda69921de0d76

TenioDL_core.dll

B

8f3a28336793f619d1ccd4974059ccfbf93be61cd05240d807ca94d42adeb101

coreclr.dll

B033065cf18592ed41714866b1fc43aa9da55b46f13e4cbc60e8d027699baffe0

TenioDL_core.dll

B

00b9d01d103f85170142e0f045a1943b10dfcc9d86a935d8853c6336d7055784© 2022 Trend Micro Inc.

Backdoor.Win32.TONESHELL - 2/2

78

Filename

Variant

SHA2562345DLAgent.dll

B

5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7

VERSION.dll

A

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7

TenioDL_core.dll

B

f8275f6f78618cb1de4fc4d0d288c5aa2967de74375cc82aa98d0392c71d537a

CefBrowser.dll

A

8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc

2345DLAgent.dll

Bd79832bd6904f02c09094c0a6c3fd176c42727868138ebe2d3fada581d2da50a

coreclr.dll

B

ecbe91ab9cf171411ef23ffa031e26be254e28b3bab698b8ec169bdc15a61c6b© 2022 Trend Micro Inc.

Trojan.Win32.PUBLOAD

79© 2022 Trend Micro Inc.

Filename

SHA256EVENT.dll

c52828dbf62fc52ae750ada43c505c934f1faeb9c58d71c76bdb398a3fbbe1e2

libcef.dll

966ab1c468e3fc7d8d8b2d73a9ca9a85d352a0db8043c5eab36dd304a5915812

NvSmartMax.dll

cfa33741054fa661525cbff8375a17e5c91d7411a9c18f78c7d0cdf8a24ab207

hpqhvsei.dll

f99560a6a6bcf3f0c4dbe5d3957e942eb4dfa88f5e9d59efa6ba017f5f626c31

qbcore.dll

10a746434abb8428c6b6a411d4dc069a89988a17a042e7f63fbfa867f3013cb3

kdump.dll

b7c7d90d4fd0917f2ed1d60ee334f8077d9b6620bb4b52aab76c67d2db642dc7

goopdate.dll

ef54e266f8fc9eb97d71c76f2a53b65bef83fe5fc270fbfe83463f83678ff44c

active_desktop_render.dll

1aafbe976c3559b61531910c75f9bb90176641f565f9810a18dcde9564241164

hpqhvsei.dll

cd697ed22e3ece7ef2e203c28c297d7be0b5ef862c2fd1a0c2f9b0fd3cc4e90a

hpqhvsei.dll

891335282ff2d45689cec8066eb5ed9167297e8d989529e8dc33e9ee1a7d4f86

goopdate.dll

df84d6c284dd39c2bfed6f8eb26149a4154396c27de50595ed5d80b428930dcd

Backdoor.Win32.CLEXEC

80© 2022 Trend Micro Inc.

Filename

SHA256

SensorAware.dll

cfe1447e7515ad831fcfedb9a5c1a721885b0542b775e4028a277a27e724ec73

Trojan.Win32.HUIPAN

81© 2022 Trend Micro Inc.

Filename

SHA256

u2ec.dll

4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4

usb.ini

12216b083ce2461c338bf571411ab53cd28fc0e3361add69a0b1c6d22b57e9c1

Backdoor.Win32.ACNSHELL

82© 2022 Trend Micro Inc.

Filename

SHA256

rzlog4cpp.dll

28a992ea7b9df22a7b7bcc04ecb3f3b89e5ea022f03b765bf1f12edd61df779f

Trojan.Win32.NUPAKAGE

83© 2022 Trend Micro Inc.

Filename

SHA256package.exe

634977a24e8fb2e3e82a0cddfe8d007375d387415eb131cce74ca03e0e93565f

pak.exe

c835577f1ddf66a957dd0f92599f45cb67e7f3ea4e073a98df962fc3d9a3fbe0

meg.exe

2937580b16e70f82e27cfbc3524c2661340b8814794cc15cb0d534f5312db0e0

psvc.exe

c2f5a12ebaeb39d4861e4c3b35253e68e6d5dc78f8598d74bc85db21aeb504e8

Trojan.Win32.ZPAKAGE

84© 2022 Trend Micro Inc.

Filename

SHA256

fp.exe711c0e83f4e626a7b54e3948b281a71915a056c5341c8f509ecba535bc199bee

Trojan.Win32.ABPASS

85© 2022 Trend Micro Inc.

Filename

SHA2563.exe

869e2a35107f7469cc0a8eef44d2eaf311ce8c6fff7acd3e429b11167c6bcd57

Trojan.Win32.CCPASS

86© 2022 Trend Micro Inc.

Filename

SHA256

msedge.dll

9635bc2009415b05cfb3fa1c5f40042916891d7e289502572f5d20043dc0e2a8

Others

87

Distributed Links

https://drive[.]google[.]com/uc?id=1pJR6hvEcdZFNPS9BIuw2Egcp_gb-pvLR&export=download
https://drive[.]google[.]com/uc?id=1t0Cxanp-cm9bOyOfrfu5BN1ya2CZs-3q&export=download
https://drive[.]google[.]com/uc?id=12ZEERd58S25zxAWUF5tiBSPOswYgtU2j&export=download
https://drive[.]google[.]com/uc?id=1OGNqBZNG57STWtoTIUwoBMFDIcu9AMh1&export=download
https://drive[.]google[.]com/uc?id=1BG0F1NdkPZOY6w2Y0YEs6nMGYLvSJiQo&export=download
https://drive[.]google[.]com/uc?id=1mQGqtxR8XzafPalD7hEUBZw-LHtPHeAG&export=download
https://drive[.]google[.]com/uc?id=1mhv6sOKU1OmqrX3PRB7fme-STM8wCMw4&export=download
https://www[.]dropbox[.]com/s/8zswaln4nm0neap/Action%20Plan%202022.zip?dl=1
http://103[.]75[.]190[.]224/Enable_Adobe_Flash_Player.zip
https://drive[.]google[.]com/uc?id=1xr-NUG2el_8wI6Lnvkp-q17rV3C_vxoC&export=download
https://drive[.]google[.]com/uc?id=1fMn9S7VIn8BszBL-VcNdJF8SkKzwTRov&export=download
https://drive[.]google[.]com/uc?id=14topBrJNM5J1m4h2bO3ihi5M6apWnx8S&export=download
https://drive[.]google[.]com/uc?id=1aTbT-p28UK-KaYttQT3nIdynHnVdPS6w&export=download
https://drive[.]google[.]com/uc?id=1roe1BE_Riy7AVbqtJZUxKTHkNvs3yn3a&export=download
https://drive[.]google[.]com/uc?id=1g36jBkVLHubXsKrf9MaUkbRwBYv6Iu7-&export=download
https://drive[.]google[.]com/uc?id=1UHAuqp6a3qNZfzF51-p3XBDYMkG77aYL&export=download
https://drive[.]google[.]com/uc?id=1zlvioLjo9HjTVqP0fDBrkQnJACW9HABf&export=download
https://drive[.]google[.]com/uc?id=1qWMPrQ_s55Y__9mBIRR1-Nw6oQiFdMII&export=download
https://drive[.]google[.]com/uc?id=1072qv4eeKRZLRfiSsx0OfrRzBLk2f0Xe&export=download
https://drive[.]google[.]com/uc?id=1KJ702ReZ_C_Z6sHzd2W1hciHjhSd9pH&export=download
https://drive[.]google[.]com/uc?id=19eGOwbQZU8Qtvt2t5kqPdvRY7S_1N504&export=download
https://drive[.]google[.]com/uc?id=1A6JFwcE0s9KFdLkdABgZmnavH709XCtM&export=download
https://drive[.]google[.]com/uc?id=1PSKh4XIMoPCsLmsUvmqWJ67lyoQuOBgZ&export=download
https://drive[.]google[.]com/file/d/1S6WhR8iIXTsKxroU6tY_PlJhDlA_0r_-/view?usp=drive_web
https://drive[.]google[.]com/uc?id=1tf0_WX1Qak84rfylGEoo4YvlYU5Dd5vA&export=download
https://drive[.]google[.]com/uc?id=1_kYWY8u9mLqNBfBQh53ZQSxAPFB_hWaf&export=download
https://drive[.]google[.]com/uc?id=1vQWG_GdVcqM_pp_UbbEysuC_AGr4flFP&export=download
https://drive[.]google[.]com/uc?id=1oyY0Fda3sqnogAIQQdkr3yDko5RJX67E&export=download
https://drive[.]google[.]com/uc?id=1qKHgooWqJaaPxtEaPDbhaL0oD_NheOi6&export=download
https://drive[.]google[.]com/file/d/1zHRbWBx1ZXNMetm7RxawRS2b55yF6337/view?usp=drive_web© 2022 Trend Micro Inc.

C&C Servers
Domains / IPs
89[.]38[.]225[.]151
103[.]15[.]29[.]179
202[.]53[.]148[.]24
103[.]15[.]28[.]208
202[.]58[.]105[.]38
98[.]142[.]251[.]29
202[.]53[.]148[.]26
23[.]106[.]122[.]81
38[.]54[.]33[.]228
212[.]114[.]52[.]210
158[.]255[.]2[.]63
closed[.]theworkpc[.]com

88© 2022 Trend Micro Inc.

Appendix
89© 2022 Trend Micro Inc.

Abused Legitimate Executables for DLL Side Loading
Original Filename

SHA1

Description

Signeradobe_licensing_wf_helper.exe

0d451c8ee760d3fdf1233b44b657dc10e0450bb6

Adobe Licensing WF Helper

Adobe Inc.

AppXUpdate.exe

679cde0668e0c196e6d38353568f6a8d8a51b456

Silverlight.Configuration.exe

c8f5825499315eaf4b5046ff79ac9553e71ad1c0

Microsoft® Silverlight Configuration Utility

Microsoft Corporation

hpqhvind.exe

4d13b1ab91b766b35dbaca4e6a18eae7a06afb76

HelpContentIndexer

Hewlett Packard

TenioDL.exe

ad70a71088a8703ec81eb4ad307a0105a29199ac

Tencent TenioDL for Game

Tencent Technology(Shenzhen) Company Limited

MasterPDF.exe

0616592e11a756a8ed25a24d1723938af9f26e48

迅读PDF大师主程序天津迅读科技有限公司

2345DLAgent.exe

04571cc1bd7a55b77afd7fe7670487eb14575f16

网络辅助工具Shanghai 2345 Mobile Technology Co., Ltd.

Setup.exe

4e371fdea1258f508a956b9a7dd58e3aee9a67a4

Suite Integration Toolkit Executable

Microsoft Corporation

UpdateTrayIcon.exe

75c4d1f1b6b23d769cc7819d499e06b4f236925e

WinWord.exe

6e35ae1d5b6f192109d7a752acd939f5ca2b97a6

Microsoft Word

Microsoft Corporation

minibrowser.exe

90174d17461d503751710f8a406cd2394906e901

腾讯TBS

Tencent Technology(Shenzhen) Company Limited

active_desktop_launcher.exe

db999a5ecf4e1c87fae10983f6d23b26069cbba1

active_desktop_launcher

GuangZhou KuGou Computer Technology Co.,Ltd.

AvastBrowserUpdate.exe

07294e556b26d22d52b9b76e04820071c76be354

Avast Browser

Avast Software s.r.o.

AVGBrowserUpdate.exe

2aa50e30b68dcd57f522304a1c0e28ffbd881e04

AVG Browser

AVG Technologies USA, LLC

90© 2022 Trend Micro Inc.

国信证券股份有限公司

Tencent Technology(Shenzhen) Company Limited

Custom Exception Handler – 1/4

91© 2022 Trend Micro Inc.

Custom Exception Handler – 2/4

While coding, we use the syntax “throw” to trigger an exception manually.
After compilation, this call is turned into _CxxThrowException.
What comes before this call is a ThrowInfo structure (the offset to _TI1D).

92© 2022 Trend Micro Inc.

Custom Exception Handler – 3/4

The C++ runtime finds all the way down to the CatchTableType structure.
The member pTypeInfo specifies the data type of this exception.

93© 2022 Trend Micro Inc.

Custom Exception Handler – 4/4

The member pTypeInfo is used to locate which handler (CatchProc) should be invoked basedon the pType member in the _msRttiDscr array.

94© 2022 Trend Micro Inc.