ChChes

Malware & Tools · ChChes

· MalwareS0144 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

ChChes is a Trojan that appears to be used exclusively by menuPass. It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool. (Citation: Palo Alto menuPass Feb 2017) (Citation: JPCERT ChChes Feb 2017) (Citation: PWC Cloud Hopper Technical Annex April 2017)

Tactic Coverage

command and control (4)discovery (3)defense impairment (2)stealth (1)persistence (1)privilege escalation (1)credential access (1)

Used By (1 groups)

G0045menuPassCicada, POTASSIUM

Techniques (12)

T1036.005Match Legitimate Resource Name or Location

stealth

T1057Process Discovery

discovery

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1132.001

References

https://attack.mitre.org/software/S0144 https://x.com/ItsReallyNick/status/850105140589633536 https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/https://blogs.jpcert.or.jp/en/2017/02/chches-malware--93d6.html https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf