Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

Summary

Kimsuky uses malicious Compiled HTML (.chm) files as initial lures to trigger a multi-stage infection chain. The operation abuses native Windows utilities such as PowerShell, certutil, and wscript to profile the system, establish persistence through scheduled tasks, and exfiltrate collected data. The actor also applies selective payload delivery, providing the final operational component only after certain environmental or behavioral conditions are satisfied.

Investigation

The researcher analyzed a suspicious CHM sample and reconstructed its execution chain, which consisted of multiple VBScript and PowerShell stages. By replaying network requests and testing from different proxy locations, the researcher uncovered a selective response model in which the final payload was not delivered to the sandboxed environment. The investigation also connected the infrastructure to known Kimsuky activity through favicon similarities and web server fingerprinting.

Mitigation

Organizations should monitor suspicious process ancestry, especially cases where hh.exe or wscript.exe launches PowerShell or cmd.exe. Restricting execution of script content from user-writable locations such as the Internet cache can help block persistence. Monitoring unauthorized changes to Internet Explorer and Microsoft Edge registry settings can also improve detection of host tampering.

Response

If this activity is detected, isolate the affected endpoint immediately to prevent additional command-and-control traffic. Perform memory forensics to identify any fileless PowerShell payloads loaded into process memory. Review scheduled tasks for suspicious entries such as Edge Updater and inspect the %USERPROFILE%\Links directory for deceptive .dat or .ini files.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to achieve initial execution via a weaponized .chm file. Once the user opens the file, the compiled HTML Help file uses an embedded script to invoke hh.exe. To evade standard detection, the actor uses hh.exe to launch PowerShell, effectively masking the shell execution under a legitimate Windows help process. The goal is to establish a foothold by executing a hidden PowerShell command that can pull down a secondary stage payload.

• Regression Test Script:

  # Simulation of Kimsuky CHM-to-PowerShell Execution Chain
  # This script simulates the behavior of hh.exe spawning PowerShell as detected by the rule.
  
  Write-Host "[+] Starting Kimsuky CHM Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate hh.exe spawning PowerShell (Matches selection_hh)
  Write-Host "[+] Triggering Rule: hh.exe spawning PowerShell..." -ForegroundColor Yellow
  Start-Process "hh.exe" -ArgumentList "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command Write-Output 'Simulation Success'"
  
  # 2. Simulate wscript.exe executing VBScript (Matches selection_wscript)
  Write-Host "[+] Triggering Rule: wscript.exe with VBScript flag..." -ForegroundColor Yellow
  $tempVBS = "$env:TEMPtest_sim.vbs"
  "WScript.Echo ""Simulation Success""" | Out-File -FilePath $tempVBS -Encoding ascii
  Start-Process "wscript.exe" -ArgumentList "/e:vbscript $tempVBS"
  
  # 3. Simulate cmd.exe with hidden window (Matches selection_cmd)
  Write-Host "[+] Triggering Rule: cmd.exe with Hidden Window Style..." -ForegroundColor Yellow
  Start-Process "cmd.exe" -ArgumentList "/c PowerShell -WindowStyle Hidden -Command Write-Output 'Simulation Success'"
  
  Write-Host "[+] Simulation commands dispatched." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup temporary files created during simulation
  Remove-Item -Path "$env:TEMPtest_sim.vbs" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan