Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Phishing emails leveraging authentic-looking Microsoft Office documents were the initial vector.
- Malicious macros executed upon user interaction downloaded secondary payloads, exploiting T1059.003 – PowerShell.
- Communication back to the C2 was obscured using HTTPS, leveraging public hosting services to hide the true intent.
Executive Summary
During our investigation into a series of incidents targeting multiple sectors, we observed a sophisticated phishing campaign that utilized Microsoft Office macros as its primary vector for initial access. The phishing emails presented as legitimate communications, tricking users into enabling macros which initiated the malicious payload. Our analysis revealed the usage of PowerShell scripts as the primary execution method, leading to a carefully orchestrated command and control (C2) communication pattern that employed common web hosting solutions to obfuscate their tracks.
Initial Access
The phishing emails contained links to malicious attachments, often appearing as invoices or important documents from reputable sources. These attachments typically held legitimate-looking Word documents with embedded malicious macros. When the victim enabled macros, the macro would execute a PowerShell command to download and execute the secondary payload from a remote server. Notably, the attachment’s file path often resembled typical document directories, enhancing the social engineering aspect.
Execution & Persistence
The payload we examined primarily consisted of an executable binary disguised as a PDF viewer, which was downloaded via PowerShell commands. This step employed the T1059.003 – PowerShell technique to execute scripts directly in memory, sidestepping traditional file-based detection mechanisms. Once executed, the implant initiated persistence within the system by creating registry entries under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, allowing it to execute on system boot.
Command and Control
Our analysis identified a dynamic command and control infrastructure that relied heavily on HTTPS communications. The actor utilized common web hosting services, further obfuscating their commands within TLS-encrypted traffic. Initial callbacks were observed to a URL that appeared benign but contained patterns consistent with C2 behavior, such as regular check-ins for configuration files and additional commands.
Lateral Movement & Discovery
Once installed, the implant deployed methods for lateral movement using T1075 – Pass the Hash attacks, leveraging credentials harvested from the local system. We detected attempts at accessing subsequent machines across the network by impersonating authenticated sessions. The actor utilized various techniques for discovery, including querying network resources and searching for domain and local usernames that could be exploited for further access.
Impact & Objectives
The primary objective of this attack was to exfiltrate sensitive information and gather intelligence on network configurations. The data extracted was likely intended for further exploitation, with specific targeting of financial records noticeable from the files being accessed. In one instance, harvested data included documents detailing financial contracts and employee personal data. This indicates a dual intent: both financial gain and potential identity theft.
MITRE ATT&CK Mapping
- T1566 – Phishing: Exploits social engineering to gain initial access through deceptive emails.
- T1059.003 – PowerShell: Executes malicious commands through PowerShell to facilitate further access and payload downloads.
- T1075 – Pass the Hash: Leverages stolen hash credentials for lateral movement across systems.
Detection Opportunities
- Implement email filtering solutions to detect and quarantine similar phishing attempts featuring macro-enabled documents.
- Monitor for unusual PowerShell usage in the environment, particularly those that download and execute scripts.
- Utilize endpoint detection and response (EDR) tools to identify unauthorized registry modifications related to startup persistence mechanisms.
Analyst Notes
It’s critical to increase user awareness regarding the risks associated with enabling macros in Microsoft Office documents. Regular training sessions and phishing simulation exercises can significantly reduce the likelihood of successful social engineering attempts. Additionally, organizations must adopt a layered security strategy that includes robust email filtering, advanced endpoint protection, and thorough monitoring of network activity to enhance detection and response capabilities.
Source: Original Report