Mike Torres — Incident Response Specialist
Key Takeaways
- Hanny malware utilizes spear-phishing as its primary initial access method, leveraging social engineering tactics.
- The malware exhibits sophisticated persistence mechanisms by leveraging Windows Task Scheduler for maintaining access.
- Command and control communications are obfuscated, employing HTTPS to evade traditional detection methods.
Executive Summary
In our investigation of a recent Hanny malware campaign, we observed a well-structured attack chain that begins with spear-phishing emails targeting specific individuals within organizations. These emails often contained malicious attachments or links leading to malware downloads. Our analysis revealed that the attacker was meticulous in their approach, utilizing social engineering elements specific to the victims’ interests and roles. This allowed them to bypass initial security controls, leading to a series of actions aimed at maintaining persistence and establishing robust command and control channels.
Initial Access
The initial access vector for the Hanny malware was identified as spear-phishing, where we analyzed multiple email samples. These emails contained enticing subject lines that referenced recent events relevant to the target organizations, prompting users to open them. Embedded within these emails were malicious Microsoft Word documents, which upon opening, prompted the user to enable macros. We discovered that the macros executed VBScript that ultimately downloaded the Hanny dropper from a remote server.
Execution & Persistence
Once executed, the Hanny dropper initiated a series of procedures designed for effective execution and persistence. Our analysis uncovered that the dropper deployed the main payload of the malware into the user’s Application Data folder at %APPDATA%\Hanny\hanny.exe. In addition to this, it created persistence through the Windows Task Scheduler, scheduling a task to run the malware every time the user logged in. This task was identified at C:\Windows\System32\Tasks\HannyTask, which ensured that even if the malware was terminated, it would automatically restart upon the next login.
Command and Control
The command and control (C2) infrastructure utilized by Hanny employed a mix of dynamic DNS and hardcoded domains, making it challenging to identify the C2 servers. During our investigation, we detected that the malware periodically beaconed to an HTTPS endpoint, specifically utilizing obfuscation techniques to disguise the traffic. The communications included encrypted payloads, indicating advanced attempts by the actor to evade network detection systems. Analyzing the traffic patterns, we noted that the malware typically sent beacons every 60 seconds, suggesting that the attacker was keen on maintaining real-time access to the compromised system.
Lateral Movement & Discovery
Once the Hanny malware had established a foothold, the next phase involved lateral movement and reconnaissance within the network. Our forensic analysis revealed the utilization of Windows Management Instrumentation (WMI) for lateral movement, leveraging the T1047 – Windows Management Instrumentation technique. This technique enabled the actor to query for additional systems on the network and execute commands remotely. We found evidence of attempts to enumerate user accounts and retrieve network shares, culminating in the mapping of critical assets for potential data exfiltration.
Impact & Objectives
The ultimate objectives of the Hanny malware campaign appeared to be data exfiltration and prolonged network presence. Indicators pointed to the actor’s interest in sensitive documents, with targeted organizations being from sectors with proprietary information. Our analysis exposed that the malware not only aimed to steal data but also sought to set up backdoor access for future operations, hinting at a broader intent for espionage rather than immediate financial gain.
MITRE ATT&CK Mapping
- T1566 – Phishing: Hanny leveraged spear-phishing emails to gain initial access.
- T1105 – Ingress Tool Transfer: Used to download the payload from a remote server.
- T1053 – Scheduled Task: The malware maintained persistence through Task Scheduler.
- T1047 – Windows Management Instrumentation: Used for lateral movement and discovery within the network.
Detection Opportunities
- Monitor for unusual email patterns and specific keywords associated with spear-phishing attempts.
- Implement behavioral detection for process execution from
%APPDATA%to capture malware behavior. - Inspect scheduled tasks for entries that appear suspicious or are associated with known malware.
Analyst Notes
This investigation underscores the continued efficacy of social engineering tactics and the need for proactive threat hunting. The stealthy nature of Hanny’s operations spotlights the importance of having robust logging and monitoring systems in place. By understanding the attack chain, we can better prepare our defenses and develop tailored detection strategies against similar threats.
Source: Original Report