Deep Dives

In-Depth Analysis of a Targeted Phishing Campaign Leveraging PowerShell Backdoor

by n8n admin

Sarah Chen — Malware Reverse Engineer

Key Takeaways

  • A sophisticated phishing attack initiates with a weaponized document
  • Persistence achieved via Registry run keys and scheduled tasks
  • Command and Control established through HTTP POST requests to a dynamic hostname

Executive Summary

During our investigation into a recent targeted phishing campaign, we observed a multi-stage attack chain that demonstrates advanced tactics and persistence mechanisms. The actors leveraged a malicious Microsoft Word document to deliver a PowerShell backdoor, designed for remote control and data exfiltration. This analysis will break down the steps taken by the threat actor from initial access through to the final impact on the victim’s environment.

Initial Access

The infection vector began with a well-crafted phishing email containing an attachment masquerading as an invoice. The document, named Invoice_Details.docx, prompted the recipient to enable macros to view its contents. Using social engineering techniques, the attackers convinced users to permit macro execution, triggering the execution of embedded PowerShell code.

Execution & Persistence

Upon enabling macros, the macro executed a PowerShell command that downloaded a backdoor payload from a remote server. Our analysis revealed that this payload was obfuscated to evade initial detection by traditional security solutions. Specifically, the PowerShell command utilized a Base64 encoded string to download the executable. The backdoor was then set to run at every system startup through modifications made to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key. Additionally, a scheduled task was created to ensure persistence, calling a PowerShell script every hour.

Command and Control

The threat actor established a command-and-control (C2) infrastructure utilizing dynamic DNS providers. Our investigation indicated that the C2 server was reachable through an HTTP POST request, sending regular beacons to receive instructions. The traffic analysis identified the use of headers mimicking legitimate services, further obfuscating the malicious intent. The C2 also employed a feedback channel that allowed the operator to issue commands to the infected machines seamlessly.

Lateral Movement & Discovery

Once the backdoor was successfully installed, we observed attempts at lateral movement through the exploitation of weak credentials on network shares. The implant used Windows Admin Shares to attempt accessing other devices on the network. Additionally, reconnaissance commands were run, querying for active directory information and accessing service accounts that could yield administrative privileges.

Impact & Objectives

The primary objective of this operation appeared to be data exfiltration. Our analysis revealed that the backdoor was configured to capture screenshots and keystrokes, later exfiltrating this sensitive information back to the C2. Furthermore, the presence of various stages of the attack suggested the entities behind it were interested in maintaining long-term access, likely for espionage or further network compromises. The endpoints monitored showed signs of further exploitation with secondary payloads being downloaded that targeted sensitive internal data.

MITRE ATT&CK Mapping

  • T1203 – Exploitation for Client Execution: Utilization of a phishing email to execute macros in a malicious document.
  • T1059.001 – PowerShell: Use of PowerShell scripts for remote access and command execution.
  • T1071.001 – Application Layer Protocol: Web Protocols: C2 communication over HTTP.
  • T1021.001 – Remote Services: SMB/Windows Admin Shares: Lateral movement through network shares.

Detection Opportunities

  • Monitor for unusual PowerShell execution with Base64 encoded commands.
  • Audit HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run for unauthorized entries.
  • Check for abnormal outbound HTTP requests to dynamic DNS services.

Analyst Notes

This investigation highlights the need for continuous security training for employees on recognizing phishing attempts. Moreover, implementing network segmentation can limit lateral movement, and regular review of system changes and user permissions can help mitigate the risk of such attacks. It remains critical to bolster endpoint detection and response (EDR) capabilities to identify and respond to such implants at the earliest stage.

Source: Original Report

Related Posts