Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The phishing campaign exploited Office macros to deliver a sophisticated malware payload.
- Post-exploitation activities involved extensive use of PowerShell for lateral movement across the network.
- Indicators of Compromise (IOCs) included specific domain names, IP addresses, and malicious file hashes associated with the attacker’s infrastructure.
Executive Summary
During our investigation, we delved into a recent phishing attack that leveraged malicious Office document attachments to gain initial access to target networks. The attacker employed a well-crafted social engineering approach, luring unsuspecting users into enabling macros, thereby facilitating the execution of the malware payload. Our analysis revealed that the compromised systems were then subjected to a series of post-exploitation activities aimed at lateral movement and data extraction. We traced the attack chain, uncovering the intricate tactics utilized by the threat actor to maneuver undetected throughout the environment.
Initial Access
The attack commenced with a seemingly innocuous email containing a fraudulent invoice. Opening the attached document prompted users to enable macros, a common technique referred to in the MITRE ATT&CK framework as T1059.001 – Command and Scripting Interpreter: PowerShell. Once enabled, the macros executed a PowerShell command that download and executed a secondary payload from a remote server. The URL pattern utilized a domain that closely resembled a legitimate service provider, enhancing the likelihood of user interaction and macro execution.
Execution & Persistence
Once the payload was executed, we observed that it deployed a dropper known as ShellInteract. This dropper was responsible for further fetching the main payload, which was a persistent backdoor written in .NET. The implant was persisted through the use of the Windows Task Scheduler, with the task set to trigger at user logon on all infected systems. This technique aligns with T1053.005 – Scheduled Task/Job: Scheduled Task in the MITRE ATT&CK framework. The task was created with a command line invocation that referenced a hidden file located at C:\Users\Public\Documents\hidden.exe.
Command and Control
Our analysis indicated that the implant established a robust command and control (C2) connection to a remote server hosted on a dynamically assigned IP address. The communications were encrypted, utilizing SSL to obscure the traffic from network monitoring solutions. The malware employed a beaconing mechanism with intervals configured to evade detection while still allowing the attacker to issue commands and exfiltrate data. This technique is consistent with T1071.001 – Application Layer Protocol: Web Protocols. We identified several domain names used by the C2, including exampledynamicdomain.com, which were registered shortly before the attack commenced.
Lateral Movement & Discovery
After establishing a foothold, the actor sought to capture credentials to facilitate lateral movement within the network. Our investigation revealed that the implant executed a series of PowerShell commands to harvest credentials using T1003.001 – Credential Dumping: LSASS Memory, allowing the attacker to pivot to additional machines within the environment. Several remote services, including RDP and SMB, were targeted to facilitate unauthorized access to clustered systems. The existence of the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key was used to identify startup applications aligning with lateral movement tactics.
Impact & Objectives
The primary objective of the attackers appeared to be exfiltration of sensitive data, with a particular focus on proprietary financial documents and email communications. During our investigation, we isolated the exported files from compromised machines, revealing attachments consistent with high-value intellectual property. The threat actor’s endgame aligned with T1041 – Exfiltration Over Command and Control Channel, where data was systematically extracted and transmitted back to the C2 server. Given the nature of the documents targeted, the attackers likely aimed to sell the information or use it for further espionage activities against the organization.
MITRE ATT&CK Mapping
- T1059.001 – Command and Scripting Interpreter: PowerShell: Execution of PowerShell scripts for initial access and lateral movement.
- T1053.005 – Scheduled Task/Job: Scheduled Task: Utilization of Task Scheduler for persistence.
- T1071.001 – Application Layer Protocol: Web Protocols: Use of web protocols in C2 communication.
- T1003.001 – Credential Dumping: LSASS Memory: Credential harvesting for lateral movement.
- T1041 – Exfiltration Over Command and Control Channel: Systematic data exfiltration to C2.
Detection Opportunities
- Monitor for suspicious PowerShell execution patterns within your environment, particularly in relation to macro-enabled Office documents.
- Implement alerts for the creation of scheduled tasks that reference unusual file paths or contain encoded commands.
- Track and analyze network traffic for communication with known malicious domains or anomalous SSL traffic patterns.
Analyst Notes
This case underscores the importance of comprehensive email filtering and user education regarding the risks of enabling macros in unexpected documents. Additionally, organizations should regularly audit scheduled tasks and monitor credential access patterns to preemptively identify potential lateral movement activities. Implementing least-privilege access controls and enforcing MFA can significantly mitigate the risks presented by this attack vector.
Source: Original Report