Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Phishing campaign predominantly targets corporate users through malicious macros in Office documents.
- The campaign employs obfuscation techniques to evade detection, utilizing PowerShell for execution.
- Indicators of compromise (IOCs) include specific file hashes and C2 domains that should be monitored closely.
Executive Summary
During our investigation of a recent phishing campaign, we observed that the attackers primarily targeted corporate environments by distributing malicious Microsoft Office documents. The campaign relied heavily on social engineering tactics to trick users into enabling macros, which then executed a PowerShell script. Our analysis revealed a layered approach to the attack, demonstrating a clear understanding of defenses and methods to bypass them. This report details our findings, outlining the complete attack chain from initial access to potential impacts on affected organizations.
Initial Access
The initial access vector involved the distribution of spear-phishing emails that contained a Microsoft Office document attachment. Upon opening the document, users were presented with a seemingly legitimate message instructing them to enable macros to view the content. This social engineering tactic is prevalent among threat actors, with indicators suggesting that the emails were crafted to appear as internal communications, further lowering the target’s defenses.
Execution & Persistence
Once the user enabled macros, the malicious code embedded within the document triggered. The macro executed a PowerShell command that downloaded and executed a secondary payload from a remote server. Our analysis identified that the PowerShell script was obfuscated, highlighting the actor’s intent to evade detection using techniques such as **T1059.001 – PowerShell**. The persistence mechanism, while not overtly aggressive, seemed to involve creating scheduled tasks that would re-establish the actor’s access in case the initial foothold was disrupted.
Command and Control
The communication between the infected hosts and the command and control (C2) server was primarily conducted over HTTP using a custom protocol. We observed that the actor employed domain generation algorithms (DGA) to limit the lifespan of hardcoded C2 domains, enhancing their resilience against takedown efforts. Traffic analysis pointed towards a variety of C2 domains, all exhibiting characteristics typical of dynamic DNS services, making it difficult to pinpoint the operator’s location.
Lateral Movement & Discovery
Following initial access, the implant exhibited lateral movement capabilities that allowed the actor to navigate the internal network. This was achieved using **T1075 – Pass the Hash** and **T1086 – PowerShell** to execute commands on other machines. The actor leveraged network shares and weak credentials to facilitate access to sensitive systems, indicating a well-researched target profile. Additionally, we noted attempts to exfiltrate data by querying Active Directory for credential information, which points to **T1016 – System Network Configuration Discovery** as one of their methods of reconnaissance.
Impact & Objectives
The ultimate objectives of this campaign appear to be data theft and espionage. As we delved deeper, indicators such as searches for file types relevant to intellectual property suggested that the actor was not merely interested in disruptive activities but rather aimed for long-term access to sensitive corporate information. The persistence mechanisms employed indicate that the attacker sought an environment in which they could establish a foothold over an extended period, highlighting the need for heightened vigilance around emerging threats.
MITRE ATT&CK Mapping
- T1059.001 – PowerShell: Execution of malicious commands via PowerShell to facilitate download and execution of secondary payloads.
- T1075 – Pass the Hash: Use of stolen hashed credentials to authenticate to other systems.
- T1086 – PowerShell: Utilization of PowerShell for lateral movement and system discovery.
- T1016 – System Network Configuration Discovery: Queries made to identify network resources and system configurations for lateral movement and data exfiltration.
Detection Opportunities
- Monitor for execution of PowerShell scripts that utilize base64 encoding or other forms of obfuscation.
- Implement alerting on the creation of scheduled tasks that are anomalous or executed through non-standard user accounts.
- Employ network traffic analysis to detect any communication with known C2 domains or anomalous DNS queries indicative of DGA usage.
Analyst Notes
The findings from this investigation underscore the necessity for comprehensive email filtering and user training to mitigate the risk associated with phishing attacks. The use of malicious Office documents is expected to persist owing to its effectiveness. Organizations should prioritize monitoring for the techniques outlined in the MITRE ATT&CK framework to reduce the resilience and effectiveness of such campaigns. Enhanced visibility into network configurations and authentication attempts is vital in preemptively disrupting the attackers’ lateral movement capabilities.
Source: Original Report