Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Phishing emails exploited to gain initial access through malicious Office documents.
- Malware employs PowerShell scripts for execution and maintaining persistence on infected systems.
- Command and Control (C2) communications utilize encrypted channels to obfuscate network traffic.
Executive Summary
This analysis delves into a recent phishing campaign that effectively utilized a combination of malicious Microsoft Office documents and PowerShell-based malware to establish footholds in corporate environments. Our investigation revealed a sophisticated method of initial access that leveraged social engineering tactics, followed by the deployment of a dropper that employed in-memory execution techniques to evade detection. The subsequent stages involved establishing robust persistence mechanisms through scheduled tasks and maintaining covert communication with external Command and Control (C2) servers.
Initial Access
During our investigation, we observed that the initial access vector involved a well-crafted phishing email, which was designed to appear as an important corporate communication. The email included a malicious attachment, specifically a Word document that, when opened, prompted the victim to enable macros. This macro executed a PowerShell command that downloaded the malware payload from a remote server. The initial Office document was located at C:\Users\[USERNAME]\Downloads\Invoice.docm. Our analysis of the email headers indicated that the attacker used a spoofed domain to increase the likelihood of user interaction.
Execution & Persistence
Once executed, the PowerShell script acted as a dropper, retrieving the main payload — a variant identified as PowerShell/TrojanDownloader. This payload was responsible for establishing persistence within the system by creating a scheduled task at C:\Windows\System32\Tasks\MyTask, which invoked the PowerShell command every hour. This task was named inconspicuously, minimizing detection chances by security solutions. Furthermore, it was set to run under the user context, allowing unrestricted access to the environment.
Command and Control
Our analysis revealed that the malware communicated with a remote server via HTTPS, utilizing a dynamically generated domain name which made blocking conditions exceedingly challenging. The C2 traffic was encrypted, and we noted the usage of base64 encoded data patterns, common in sophisticated malware to obscure the actual commands and results of the infected machine’s actions. Communication was established over a custom protocol that employed randomly chosen ports, thereby complicating pattern recognition attempts by network monitoring tools.
Lateral Movement & Discovery
After establishing a foothold, the actor attempted lateral movement within the network by leveraging stolen credentials obtained from the initial infection. The malware employed T1078 – Valid Accounts for privilege escalation and attempted to access shared drives. Additionally, scripts were used to enumerate domain accounts and retrieve sensitive information, further facilitating movement across the network. We traced attempts to access other machines at \192.168.1.10\SharedFolder which indicated a reconnaissance phase prior to data exfiltration.
Impact & Objectives
The ultimate objective of this campaign appeared to be data exfiltration and potential installation of additional backdoors that could facilitate ongoing access. During our investigation, we identified evidence of sensitive data being potentially siphoned off the network, with indicators suggesting the theft of personal identifiable information (PII) and intellectual property. The impact of this breach could have ramifications not only on the immediate victims but also on partners and clients involved with the affected organizations.
MITRE ATT&CK Mapping
- T1566 – Phishing: The actor leveraged phishing emails with malicious attachments to gain initial access.
- T1059 – Command and Scripting Interpreter: PowerShell was utilized for executing commands and script downloads.
- T1070 – Indicator Removal on Host: The malware attempted to hide its tracks by manipulating timestamps and scheduled tasks.
Detection Opportunities
- Implement email filtering solutions to detect and quarantine phishing attempts based on known IOC patterns.
- Monitor PowerShell execution logs for unusual script execution or commands that attempt to download remote resources.
- Utilize endpoint detection and response (EDR) tools to monitor for changes to scheduled tasks and suspicious lateral movement patterns.
Analyst Notes
This phishing campaign showcases the evolving tactics employed by threat actors targeting corporate entities. The use of PowerShell as a means of execution is particularly concerning due to its ubiquity in administrative tasks. Organizations should enhance user training regarding phishing and continue to implement robust detection systems to identify and mitigate these threats proactively.
Source: Original Report