Mike Torres — Incident Response Specialist
Key Takeaways
- Embedding PowerShell scripts into malicious documents remains a prevalent tactic among threat actors.
- The malware utilizes a multi-stage payload delivery mechanism, highlighting the need for advanced detection capabilities.
- Behavioral analysis reveals extensive use of legitimate tools for lateral movement and data exfiltration, complicating attribution.
Executive Summary
The recent malware campaign we’ve investigated showcases the actor’s preference for embedding PowerShell scripts in malicious documents. While this technique is not new, our analysis revealed a highly sophisticated multi-stage execution that demonstrates a deep understanding of evasion techniques and the exploitation of Windows administrative tools. The sample we examined used obfuscated PowerShell commands to facilitate command and control (C2) communication, lateral movement, and ultimately, data exfiltration from compromised systems.
Initial Access
During our investigation, we noted that the initial access vector was achieved through a phishing email containing a malicious document. The document exploited a zero-day vulnerability in Microsoft Word, prompting users to enable macros. Once macros were enabled, the embedded PowerShell script was executed. This is indicative of our previous encounters with similar tactics observed in groups linked to the TA505 actor group.
Execution & Persistence
Following initial access, the payload downloaded additional malware components hosted on various cloud services. Our analysis revealed that the first stage was primarily a dropper, responsible for further payload acquisition. The dropper itself placed files in %APPDATA%\Roaming\Microsoft under an innocuous folder name, effectively using persistence mechanisms to ensure its continued execution upon reboot. Additionally, we identified modifications to the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, where a new entry was created pointing to the dropper.
Command and Control
The malware’s C2 infrastructure employed a series of dynamic domains, which changed frequently, making it challenging to block and trace. Our analysis demonstrated the use of HTTP/S beacons that communicated with command servers residing on cheap cloud hosting services. The communication was encrypted, and the payloads were designed to blend with normal traffic patterns, effectively concealing the malicious behavior from standard network monitoring tools. Several domains were identified as malicious, and we documented them as IOCs for future reference.
Lateral Movement & Discovery
Once the implant established a foothold in the environment, it leveraged tools like WMIC and PowerShell for lateral movement within the network. We observed this activity correlating with the use of T1075 – Pass-the-Hash, suggesting the actor aimed to propagate through the network by exploiting stolen credentials. The actor executed numerous discovery commands, notably Get-ADUser and Get-ADComputer, aimed at gathering intelligence about other targets within the Active Directory infrastructure.
Impact & Objectives
The ultimate goal of this campaign appears to be data exfiltration. After establishing a strong foothold and mapping the network, the actor transitioned to using the FTP protocol to move sensitive files to external servers. Our investigation noted that the command sequence included the use of Invoke-WebRequest to send data back to the C2. This method not only facilitated data transfer but also minimized the detection risk, as FTP traffic may not always trigger alerts within enterprise environments.
MITRE ATT&CK Mapping
- T1133 – External Remote Services: Abuse of legitimate external remote services for Lateral Movement.
- T1071 – Application Layer Protocol: Utilize application layer protocols for C2 traffic.
- T1068 – Exploit Public-Facing Application: Exploit vulnerabilities in public-facing applications for initial access.
Detection Opportunities
- Monitor for suspicious PowerShell command executions, especially those involving
Invoke-ExpressionorSet-ExecutionPolicy. - Implement endpoint detection tools to identify changes in the registry related to startup programs.
- Analyze network traffic for unusual C2 communication patterns, especially over non-standard ports or using dynamic domains.
Analyst Notes
This investigation underscores the necessity for security teams to implement layered defenses, including user education to mitigate phishing attempts. Continuous monitoring and threat hunting are critical in detecting the early stages of such sophisticated attack chains. The use of legitimate tools for malicious purposes complicates detection, thus emphasizing the importance of behavioral analytics as opposed to reliance solely on signature-based solutions.
Source: Original Report