Deep Dives

In-Depth Analysis of a Recent Phishing Campaign Leveraging Excel Macros and Cobalt Strike for Lateral Movement

by n8n admin

Priya Nair — Digital Forensics Analyst

Key Takeaways

  • Insider threat simulations show targeting via phishing emails using malicious Excel documents.
  • The attack employed Cobalt Strike for lateral movement and persistence within the network.
  • Utilization of PowerShell for execution of malicious scripts raised red flags during our behavior analysis.

Executive Summary

This analysis examines a recent phishing campaign that effectively deployed malicious Excel macros to gain initial access into a target network. Our investigation revealed a sophisticated exploitation technique combined with Cobalt Strike toolset for lateral movement. The actor demonstrated advanced capabilities by leveraging inherent system tools like PowerShell to enable persistence. By mapping the attack to the MITRE ATT&CK framework, we can understand the methodologies employed as well as potential detection strategies.

Initial Access

The attacker initiated the campaign by sending a phishing email containing a malicious Excel file. This Excel document was crafted to entice users with a legitimate-looking subject, ultimately persuading them to enable macros. Once enabled, the macro called a Base64 encoded PowerShell command, which facilitated the download of secondary payloads hosted on a remote server. Our analysis showed that the dropper was executed from a temporary folder: %TEMP%\random_file.exe. This method is commonplace among actors aiming to bypass traditional security controls.

Execution & Persistence

Upon execution, the dropper utilized a PowerShell script to establish an initial payload which enabled the actor to maintain a foothold. The payload leveraged the Windows Management Instrumentation (WMI) for persistence through a scheduled task. Our investigation revealed a newly created task under the folder C:\Windows\System32\Tasks\ named “Update Service” that executed a PowerShell script every hour. This technique falls under the persistence category of Scheduled Task in the MITRE framework.

Command and Control

The command and control (C2) communications initiated shortly after the system was compromised. Using Cobalt Strike, the attacker established a secure channel, communicating over HTTPS to obfuscate their traffic. Our investigation highlighted traffic to a domain configured to mimic a legitimate service, facilitating communications for command execution and data exfiltration. This method illustrates the use of Application Layer Protocol for C2, specifically using T1071.001 – Application Layer Protocol: Web Protocol, which is effective for evading detection.

Lateral Movement & Discovery

Once initial access was confirmed, the actor employed Credential Dumping techniques to gather user credentials, enhancing their ability to move laterally across the network. By utilizing tools such as Mimikatz hidden within the legitimate PowerShell execution processes, the actor was able to harvest credentials stored in memory. This allowed for further traversing into sensitive systems, consistent with tactics described in T1003.001 – Credential Dumping: LSASS Memory. The actor executed additional reconnaissance commands via Windows PowerShell to identify valuable targets, utilizing commands like Get-ADUser to enumerate user accounts.

Impact & Objectives

The overall objective of this campaign appeared to be data exfiltration and potential ransom demands. Key data extracted involved sensitive employee information and proprietary documents, leading us to believe that the actor aimed for both financial gain and disruption. The exfiltration was accomplished via compressed and encrypted archives sent to an external FTP server, which showcased not only the intent but also the level of operational security practiced by the actor.

MITRE ATT&CK Mapping

  • T1193 – Spear Phishing Attachment: Delivery of malicious Excel files through spear phishing emails.
  • T1086 – PowerShell: Execution of malicious scripts from within PowerShell for various stages of the attack.
  • T1071.001 – Application Layer Protocol: Web Protocol: C2 communication over HTTPS.
  • T1003.001 – Credential Dumping: LSASS Memory: Harvesting credentials from memory for lateral movement.

Detection Opportunities

  • Monitor for suspicious PowerShell command executions, particularly those involving Base64 encoded strings or external script downloads.
  • Implement alerts for the creation of scheduled tasks, especially ones that exhibit unusual behavior or names.
  • Utilize endpoint detection tools to analyze and alert on unusual network traffic patterns, focusing on outbound connections to unknown domains.

Analyst Notes

Given the nature of this attack, ongoing training for Phishing Awareness is critical. Ensuring that users are equipped with knowledge about recognizing phishing attempts can significantly reduce initial access vulnerabilities. Additionally, investing in advanced threat detection solutions, combined with behavioral analysis, will enhance our capabilities in identifying potential malicious activity earlier in the attack chain.

Source: Original Report

Related Posts