<img height="1" width="1" style="display:none;" alt="" src="https://dc.ads.linkedin.com/collect/?pid=179060&amp;fmt=gif">

Minerva Labs Blog

News & Reports

Attackers Insert Themselves into the Email Conversation to Spread Malware

The “never get gifts from strangers” rule applies for suspicious email attachments as well as enterprises and SMBs alike educate their employees about the dangers lurking in cyberspace.

One of the most popular threats is malware delivered by email with a malicious document attached to it. The increasing awareness to this type of attack results in a negative impact on the success ratio of massive phishing campaigns; however, cybercriminals (as always) are adapting. This short blog post provides an example of advance tactics that adversaries use in such campaigns to overcome these challenges.

Leveraging Existing Trust

The rule “never accept gifts from strangers” applies to many settings, including suspicious email attachments. But what if you recognize the sender? Moreover, the attachment is a part of an existing email thread?

A recent campaign the attacker leveraged a previously compromised email account belonging to an employee of a prominent Chamber of Commerce. The adversary sent generic responses to existing threads, attaching a malicious Microsoft Office document. Abusing compromised trusted senders is a powerful persuasion tactic, which greatly increases the chances of opening the malicious attachment even by a trained recipient.

Below is one of the messages sent during this attack. –Most of its contents are authentic, but the last reply was appended by the attacker:

Below is one of the original emails sent during this incident

The attachment is a malicious document prompting the victim to allow macro execution:

doc.

The malicious macro is comprised of two modules: the first decodes an embedded command and the second executing it using the Shell function:

macro

The command itself has another layer of obfuscation, which was added by the publicly available tool Invoke-DOSfuscation:

dosfuscation

Decoding this results in a simple, typical PowerShell script, which downloads an executable Windows binary from a remote website:

powershell

The payload in this case was a Gozi ISFB/Ursnif malware, capable of stealing sensitive data from a victim. Moreover, once the attackers established compromised the victim’s machine they might use it to launch future similar campaigns.

Prevented by Minerva

In this case attackers were trying to evade “human detection” by leveraging clever social engineering techniques and “machine detection” (i.e. evading security products) by obfuscating the downloader and payload.

Minerva’s Malicious Documents Protection capabilities prevents this evasive threat and provide useful data to SOC and IR teams, capturing the full context of the attack:

minerva-1

 

To better understand this type of attack watch our webinar: Why Do Malicious Office Documents Keep Infecting Me?  

Interested in learning more about Minerva's Endpoint Protection?

REQUEST A DEMO

IOC

Document (SHA256):

460073875b11a5c8f1f0fe4ecf4967d0c90d066867b5ca57fd2a25df6bc384c0 URL:

Executable Payload (SHA256):

ae6ca8aab5bbd5ff08915011c6c773808a37440d805bdff247ebac9a5d060631

URLs:

hxxp://tapertoni[.]com/Flux/tst/index[.]php?l=ab1[.]tkn (analyzed sample)

hxxp://tapertoni[.]com/Flux/tst/index[.]php?l=ab2[.]tkn

hxxp://tapertoni[.]com/Flux/tst/index[.]php?l=abc1[.]tkn

hxxp://nesocina[.]com/Flux/tst/index[.]php?l=abc1[.]tkn

hxxp://nesocina[.]com/Flux/tst/index[[.]php?l=abc2[.]tkn

hxxp://nesocina[.]com/Flux/tst/index[.]php?l=abc3[.]tkn

Subscribe to Our Blog