POWERSOURCE

Le vecteur d’infection principalement employé par FIN7 est le courriel d’hameçonnage. Il contient une pièce jointe malveillante et plus rarement une URL pointant vers des sites compromis ou des services légitimes tels que Google Docs.

Le vecteur d’infection principalement employé par FIN7 est le courriel d’hameçonnage. Il contient une pièce jointe malveillante.

...plus rarement une URL pointant vers des sites compromis ou des services légitimes tels que Google Docs.

The emails associated with this malware campaign were spoofed to make them appear as if they had originated from the Securities and Exchange Commission (SEC) Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system.

The command is then executed using the Windows Management Interface (WMI) Win32_Process object using the Create method.

the malware also creates a Scheduled Task on the infected system named "kernel32"

Using this channel, the attackers were able to directly interact with the Windows Command Processor using the contents of DNS TXT record queries and the associated responses generated on the attacker-controlled DNS server.

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

The document uses the Document_Open() function to call another VBA function.

The document informs the user that it is secured and instructs the user to enable content.

Rather than leveraging macros or OLE objects... these attachments leveraged Dynamic Data Exchange (DDE) to perform code execution.

the malware also creates a Scheduled Task on the infected system named "kernel32"

If the system is running an earlier version of Powershell, the Stage 3 payload is encoded and written to the registry location dictated by the assignment of $reg_win_path earlier with the key name of 'kernel32'.

If the user has administrative privileges on the infected system, it will set up a WMI event consumer and filter as an additional WMI-based persistence mechanism. The filter name is "kernel32_filter" and the consumer name is "kernel32_consumer".

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

the malware also creates a Scheduled Task on the infected system named "kernel32"

If the user has administrative privileges on the infected system, it will set up a WMI event consumer and filter as an additional WMI-based persistence mechanism. The filter name is "kernel32_filter" and the consumer name is "kernel32_consumer".

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

The code in Stage 2 has been obfuscated... Base64 string encoding was also present throughout the script.

A second block of code present in the Powershell is called $stagerCode and is responsible for extracting and decoding the code that was previously stored in the registry, then executing this code, first checking for the presence of the mutex '1823821749'. If this mutex does not exist, execution continues.

Anchor has used NTFS to hide files. APT32 used NTFS alternate data streams to hide their payloads. Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

If the system is running an earlier version of Powershell, the Stage 3 payload is encoded and written to the registry location dictated by the assignment of $reg_win_path earlier with the key name of 'kernel32'.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The malware then queries the system to determine the characteristics of the environment in which it is operating... It specifically checks the version of Powershell that is installed on the system... The malware also obtains the serial number of the system from the BIOS.

leveraged an interesting infection process using DNS TXT records to create a bidirectional command and control (C2) channel... The same generated hostname is then used by the malware to make a TXT record request.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

The 'MSG' queries which are used to send commands to execute and return the output of the executed commands are hex-encoded and use a dot separator after every 30 bytes.

This allows the attacker to send commands to be executed directly by the Command Processor and receive the output of those commands all using DNS TXT requests and responses.

They can use very simple techniques for stealing and transferring data from an internal network to an attacker domain such as HTTP/HTTPS, SMTP, DNS, SMTP, P2P, VPN or even the ARP method for data exfiltration.

Several malware programs exfiltrate the stolen information to an attacker-controlled SMTP server.