Loading malware…
13 distinct techniques documented for this family, organized by ATT&CK tactic.
As with most external attacks, phishing emails containing a malicious compressed zip file appears to be the primary delivery method.
The email attachment file analyzed by our team (screenshots-9201.jpg.zip) contains two shortcut files “ Screenshot-9501.JPG.lnk ” and “ Screenshot-9502.JPG.lnk ” disguised as jpeg.
Execution using WMI [T1047] Commands and other processes can also be executed using Windows Management Instrumentation (WMI) infrastructure.
Taking a closer look at the two .lnk files, there is some obvious and apparent CMD obfuscation passed in as command line parameters along with the call to cmd.exe.
TerraLoader is a heavily obfuscated JavaScript loader which allows for command and control (C2) functionality on the affected host.
Diving in a bit deeper into the initial code execution from the two LNK files, we can see that the shortcut file links to “ C:\Windows\System32\cmd.exe ” along with a large chunk of obfuscated command line.
The email attachment file analyzed by our team (screenshots-9201.jpg.zip) contains two shortcut files “ Screenshot-9501.JPG.lnk ” and “ Screenshot-9502.JPG.lnk ” disguised as jpeg.
Persistence: Establish a registry foothold: ActXobj1.RegWrite("HKCU\\Environment\\UserInitMprLogonScript", ‘cscript /b /e:jscript “%APPDATA%\\Microsoft\\’ + PersFileName + ‘”‘);
Persistence: Establish a registry foothold: ActXobj1.RegWrite("HKCU\\Environment\\UserInitMprLogonScript", ‘cscript /b /e:jscript “%APPDATA%\\Microsoft\\’ + PersFileName + ‘”‘);
This is done by using a common LOLbin technique which leverages the Windows binary file Ie4uinit.exe.
The next stage of the attack kicks off by downloading and executing a few different OCX#HARVESTER files... Regsvr32.exe is then used to register the DLL payload.
Msxsl.exe execution [T1220] In another effort to maintain persistence on the host, the script would leverage the msxsl.exe LOLbin to re-run this particular script file and then sleep.
Command and Control [T1071.001] C2 communication is established by creating a new ActiveXObject object and one of several XMLHTTP objects to establish a connection to the attacker’s remote server.
After gaining full access, the attackers attempted to download and run SharpChrome.exe downloaded and saved from one of the attacker’s C2 servers.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.