SheetAgent RAT

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment

The primary persistence mechanism relies on a Windows Scheduled Task named WindowsDefenderSyncService which resembles a legitimate Windows service.

Upon analyzing the LNK file, we found that its description was set to “Install ControlR Agent”... we observed that it invokes powershell.exe to execute JT-agenda.ps1.

MITRE ATT&CK Mapping ... Execution T1106 Native API

The initial infection begins with the LNK file, which has been disguised with a Microsoft Edge browser icon to appear as a legitimate document.

The primary persistence mechanism relies on a Windows Scheduled Task named WindowsDefenderSyncService which resembles a legitimate Windows service.

If the scheduled task cannot be created, the malware falls back to a second persistence mechanism using the Windows Startup folder. It creates a shortcut named WindowsDefenderSync.lnk... and places it in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\.

The primary persistence mechanism relies on a Windows Scheduled Task named WindowsDefenderSyncService which resembles a legitimate Windows service.

If the scheduled task cannot be created, the malware falls back to a second persistence mechanism using the Windows Startup folder. It creates a shortcut named WindowsDefenderSync.lnk... and places it in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\.

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Privilege Escalation T1548.004 Abuse Elevation Control Mechanism

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Defense Evasion T1027.011 Obfuscated Files or Information

After execution, Document.exe creates a directory named %APPDATA%\Microsoft\WinSyncDefender\. The folder name closely resembles a legitimate Windows component.

The cleanup routine creates a temporary batch file named cleanup.bat... forcefully deletes the malware executable, removes its configuration file (service.json), deletes the batch file itself, and then exits.

Upon examining the script, we found that it invokes powershell.exe with a long Base64-encoded command supplied through the -EncodedCommand parameter. After decoding the embedded command...

The malware performs a total of 14 different virtualization detection techniques.

The other two files, Document.exe and JT-agenda.ps1, were configured with the Hidden file attribute, making them invisible under the default Windows File Explorer settings.

It checks the system manufacturer and BIOS information using WMI, looks for virtualization-related disk drives and graphics adapters...

The malware performs a total of 14 different virtualization detection techniques.

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Discovery T1614.001 System Location Discovery

the malware continuously reads commands written by the attacker in the Google Sheet, executes them on the victim’s machine, and writes the execution results back to the same row.