CommonMagic

Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar methods.

We initiated our investigation back in 2022, starting with simple malicious PowerShell scripts deployed by an unknown actor

When the potential victim activates the LNK file included in the ZIP file, it triggers a chain of events that lead to the infection of the computer with a previously unseen malicious framework that we named CommonMagic.

The archive, in turn, contained two files: A decoy document ... A malicious LNK file with a double extension (e.g., .pdf.lnk) that leads to infection when opened.

Modules start as standalone executable files and communicate via named pipes.

The main body of the backdoor is read from the file %APPDATA%\WinEventCom\config and decrypted with a simple XOR (key: 0x10).

A malicious LNK file with a double extension (e.g., .pdf.lnk) that leads to infection when opened.

USB (U.exe) – collects the contents of the files with the following extensions from connected USB devices: .doc, .docx. .xls, .xlsx, .rtf, .odt, .ods, .zip, .rar, .txt, .pdf.

Screenshot (S.exe) – takes screenshots every three seconds using the GDI API

It uses OneDrive and Dropbox folders as transport, and OAuth refresh tokens as credentials.

The malicious LNK points to a remotely hosted malicious MSI file that is downloaded and started by the Windows Installer executable.

Uploads the output of the executed PowerShell command to the cloud storage ... The framework uses OneDrive remote folders as a transport.