{"id":88206,"date":"2019-11-02T18:26:15","date_gmt":"2019-11-02T12:56:15","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=88206"},"modified":"2019-11-02T18:50:43","modified_gmt":"2019-11-02T13:20:43","slug":"attacker-uses-tricky-technique-excel-4-0-malspam-campaign","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/attacker-uses-tricky-technique-excel-4-0-malspam-campaign\/","title":{"rendered":"Attacker uses tricky technique of Excel 4.0 in Malspam campaign"},"content":{"rendered":"

Use of Phishing emails is not new for cyber-attack and is still one of the classic strategies to compromise a victim\u2019s machine. Cyber criminals lure victims to open email attachments (mostly Doc and XLS files) by faking them to look like important one using keywords like invoice, payment, finance, order etc. Quick Heal Security Labs observed one such type of attack to compromise the victim.<\/p>\n

Overview:<\/strong><\/p>\n

In this attack, attacker first sends a phishing email disguised as an important one\u00a0 and containing an excel document as attachment. Here is a Phishing email which was tracked during this research.<\/p>\n

\"\"<\/p>\n

Fig.1: Phishing email with excel file as attachment<\/p>\n

On opening this excel document, it asks victim to \u201cenable macro\u201d content to execute malicious VBA macro code in background.<\/p>\n

\"\"<\/p>\n

Fig.2: Prompt requesting to enable Macros<\/p>\n

There has been a rise in the use of VBA macro in Phishing attacks and this trend is not new. There are ways to detect this attack easily. Hence attackers have changed their exploitation technique and are using Excel 4.0 macro these days.<\/p>\n

Excel 4.0 Macro technique is old but still effective as all versions of Excel can run Excel 4.0 macros. In this technique, macros are not stored in a VBA project, but are placed inside cells of a spreadsheet containing functions like Exec(), Halt(), Auto_Open() etc. To trick the victim, attackers leverage hiding feature of spreadsheet and store the macros inside it.<\/p>\n

Following is an example that shows the actual macro code is hidden inside other excel sheet and using unhide option that sheet can be seen as shown in Fig 3.<\/p>\n

\"\"<\/p>\n

Fig.3: Unhiding Excel Sheet<\/p>\n

Below figure shows the exact code and flow of execution.<\/p>\n

\"\"<\/p>\n

Fig.4: Macro Code Execution<\/p>\n

Auto_Open() is a function used to execute a code as soon as workbook is opened.<\/p>\n

We can see in Fig.4, Auto_Open function will execute Macro1() which means code execution will start from Row 4 which is Macro1. After that, it will call Macro2 (step 2) and then next instruction which is 33 (on Row 14) is executed. In step 3, 1st<\/sup> stage payload is being downloaded at %temp%<\/em> folder using msiexec.exe<\/em><\/a> process as shown in Fig 5.<\/p>\n

While msiexec.exe<\/em><\/a> is a legitimate Microsoft process, it is one of the binary from living of the land<\/a> which belongs to the Windows Installer Component. Hackers are making use of this process to download payload as many security solutions treat this as Whitelisted process which makes it difficult to detect using behaviour detection technique.<\/p>\n

\"\"<\/p>\n

Fig.5: Download of 1st<\/sup> Stage Payload<\/p>\n

Executable Analysis:<\/strong><\/p>\n

After downloading a payload, msiexec.exe<\/em><\/a> is also responsible to execute the payload and performs further activity. The 1st<\/sup> stage payload is just a dropper which is used to drop multiple files in the %temp% <\/em>folder. Finally, it drops a .dll file which acts as final stage payload and it is used to perform further malicious activities.<\/p>\n

The final stage payload is executed by Rundll32.exe with argument of function name as \u201csega\u201d. It starts collecting system information such as number of running tasks, system id, user is part of domain or not, drive usages etc.<\/p>\n

\"\"<\/p>\n

Fig.6: Execution flow of Attack<\/p>\n

Final payload drops a PowerShell script which is responsible to check whether user is part of domain or not. The dropped PowerShell script is stored at %temp%<\/em> location in obfuscated format.<\/p>\n

After collecting required information from victim\u2019s machine, payload starts encoding data using simple URL encoding and sends data using POST method to its C2 server.<\/p>\n

\"\"<\/p>\n

Fig. 7: Data send using POST method<\/p>\n

Here is the screenshot of the decoded data:<\/p>\n

\"\"<\/p>\n

Fig. 8: Decoded data<\/p>\n

C2 Server responds with a command after getting the details.<\/p>\n

\"\"<\/p>\n

According to response, payload performs action on victim\u2019s machine as it executes a net.exe with command \u201cnet user \/domain<\/em>\u201d and collects the information and sends back to C2 server.<\/p>\n

Some of following functions are used while sending data to C2 server.<\/p>\n

\"\"<\/p>\n

Fig. 9: C2 communication API calls<\/p>\n

This payload also creates a global mutex to execute payload only for one occurrence.<\/p>\n

\"\"<\/p>\n

Fig. 10: Create global mutex<\/p>\n

The main purpose of this malware is to create a backdoor which can be used to steal system data and if system is in domain, it may perform a lateral movement to create a backdoor network.<\/p>\n

Conclusion:<\/strong><\/p>\n

Use of social engineering tricks to compromise victim is a typical method and hackers always keep changing their techniques to evade AV detections by using new ideas like Excel 4.0 macro and genuine windows process like msiexec.exe. Quick Heal and Seqrite enterprise security solutions protect its users from such malicious email attachments and can also help in identifying remote Command and Control server communication. So, remember to keep the endpoint security solutions always updated.<\/p>\n

IOCs:<\/strong><\/p>\n

78EA9835C2D7F6760315EA043807B8C8<\/p>\n

34B769FA431AC1945BE9CC33D4CC2426<\/p>\n

DDAE8B7AA9A93CE17610EB063F5838CE<\/p>\n

6675C63A2534FD65B3B2DA751F2B393F<\/p>\n

 <\/p>\n

Subject Matter Expert:<\/strong><\/p>\n

Anjali Raut, Aniruddha Dolas<\/p>\n","protected":false},"excerpt":{"rendered":"

Use of Phishing emails is not new for cyber-attack and is still one of the classic strategies to compromise a victim\u2019s machine. Cyber criminals lure victims to open email attachments (mostly Doc and XLS files) by faking them to look like important one using keywords like invoice, payment, finance, order etc. Quick Heal Security Labs […]<\/p>\n","protected":false},"author":62,"featured_media":88224,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,303,304],"tags":[22,25,29],"class_list":["post-88206","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-email","category-phishing","category-social-engineering-2","tag-email-malware","tag-phishing","tag-social-engineering"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/88206"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=88206"}],"version-history":[{"count":13,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/88206\/revisions"}],"predecessor-version":[{"id":88242,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/88206\/revisions\/88242"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/88224"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=88206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=88206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=88206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}