We recently received samples that we suspected were “phishy” in nature, but after analyzing the email attachment a severe threat was exposed. 

Figure 1.0 Email sample

The emails had a ZIP attachment containing an HTML that was designed to look like an invoice signed by DocuSign, which is a well-known service that allows organizations to manage electronic agreements securely. Unfortunately, because it is widely used, this service is often used as a theme in phishing or targeted malware campaigns.

Figure 1.1 DocuSign themed invoice for review

Viewing the source of the HTML page reveals that a file named “ProformaInvoice.zip” will be saved to the disk, mimicking a downloaded file.

Figure 2. Excerpt of the script code found in the phishing HTML

The zip archive contains 3 files:

• AdobeSign.pdf
• Alternative_View.OnlineWeb_;.lnk
• ClientSignatureNote.vbs

Clicking Alternative_View.OnlineWeb_;.lnk executes ClientSignature.vbs. The AdobeSign.pdf is not actually a PDF, but an encrypted file, which is decrypted by the ClientSignature.vbs. A quick look at the contents of the pdf suggested that it was encrypted using XOR with a single byte key.

Figure 3. AdobeSign.PDF with trailing “0x63” bytes

To confirm that the PDF file was indeed encrypted using XOR, we needed to analyze the VBS file. The contents of the file were filled with the Attribution-ShareAlike 4.0 International license as line comments, and in between them is the actual VBS code. Cleaning up the file revealed that the actual code was just six lines. The content of the variable “DocuSign”, which was delimited by a “;”, was decrypted using a simple algorithm. By adding six characters on each value, and then converting it to the corresponding charter code. The first entry was 73 + 6 = 79, 0x4F in hexadecimal form, which corresponded to the “O” character. The output was then concatenated and formed a new VBS code that ran using the “execute” function.

Figure 4.1. Excerpt of the VBS code with license as line comments

Figure 4.2. VBS code without line comments

To check the decrypted code, dump the contents of DocuRead. The first part of the code is straightforward. It tries to decrypt the file AdobeSign.pdf, and drops a copy as svchost.exe. To check our assumption earlier that AdobeSign.pdf was encrypted using XOR, we checked the “Encode” function, which saved the decrypted executable to “C:WindowsSystem32spooldriverscolorsvchost.exe”.

Figure 5.1. Start of decrypted VBS code

Figure 5.2. Part of “Encode” function using XOR to decrypt a file

There was a privilege elevation attack, which involved an increase of privileged access beyond what a user already has.

Figure 6. check if it was executed with the “elevate” parameter

It also runs two Powershell commands. The first file extension that the malware will use is from scheduled, custom, and real-time scanning of Windows Defender. The second file tries to disable the Ransomware Protection of Windows.

Figure 7.1. 2 Powershell with encoded commands

Figure 7.2 Decoded Powershell command strings

Uninstalls.bat is created with the purpose to execute svchost.exe. After creating the batch file, it decodes another component using base64 which is saved to a disk as johntask.ps1.

Figure 8.1. Batch file that will execute a main payload

Figure 8.2. Base64 encoded contents of the Powershell file

Figure 8.3. Decoded johntask.ps1

Before finally executing the PowerShell script johntask.ps1, virtual machines were checked to see if they were infected with possible default names. If found, it will try to merge the undo disks of that virtual machine and a SCSI controller. It also tries to attach the floppy and ROM drives.

Undo disks save changes to a virtual machine’s data and configuration in a separate undo disk, in case you want to revert the changes.

Figure 9.1 Redacted most of the code to show the code sequence

Figure 9.2 Code for attaching the Floppy and ROM drives

At this point the PowerShell script (johntask.ps1) executes and attaches a task to a random Windows event. The main purpose is to automatically launch the malware payload via the batch file component whenever the selected event is triggered.

The main payload is a copy of a ransomware called “Hentai OniChan Last Version Real OniHentai”. Once svchost.exe are executed, processes that are related to anti-malware tools, such as the ones listed in the table below, are terminated.

Table 1.0 Processes terminated by ransomware

To prevent the user from recovering encrypted files, it tries to disable some window services, and other services related to backup/anti-malware software as listed below.

Table 2.0 Services disabled by the ransomware

It also skips some files with a specific extension when trying to encrypt the victim’s files, as listed below:

Table 3.0 Skipped file extensions

When it completes the malicious routine, a ransom note is posted on the infected machine as a wallpaper, as shown below.

Figure 10.0 Hentai OniChan Ransom Note

Indicators of Compromise

Table 4.0 Indicators of Compromise