Word macro spins up PowerShell script hosted on GitHub
This week researcher Arkbird has shared details on a new macro-based malware that is evasive and spawns payload in multifaceted steps.
The malware strand which looks “like MuddyWater,” according to the researcher, ships as an embedded macro within a legacy Microsoft Word (*.doc) file, in the style of the APT group.
In tests by BleepingComputer, when the Word document is opened, it runs the embedded macro. The macro further launches powershell.exe and feeds it the location of a PowerShell script hosted on GitHub.
The single-line PowerShell script has instructions to download a real PNG file (shown below) from the image hosting service Imgur.
While this image itself may be benign, its pixel values are used by the PowerShell script in calculating the next stage payload, a technique known as steganography.
As observed by BleepingComputer and shown below, the payload calculation algorithm runs a foreach loop to iterate over a set of pixel values within the PNG image and performs specific arithmetic operations to obtain functional ASCII commands.
Decoded script executes Cobalt Strike payload
The decoded script obtained from manipulating the PNG’s pixel values is a Cobalt Strike script.
Cobalt Strike is a legitimate penetration testing toolkit that allows attackers to deploy “beacons” on compromised devices to remotely “create shells, execute PowerShell scripts, perform privilege escalation, or spawn a new session to create a listener on the victim system.”
In fact, the decoded shellcode comprises an EICAR string to fool security tools and SOC teams and into mistaking this malicious payload for an antivirus test being performed by security professionals.
The payload, however, indeed contacts the command-and-control (C2) server via a WinINet module to receive further instructions, according to Arkbird.
The domain associated with the C2 server Mazzion1234-44451.portmap.host was no longer accessible at the time of writing.
However, the researcher noted “the domain has been recorded near 20 December 2020. The GitHub account has got the script pushed the 24 December, the date of the submission in [VirusTotal].”
The emergence of this evasive strain of malware around the holiday season gains adversaries another advantage: to mask their footsteps when most staff is likely to be away and less vigilant.
Security researcher Florian Roth from Nextron Systems has additionally added the Indicators of Compromise (IOCs) associated with this malware to MuddyWater IOCs list, and provided YARA rules that can be used to detect the variant in your environment.
The IOCs associated with the macro-laden Word documents used in this campaign are given below: