Key takeaways
- Cyble Analysis and Intelligence Labs (CRIL) got here throughout an ongoing cyberattack marketing campaign originating from malicious LNK recordsdata.
- The subtle multi-stage assault chain depends closely on PowerShell and BAT scripts to streamline the obtain and execution of further payloads, demonstrating the Menace Actor’s (TA) choice for script-based strategies to evade detection by conventional safety options.
- The assault entails the creation of an administrative account on the sufferer’s system and altering Distant Desktop settings to decrease authentication necessities, simplifying unauthorized RDP entry for the attacker.
- The marketing campaign deploys an extra well-known password restoration device, ChromePass, which collects saved passwords from Chromium-based browsers, rising the danger of broader account compromises.
- Based mostly on its TTPs, we’ve not been in a position to attribute this marketing campaign, so for monitoring functions, we’re naming it “HeptaX”.
Overview
CRIL has come throughout a multi-stage cyberattack marketing campaign that begins with a ZIP file containing a malicious shortcut file (.lnk). Whereas the supply of this ZIP file stays unknown, it’s suspected to be disseminated by means of phishing emails. Based mostly on the LNK file title, it’s suspected that this marketing campaign targets the healthcare business.
Upon execution, the LNK file triggers a PowerShell command that downloads and executes a collection of further payloads, together with PowerShell scripts and BAT recordsdata, from a distant server. These scripts work in tandem to create a brand new person account on the compromised system with administrative privileges and modify Terminal Providers (RDP) settings, reducing authentication necessities. This setup permits the TAs to simply set up distant desktop entry (RDP) to the sufferer’s system, facilitating additional malicious actions akin to information exfiltration, the set up of further malware, and even system monitoring.
Moreover, CRIL recognized the presence of an undesirable utility referred to as “ChromePass” throughout the risk actors’ community infrastructure. This hacking device is designed to steal saved passwords from Chromium-based browsers, including one other layer of threat for victims by exposing their credentials. The picture under illustrates the an infection chain.
Based mostly on the data obtained by means of pivoting, this group has been operational since 2023 and has executed a spread of assaults throughout completely different sectors, as mirrored within the names of the lure recordsdata. Whereas the general assault move has remained constant, it’s shocking that they’re nonetheless lively utilizing the identical methods. A number of researchers have beforehand recognized this marketing campaign [1],[2],[3],[4],[5], with nearly all of findings shared by the Malware Hunter Group.
Marketing campaign evaluation
Over the previous 12 months, this unidentified group has constantly reemerged with varied lure themes whereas sustaining unchanged assault patterns. Tracked as HeptaX,’ the marketing campaign depends closely on PowerShell and Batch scripts to realize management over compromised techniques. By pivoting the IP handle, we uncovered a number of further artifacts related to the identical TAs used throughout completely different campaigns.
One of many notable recordsdata from this marketing campaign is:
- 202409_Resident_Care_Quality_Improvement_Strategies_for_Nursing_Homes_Enhancing_Patient_Satisfaction_and_Health_Outcomes.pdf.lnk
As well as, older campaigns attributed to this risk group over the previous 12 months embody malicious recordsdata with names akin to:
- SOW_for_Nevrlate.pdf
- WebContentWriting_Handout.pdf
- Blockchain_Trading_Website_Manager.docx
- Venture Description – PoC good assistant Vhyro Venture from jvope signature.pdf
- Resume – skilled sax, keys and guitar participant with over 40 years expertise working with personal bands, accompanied world stars.pdf
- dropshipping Elien undertaking prposal-soft on-line service ventilization from xihu.pdf.lnk
The variety in file names and themes means that this group tailors its campaigns to enchantment to quite a lot of victims, indicating a broad focusing on technique throughout a number of industries.
Technical Evaluation
Upon execution, the LNK file runs a PowerShell command that downloads and executes subsequent payloads from a distant server. The picture under reveals {a partially} de-obfuscated PowerShell command.
First stage – bb.ps1
As an preliminary step, the downloaded PowerShell script constructs a base URL to which it sends info and from which it downloads different stage payloads. The PowerShell script comprises a number of capabilities, the primary of which retrieves a novel identifier (UID) for the compromised system. This UID is obtained both from a selected registry path (HKEY_LOCAL_MACHINESOFTWAREWireless) or from a log file (id.log) within the “C:UsersPublicDocuments” listing. If neither exists, a brand new GUID is generated and saved to a newly created id.log file.
Subsequent, the PowerShell script creates a shortcut file within the Home windows Startup folder for persistence. The contents of the newly generated LNK file match these of the unique malicious LNK file. The picture under reveals the perform chargeable for creating the brand new LNK file within the startup folder.
Then, the PowerShell script constructs a URL by appending the beforehand generated UID to the distant server, forming the request hxxp://157.173.104.153/up/get-command.php?uid=<UID>, and makes use of WebClient to ship a request to fetch instructions from the server. Upon receiving a profitable response, it checks whether or not the response comprises the string “autoreconnect”. If this string is current, the Powershell script runs the code within the present session utilizing `iex`; in any other case, it executes the code as a background activity in a separate PowerShell course of.
Afterward, the PowerShell script downloads a password-protected lure doc from the above-mentioned distant server, saves it within the system’s momentary listing “C:Customers<Username>AppDataLocalTemp”, after which launches the doc. The picture under shows the perform code and the open listing containing the lure PDF.
Lastly, the PowerShell script retrieves two registry values associated to Person Account Management (UAC):
- HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemConsentPromptBehaviorAdmin, which controls the consent immediate conduct for directors.
- HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA, which signifies whether or not UAC is enabled.
If both of those values is 0, suggesting that UAC is both disabled or configured to a much less safe setting, the script proceeds to obtain and execute one other PowerShell script (b.ps1) from the distant server.
Second Stage – b.ps1
The newly downloaded second-stage PowerShell script contains a number of capabilities, some mirroring these from the primary stage. The first perform of this script is concentrated on evaluating the system’s Person Account Management (UAC) settings, using the identical registry checks employed earlier to find out whether or not UAC is enabled and if the consent immediate for directors stays lively.
If UAC is disabled or the consent immediate conduct is configured to a much less safe state, the perform sends a message to the distant server indicating that UAC is off by default: (“hxxp://157.173.104[.]153/up/index.php?uid=$uid&msg=UAC off in default!”).
If each settings are enabled, the perform enters a loop, repeatedly trying to disable UAC by setting the “ConsentPromptBehaviorAdmin” worth to 0. As soon as profitable, it sends a message to the distant server stating that UAC has been forcefully disabled: (“hxxp://157.173.104[.]153/up/index.php?uid=$uid&msg=UAC pressure disabled!”). The under picture reveals the perform code chargeable for sending a POST request to the distant server, transmitting details about the sufferer’s Person Account Management (UAC) standing.
After a short 300-millisecond sleep, the PowerShell script calls the schReg() perform, which downloads three batch recordsdata from the distant server into the system’s momentary listing ($env:TEMP). The recordsdata are named “k1.bat,” “scheduler-once.bat,” and “k2.bat.” After downloading, the script runs the “scheduler-once.bat” file utilizing the “Begin-Course of” cmdlet with elevated privileges. The picture under reveals the code chargeable for downloading and executing the batch recordsdata.
Third Stage – scheduler-once.bat
The executed batch file copies “k1.bat” and “k2.bat” from the %temp% listing to “C:WindowsSystem32”, renaming them to “sysmon.bat” and “sysmon2.bat”. It then deletes the unique “k1.bat” and “k2.bat” recordsdata from the temp location. Subsequent, the batch file checks for and removes any scheduled duties named:
- Intel(R) Ethernet Connection 1219-LM
- Intel(R) Ethernet2 Connection 1219-LM
Afterward, it creates a brand new scheduled activity referred to as “Intel(R) Ethernet2 Connection 1219-LM” to run “sysmon2.bat”. Lastly, the script “scheduler-once.bat” deletes itself to cowl its traces from the system. The picture under shows the contents of the batch file “scheduler-once.bat”.
Fourth Stage – sysmon2.bat
As soon as the scheduled activity is triggered to execute the “sysmon2.bat” file, it first checks for and removes any present scheduled duties named:
- Intel(R) Ethernet Connection 1219-LM2
- Intel(R) Ethernet2 Connection 1219-LM2
Afterward, it creates a brand new scheduled activity referred to as “Intel(R) Ethernet2 Connection1219-LM2” to run the “sysmon.bat” file positioned within the “C:WindowsSystem32” folder. Notably, the earlier third-stage batch file performs related checks, however the activity names differ barely. The picture under reveals the content material of the “sysmon2.bat” file.
Fifth Stage – Sysmon.bat
The sysmon.bat script executes a collection of actions:
- Creates a brand new person account named “_BootUEFI_”.
- Units the password for this newly added account to “123456!!!” and prompts it.
- Provides the “_BootUEFI_” account to the Directors group, granting it administrative privileges.
- Provides the “_BootUEFI_” account to the Distant Desktop Customers group, permitting it to make the most of Distant Desktop.
- Removes the “_BootUEFI_” account from the Customers group, guaranteeing it retains solely administrative and distant desktop privileges.
- Moreover, the batch file makes a number of registry modifications to allow Distant Desktop and decrease its security measures. This contains hiding the “_BootUEFI_” person from the login display and adjusting Terminal Providers (Distant Desktop) settings to facilitate simpler distant connections with out stringent authentication necessities.
- The batch file runs a PowerShell command that circumvents execution coverage restrictions and provides the System32 listing, which comprises the three malicious batch recordsdata, to the Home windows Defender exclusion checklist.
- Lastly, it initiates a background PowerShell course of that downloads and executes one other PowerShell script from the distant server (hxxp://157.173.104[.]153/up/a.ps1).
Sixth Stage – a.ps1
The newly downloaded PowerShell script “a.ps1” capabilities much like the primary stage script (bb.ps1). It constructs a URL by appending the beforehand generated UID to the distant server handle, forming a request to “hxxp://157.173.104.153/up/get-command.php?uid=<UID>”.
The script then makes use of a WebClient to ship a request and retrieve instructions from the server. Upon receiving a response, it checks for the presence of the string “autoreconnect id.” If this string is discovered, the PowerShell script executes the code within the present session utilizing iex; in any other case, it runs the code as a background activity in a separate PowerShell course of. Notably, in each levels, we didn’t obtain any particular instructions akin to “autoreconnect” or “autoreconnect id”. The principle distinction on this sixth-stage script is that it appears for the string “autoreconnect id” as a substitute of simply “autoreconnect”. The under picture reveals the code for reconnecting to the server.
Seventh Stage – Server response PowerShell Script
Upon establishing a reference to the server, a brand new PowerShell script is executed. This script comprises a number of capabilities geared toward system reconnaissance, information exfiltration, and interplay with the distant server.
The script collects detailed system info, together with:
- Pc title and username.
- Retrieves latest recordsdata from the listing: C:Customers<person profile>AppDataRoamingMicrosoftWindowsRecent.
- Acquires community configuration particulars utilizing “ipconfig /all”.
- Checklist of customers on the machine (web person).
- Obtains present logged-in person particulars.
- Identifies native person teams related to the present person.
- Retrieves excluded directories in Home windows Defender.
- Lists put in antivirus merchandise.
- Captures operating processes utilizing “tasklist”.
- Gathers general system info utilizing “systeminfo”.
- All this information is saved in a log file positioned at “C:WindowsTempOneDriveLogOneDrive.log”.
The script then reads the contents of the log file, converts the information right into a byte array, and encodes it in Base64 format. This encoded information, together with the distinctive person ID (uid), is appended to the bottom URL” hxxp://157.173.104[.]153/up/index.php” and despatched through a POST request. After efficiently transmitting the information, the log file and its listing are deleted to get rid of any traces of the information assortment.
Taking Distant desktop
With all of the collected info, Person Account Management (UAC) disabled, and a brand new person account named “BootUEFI” created with administrative privileges, together with lowered authentication necessities for Terminal Providers, the TAs can simply acquire entry to the compromised distant desktop. This entry permits them to carry out varied actions on the sufferer’s machine, akin to:
- Putting in further malware
- Exfiltrating delicate information
- Monitoring person exercise
- Modifying system settings
- Using the machine for malicious actions
Moreover, we noticed an undesirable utility—a hacking device named ChromePass—related to the identical community infrastructure at “hxxp://157.173.104[.]153/up/Instrument/ChromePass.exe” This device is designed to steal saved passwords from Chromium-based browsers.
Conclusion
Over the previous 12 months, this group has executed a number of assaults using varied lures and focusing on completely different victims, all whereas remaining largely unnoticed. Their reliance on primary scripts has enabled TAs to realize distant entry to compromised techniques seamlessly, permitting for in depth exploitation with out triggering alarms.
Moreover, the deployment of the ChromePass device additional underscores the group’s intent to reap delicate info, akin to saved passwords from Chromium-based browsers, thereby posing a big risk to the safety of people and organizations alike. This mix of ways highlights the necessity for enhanced detection and prevention measures to fight these stealthy cyber threats successfully.
Suggestions
- The preliminary breach could happen through spam emails. Due to this fact, it’s advisable to deploy robust electronic mail filtering techniques to determine and forestall the dissemination of dangerous attachments.
- Train warning when dealing with electronic mail attachments or hyperlinks, notably these from unknown senders. Confirm the sender’s id, notably if an electronic mail appears suspicious.
- Think about disabling the execution of shortcut recordsdata (.lnk) from electronic mail attachments or implementing insurance policies that require express person consent earlier than executing such recordsdata.
- Think about disabling or limiting the execution of scripting languages, akin to PowerShell and cmd.exe, on person workstations and servers if they aren’t important for authentic functions.
- Implement insurance policies that forestall the unauthorized creation of privileged accounts.
- Often observe adjustments to Person Account Management (UAC)- associated registry keys, akin to “EnableLUA” and “ConsentPromptBehaviorAdmin.” Monitoring these keys helps determine potential makes an attempt to bypass UAC, enhancing system safety in opposition to unauthorized adjustments.
- Strengthen the safety of Distant Desktop Protocol (RDP) by implementing robust authentication mechanisms, akin to multi-factor authentication (MFA), and through the use of network-level authentication (NLA). Limiting RDP entry to trusted IP addresses and using VPNs also can assist mitigate dangers.
- Arrange network-level monitoring to detect uncommon actions or information exfiltration by malware. Block suspicious actions to stop potential breaches.
MITRE ATT&CK® Strategies
| Tactic | Method | Process |
| Preliminary Entry (TA0001) | Phishing (T1566) | The LNK file could also be delivered by means of phishing or spam emails |
| Execution (TA0002) | Person Execution: Malicious Hyperlink (T1204.001) Command and Scripting Interpreter: PowerShell (T1059.001) | Execution begins when a person executes the LNK file The LNK file executes PowerShell instructions |
| Protection Evasion (TA0005) | Obfuscated Information or Data (T1027) |
Scripts embody packed or encrypted information. |
| Persistence (TA0003) | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) | Provides LNK file within the startup folder |
| Privilege Escalation (TA0004) |
Abuse Elevation Management Mechanism (T1548) Account Manipulation (T1098) | Bypass Person Account Management Manipulate accounts to keep up and/or elevate entry to sufferer techniques. |
| Discovery (TA0007) | System Data Discovery (T1082) | Script gathers system info. |
| Credential Entry (TA0006) | Credentials from Password Shops: Credentials from Net Browsers (T1555.003) | Retrieves credentials from net browsers |
| C&C (TA0011) |
Ingress Instrument Switch (T1105) |
Downloads recordsdata from webservers through HTTP |
| C&C (TA0011) |
Utility Layer Protocol (T1071) |
Malware exe talk to C&C server. |
Indicators Of Compromise
| Indicators | Indicator Kind | Description |
| 6605178dbc4d84e789e435915e86a01c5735f34b7d18d626b2d8810456c4bc72 | SHA256 | Zip File |
| 18e75bababa1176ca1b25f727c0362e4bb31ffc19c17e2cabb6519e6ef9d2fe5 5ff89db10969cba73d1f539b12dad42c60314e580ce43d7b57b46a1f915a6a2b | SHA256 | Malicious LNK file |
| 1d82927ab19db7e9f418fe6b83cf61187d19830b9a7f58072eedfd9bdf628dab | SHA256 | bb.ps1 |
| a8d577bf773f753dfb6b95a3ef307f8b4d9ae17bf86b95dcbb6b2fb638a629b9 | SHA256 | b.ps1 |
| 999f521ac605427945035a6d0cd0a0847f4a79413a4a7b738309795fd21d3432 | SHA256 | K1.bat |
| 4b127e7b83148bfbe56bd83e4b95b2a4fdb69e1c9fa4e0c021a3bfb7b02d8a16 | SHA256 | GooglePass |
| hxxp://157.173.104[.]153/up/index.php hxxp://157[.]173.104.153/up/b.ps1 hxxp://157.173.104[.]153/up/bb.ps1 hxxp://157.173.104[.]153/up/scheduler-oncex hxxp://157.173.104[.]153/up/set off hxxp://157.173.104[.]153/up/Instrument/ChromePass.exe hxxp://157.173.104[.]153/up/get-command.php hxxp://157.173.104[.]153/up/bait/202409_Resident_Care_Quality_Improvement_Strategies_for_Nursing_Homes_Enhancing_Patient_Satisfaction_and_Health_Outcomes.pdf |
URL | Distant server |
References
https://twitter.com/malwrhunterteam/standing/1701669714244542758
https://twitter.com/AzakaSekai_/standing/1846482785009348692
https://twitter.com/fmc_nan/standing/1701427951714345296
https://twitter.com/malwrhunterteam/standing/1708219656488571188
https://twitter.com/malwrhunterteam/standing/1701672325580550176
Associated
