eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
Building on the insights from our previous
exploration of finance-themed cybersecurity threats during the tax season, it's evident that digital dangers are vast and evolving.
This time, our 24/7 SOC Analysts notified our Threat Response Unit (TRU) about the tax-themed threat delivering XWorm as the final payload. We assess that it is almost certain the initial infection vector is via the phishing email, as suggested by the infection chain (Figure 1).
Figure 1: Infection chain.
We were able to track that the malicious attachment was downloaded from the compromised site hxxps://spnmandalawangi.banten.polri.go[.]id/Tax_docs_2023.htm. The downloaded file is a JavaScript file named “Tax-docs-2023.pdf .js” (MD5: 5706efd7e0254105261057a82308ed72).
When clicked by the victim, the JS file executes under Windows script host (wscript.exe) which retrieves and executes the atom.xml file (MD5: c1614e86b6808df891c5d7310d089211) from 91.92.243[.]28/poom/atom.xml
(Figure 2).
Figure 2: Malicious command ran by the JavaScript file.
The retrieved file is a PowerShell script responsible for:
Terminating running processes like RegSvcs, mshta, wscript, and msbuild (Figure 3). It is highly probable that the threat actors aim to terminate other existing malware processes as well.
Dropping and opening a PDF decoy file. The decoy PDF file renamed to “James_Charles_Tax_2023.pdf” (Figure 4) (MD5: 7b47ca0383d2409fdc4ae629308bf4bc) is retrieved from MediaFire (a file hosting service).
Injecting the final payload into Msbuild.exe and RegSvcs.exe processes.
Adding a list of file extensions, paths, and processes to the Windows Defender exclusions list (Figure 5).
Figure 3: Snippet of the retrieved PowerShell script.Figure 4: Decoy PDF file.Figure 5: PowerShell script that adds the exclusions.
Setting preferences and disabling Windows Defender security features (Figure 6).
Figure 6: Disabling Windows Defender security features.
Disabling UAC, meaning that applications can run with elevated privileges without prompting the user for confirmation or an administrator password.
Disabling the Windows Firewall with command “netsh advfirewall set allprofiles state off -ErrorAction SilentlyContinue”.
Setting up the persistence via Scheduled Tasks.
Setting up the persistence via Registry Run Key, two tasks are getting created:
“loratask” which is then renamed to “intuiteupdater” – triggers the immediate execution of a scheduled task named “intuiteupdater” with the command “schtasks /run /tn intuiteupdater”
“tasklorraalman” which is then renamed to “Drakeupdater” – leverages mshta to execute a script that downloads and executes PowerShell commands from an external source pdfdatamanage.serveftp[.]com/docs.pdf (The URL is offline at the moment of analysis) (Figure 7).
Figure 7: Persistence via Registry Run Keys
The ultimate payload delivered is XWorm v5.2, a Remote Access Trojan (RAT) (MD5: fc422800144383ef6e2e0eee37e7d6ba), for which cracked versions are publicly accessible.
The initial infection vector for the observed XWorm malware is a phishing email, highlighting the continuing effectiveness of this method for cybercriminals.
This reinforces the need for ongoing vigilance and education regarding the dangers of phishing and the importance of scrutinizing email attachments and links, even those that appear tax-related during tax season.
The attack involves terminating certain processes and modifying Windows Defender's settings to evade detection.
This indicates a preparation by attackers to ensure their malware remains undetected for as long as possible, underscoring the necessity for multi-layered security approaches that do not rely solely on one form of defense.
The use of decoy documents is a clever trick to make the victim believe the file is legitimate.
This tactic shows the psychological manipulation involved in phishing attacks, where the aim is to reduce suspicion and increase the likelihood of the malware executing successfully.
The malware's capability to disable key security features (like UAC and Windows Firewall) and establish persistence through Scheduled Tasks and Registry Run Keys can give attackers long-term access to compromised systems, highlighting the importance of regular system audits and the prompt application of security updates.
The ultimate delivery of the XWorm RAT underscores the goal of gaining remote access to the victim's system for further malicious activities.
The accessibility of cracked versions of such sophisticated malware on public forums increases the risk and potential impact of these attacks, necessitating comprehensive security measures, including network monitoring and endpoint protection.
What did we do?
Our 24/7 SOC Cyber Analysts investigated the suspicious activities, notified the client, and isolated the affected device.
Recommendations from our Threat Response Unit (TRU) Team:
Ensure that all endpoints are protected with up-to-date antivirus software or Endpoint Detection and Response (EDR) tool capable of detecting and blocking malicious files.
We recommend modifying the default 'open-with' settings for script files, ensuring they open with a basic text editor like Notepad instead of executing.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
