Swedish Windows Security User Group

We recently came across a file (ORDER-549-6303896-2172940.docm, SHA1: 952d788f0759835553708dbe323fd08b5a33ec66) containing a VBA project that scripts a malicious macro (SHA1: 73c4c3869304a10ec598a50791b7de1e7da58f36). We added it under the detection TrojanDownloader:O97M/Donoff – a large family of Office-targeting macro-based malware that has been active for several years (see our blog category on macro-based malware for more blogs).

However, there wasn’t an immediate, obvious identification that this file was actually malicious. It’s a Word file that contains seven VBA modules and a VBA user form with a few buttons (using the CommandButton elements).

The VBA user form contains three buttons

The VBA modules look like legitimate SQL programs powered with a macro; no malicious code found there … However, after further investigation we noticed a strange string in the Caption field for CommandButton3 in the user form.

It appeared to be some sort of encrypted string.

We went back and reviewed the other modules in the file, and sure enough – there’s something unusual going on in Module2. A macro there (UsariosConectados) decrypts the string in the Caption field for CommandButton3, which turns out to be a URL. It uses the deault autoopen() macro to run the entire VBA project when the document is opened.

The macro script in Module2 decrypts the string in the Caption field

The macro will connect to the URL (hxxp://clickcomunicacion.es/<uniqueid>) to download a payload which we detect as Ransom:Win32/Locky (SHA1: b91daa9b78720acb2f008048f5844d8f1649a5c4).

The VBA project (and, therefore, the macro) will automatically run if the user enables macros when opening the file – our strongest suggestion for the prevention of Office-targeting macro-based malware is to only enable macros if you wrote the macro yourself, or completely trust and know the person who wrote it.

See our threat intelligence report on macros and our macro-based malware page for further guidance on preventing and recovering from these types of attacks.

-Marianne Mallen and Wei Li
MMPC

Kovter is a malware family that is well known for being tricky to detect and remove because of its file-less design after infection. Users from United States are nearly exclusively being targeted, and infected PCs are used to perform click-fraud and install additional malware on your machine.

Starting April 21, 2016, we observed a large Kovter malware attack where in just a week and a half we protected over 350,000 PCs from this threat. Interestingly, for this campaign the attackers managed to acquire trusted SSL digital certificates to secure an HTTPS SSL connection and their own code signing certificate to sign the downloaded malware with.

Kovter carried out this attack campaign using a technique called malvertising, masquerading as a fake Adobe Flash update. In this blog we will share some research into the structure of their malvertising attack, how our MSRT release will be cleaning it up, and the technical details of how Kovter installs and attempts to remain persistent as a file-less malware after it infects a PC.

Kovter’s digitally signed malvertising campaign

Malvertising is a technique used by bad actors to attack your PC, where they buy advertisement space with ad networks, ad exchanges, and ad publishers. These ads then appear on many websites who use the same advertisement network, and attacks some of the users as they visit the websites.

Unlike typical advertisements that require a user click, malvertising attacks often attack as soon as you visit a website that displays them.

Using this technique, we’ve seen malicious attackers use varied techniques such as:

• Displaying repeated message boxes claiming your PC is infected and encouraging you to call a support phone number for help. These are malicious and they have not detected a problem on your PC.
• Attempting to lock your browser and demanding payment as ransomware. You can close your browser or restart your computer to escape. This type of ransomware hasn’t really locked your PC.
• Loading an exploit kit to attack your browser or browser plugin.
• Claiming your browser, Adobe Flash Player, or Java is out of date and in need of an update. Often they will claim the update is required to view the website content or is needed for security reasons. Keeping these applications up-to-date is really important to keep your PC safe and secure from the latest vulnerabilities. However, you should never trust a website claiming to detect security problems on your PC. Instead, let these apps update if they request to outside of your browser or search for the official websites to install the missing components.

The recent Kovter malvertising attack falls into this last category, using a social engineering attack that states that your Adobe Flash is out of date and needs to be updated for security reasons.

Figure 1 below illustrates the Kovter infection chain used in this attack. Users visiting effected websites are redirected to fake websites impersonating the Adobe Flash hallmark download page claiming your Flash Player is out of date, and Trojan:Win32/Kovter is automatically downloaded pretending to be “FlashPlayer.exe”.

Figure 1 – Kovter’s fake Adobe update malvertising infection chain

For this most recent campaign, we saw Kovter perpetrators redirecting to the following domains:

• aefoopennypinchingpolly.com

• ahcakmbafocus.org

• ahxuluthscsa.org

• caivelitemind.com

• ierietelio.org

• paiyafototips.com

• rielikumpara.org

• siipuneedledoctor.com

• ziejaweleda.org

The domains from this campaign and previous campaigns commonly use the same domain registration information, and can be identified by:

Admin Email: monty.ratliff@yandex.com

As soon as the malicious advertisement is displayed, users are redirected to the Kovter social engineering page hosted using HTTPS according to the following pattern:

https://<domain>/<random numbers>/<random hex>.html

For example:

hxxps://ahxuluthscsa.org/4792924404046/89597dd177df3daa78f184fe87c4386c.html

By using HTTPS, your browser displays a ‘secure’ lock symbol – incorrectly adding to the user trust that the website is safe while at the same time preventing most network intrusion protection systems from protecting the user. Endpoint antimalware solutions, such as Windows Defender, still protect the user however. We were unable to confirm due to the servers being taken down, but reports online suggest trial COMODO SSL certificates were being used to secure these connections for the Kovter campaigns in the past.

When you visit the website, it automatically downloads Kovter as “FlashPlayer.exe”. It downloads from the same domains using a pattern such as:

hxxps://ahxuluthscsa.org/1092920552392/1092920552392/1461879398769944/FlashPlayer.exe

Some example FlashPlayer.exe downloaded files for reference are as follows:

eafe025671e6264f603868699126d4636f6636c7

c26b064b826f4c1aa6711b7698c58fc0

0686c48fd59a899dfa9cbe181f8c52cbe8de90f0

e0a31d6b58017428dd8c907b14ea334e

62690c0a5a9946f91855a476b7d92447e299c89a

18ccf307730767c4620ae960555b9237

7a678fa58e310749362a432db9ff82aebfb6de62

f6406681e0652e33562d013a8c5329b9

872d157c9c844636dda2f33be83540354e04f709

42b1b775945a4f21f6105df8e9c698c2

37a8ad4a51b6f7b418c17abd8de9fc089a23125d

3767f655a462c4bf13ae83c5f7656af4

cfebfe6d4065dd14493abeb0ae6508a6d874d809

a14a38ebe3856766d55c1af35fb1681f

c48b21c854d6743c9ebe919bf1271cade9613890

321f9b3717655e1886305f4ca01129ad

4df10be4b12f3c7501184097abee681a1045f2ed

0966f977c6d319e838be9b2ceb689fbe

457f0f7fe85fb97841d748af04166f2a3e752efe

7214015e37750f3ee65d5054a5d1ff8a

These downloaded Kovter files were digitally signed by a trusted COMODO certificate under the company name “Itgms Ltd” as follows:

We notified COMODO of the code signing abuse by Kovter and they have since revoked this certificate. We suspect that the actors behind Kovter code-signed their fake Adobe Flash installer to increase the number of users who trust the downloaded file and decide to run it.

The sheer volume of PCs encountering Kovter during this attack, along with the attackers appearing to have been directly issued their own digital certificates is a cause for concern. Lucky for us, the digital signing actually worked to help us better identify files that are Kovter to better protect you – since we are able to uniquely identify and remove all files signed by this certificate. We will be continuing to monitor Kovter to keep you protected.

MSRT coverage

As part of our ongoing effort to provide better malware protection, the May release of the Microsoft Malicious Software Removal Tool (MSRT) includes detections for Kovter and Locky. Locky is a family of ransomware which uses infected Microsoft Office files to download the ransomware onto your PC

By adding Kovter and Locky detections to MSRT we hope to have a bigger impact by reaching more affected machines and helping remove these threats. However, as with all threats, prevention is the best protection.

Kovter Installation

On top of the recent Kovter Adobe Flash malvertising attack, we have also seen this trojan arrive as an attachment to spam emails. We have seen this malware being downloaded by TrojanDownloader:JS/Nemucod, for example:

• Sha1: 36e81f09d2e1f9440433b080b056d3437a99a8e1
• Md5: 74dccbc97e6bffbf05ee269adeaac7f8

When Kovter is installed, the malware drops its main payload as data in a registry key (HKCUsoftware<random_chars> or HKLMsoftware<random_chars>). For example, we have seen it drop the payload into the following registry keys:

• hklmsoftwareoziyns8

• hklmsoftware2pxhqtn

• hkcusoftwarempcjbe00f

• hkcusoftwarefxzozieg

Kovter then installs JavaScript as a run key registry value using paths that automatically run on startup such as:

• hklmsoftwaremicrosoftwindowscurrentversionrun
• hklmsoftwaremicrosoftwindowscurrentversionpoliciesexplorerrun
• hklmsoftwarewow6432nodemicrosoftwindowscurrentversionrun
• hklmsoftwarewow6432nodemicrosoftwindowscurrentversionpoliciesexplorerrun
• hkcusoftwaremicrosoftwindowscurrentversionrun
• hkcusoftwareclasses<random_chars>shellopencommand

The dropped JavaScript registry usually has the format: “mshta javascript: <malicious Kovter JavaScript>”. When executed at startup, this JavaScript loads the Kovter payload data registry key data into memory and execute it.

One executing in memory, the malware also injects itself into legitimate processes including:

• regsvr32.exe
• svchost.exe
• iexplorer.exe
• explorer.exe

After installation, the malware will remove the original installer from the disk leaving only registry keys that contain the malware.

Payload

Lowers Internet security settings

It modifies the following registry entries to lower your Internet security settings:

• In subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3 Sets value: “1400” With data: “0”
• In subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones1 Sets value: “1400” With data: “0”

Sends your personal information to a remote server

We have seen this malware send information about your PC to the attacker, including:

• Antivirus software you are using
• Date and time zone
• GUID
• Language
• Operating system

It can also detect some specific tools you use in your PC and sends that information back to the attacker:

• JoeBox
• QEmuVirtualPC
• Sandboxie
• SunbeltSandboxie
• VirtualBox
• VirtualPC
• VMWare
• Wireshark

Click-fraud

This threat can silently visit websites without your consent to perform click-fraud by clicking on advertisements. It does so by running several instances of Internet Explorer in the background.

Download updates or other malware

This threat can download and run files. Kovter uses this capability to update itself to a new version. This update capability has been used recently to install other malware such as:

• Trojan:Win32/Corebot
• Trojan:Win32/Eksor

Demographics

Figure 2 – Kovter’s prevalence for the past two months shows a spike in the month of April

Figure 3 – Kovter’s geographic distribution shows that majority of the affected machines are in the United States

Mitigation and prevention

To help stay protected from Kovter, Locky and other threats, use an up-to-date Windows Defender for Windows 10 as your antimalware scanner, and ensure that MAPS has been enabled.

Though trojans have been a permanent fixture in the malware ecosystem, there’s still something that you or your administrators can proactively do:

• Block the IP addresses of the corresponding compromised websites soon as the administrator identifies the list of sites that Kovter and Locky maliciously redirects into.
• Use Microsoft Edge to get SmartScreen protection. It will prevent you from browsing sites that are known to be hosting exploits, and protect you from socially-engineered attacks such as phishing and malware downloads.
• Disable the loading of macros in Office programs
• Disable macro loading through the Group Policy settings.
• Keep your software up-to-date to mitigate possible software exploits.
• Protect derived domain credentials with Credential Guard for Windows 10 Enterprise.
• Secure your code integrity with Device Guard for Windows 10 Enterprise.
• Secure the lateral account movement in your enterprise.
• Use two-factor authentication with Microsoft Passport and Windows Hello.
• Ensure that a strong password policy is implemented throughout the enterprise.

Geoff McDonald and Duc Nguyen

MMPC

We have recently observed that spam campaigns are now using JavaScript attachments aside from Office files. The purpose of the code is straightforward. It downloads and runs other malware.

Some of the JavaScript downloaders that we’ve seen are:

• TrojanDownloader:JS/Swabfex
• TrojanDownloader:JS/Nemucod
• TrojanDownloader:JS/Locky

The same JavaScript downloaders are also responsible for spreading the following ransomware:

• Ransom:Win32/Tescrypt
• Ransom:Win32/Locky

The spam email contains a .zip or .rar file attachment which carries a malicious JavaScript. The JavaScript attachment mostly has the following icon, depending on the system’s script software. The file names are either related to the spam campaign, or completely random:

Figure 1: Examples of JavaScript attachments from spam email campaigns

Not your favorite Java

Just like a typical email campaign, the JavaScript-toting spam finds its way in your PC after a successful social engineering trick. In bag of tricks are attachment file names intentionally crafted to pique any person’s curiosity (finance-related, etc.).

The JavaScript attachments are heavily-obfuscated to avoid antivirus software detections. It consists of a download and execute function paired with one or two URLs hosting the malware.

Figure 2: Sample code and URL

Figure 3: Another code sample

Figure 4: Another code sample

Figure 5: Another code sample

In some cases, the malicious JavaScript attachment is bundled with a dummy file to evade email rules.

Figure 6: An example of a JavaScript attachment and a dummy file

Figure 7: Another example of a JavaScript attachment and a dummy file

These URLs are mostly short-lived. But when successfully downloaded, the malware, in this case Ransom:Win32/Locky, enters the system and proceeds in its destructive mission.

It is interesting to note that an Office attachment with malicious macros typically requires two or more clicks on the document to run it. One click to open the document, and another click to enable the macros.

On the other hand, the JavaScript attachments only takes one or two clicks for it to start executing.

It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. You should be wary of it and should not click or open it.

Figure 8: A screenshot of how the JavaScript attachment gets executed.

Same stuff, new package

It has been a common vector for malware to spread through email attachment. In the past months, we have seen Office file attachments that contains malicious macro. The code is simple and straightforward, it’s main objective is to download and execute other malware, such as password stealers, backdoors and ransomwares.

The JavaScript-toting email spam is no different.

These malicious email attachments are distributed through spam campaigns. Spam campaigns range from different social engineering areas that appeal to people’s curiosity – enough for them to take action and click what shouldn’t be clicked: from finance-related subjects like receipts, invoice and bank accounts, to resumes and shipment notifications.

Figure 9: A screenshot of a sample bank-related email spam.

Figure 10: A screenshot of a sample remittance-themed email spam.

Figure 11: A screenshot of a sample invoice-themed email spam.

Figure 12: A screenshot of a sample resume-themed email spam.

Figure 13: A screenshot of a shipment notification-themed email spam.

Figure 14: A screenshot of a sample debt case-themed email spam.

Mitigation and prevention

To avoid falling prey from those JavaScript-toting-emails’ social engineering tricks

• Use Windows Defender for Windows 10 as your antimalware scanner.
• Ensure that Microsoft Active Protection Service has been enabled.
• Use Office 365 Advanced Threat Protection. It has a machine learning capability to help your network administrators block dangerous email threats. See the Overview of Advanced Threat Protection in Exchange: new tools to stop unknown attacks, for details.
• Be wary of emails with JavaScript attachments. It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. Do not click or open it.
• Use the AppLocker group policy to prevent dubious software from running.
• Though ransomware and macro-based malware are on the rise, there’s still something that you or your administrators can proactively do:

• Ensure that a strong password policy is implemented throughout the enterprise.
• Disable the loading of macros in Office programs.
• Disable macro loading through the Group Policy settings.
• Keep your software up-to-date to mitigate possible software exploits.
• Protect derived domain credentials with Credential Guard for Windows 10 Enterprise.
• Secure your code integrity with Device Guard for Windows 10 Enterprise.
• Secure the lateral account movement in your enterprise.
• Use two-factor authentication with Microsoft Passport and Windows Hello.

See some of the related blogs and threat reports:

• New feature in Office 2016 can block macros and help prevent infection
• Locky malware, lucky to avoid it
• Social engineering tricks open the door to macro-malware attacks – how can we close it?
• Macro malware report

Alden Pornasdoro

MMPC

We have recently observed that spam campaigns are now using JavaScript attachments aside from Office files. The purpose of the code is straightforward. It downloads and runs other malware.

Some of the JavaScript downloaders that we’ve seen are:

• TrojanDownloader:JS/Swabfex
• TrojanDownloader:JS/Nemucod
• TrojanDownloader:JS/Locky

The same JavaScript downloaders are also responsible for spreading the following ransomware:

• Ransom:Win32/Tescrypt
• Ransom:Win32/Locky

The spam email contains a .zip or .rar file attachment which carries a malicious JavaScript. The JavaScript attachment mostly has the following icon, depending on the system’s script software. The file names are either related to the spam campaign, or completely random:

Figure 1: Examples of JavaScript attachments from spam email campaigns

Not your favorite Java

Just like a typical email campaign, the JavaScript-toting spam finds its way in your PC after a successful social engineering trick. In bag of tricks are attachment file names intentionally crafted to pique any person’s curiosity (finance-related, etc.).

The JavaScript attachments are heavily-obfuscated to avoid antivirus software detections. It consists of a download and execute function paired with one or two URLs hosting the malware.

Figure 2: Sample code and URL

Figure 3: Another code sample

Figure 4: Another code sample

Figure 5: Another code sample

In some cases, the malicious JavaScript attachment is bundled with a dummy file to evade email rules.

Figure 6: An example of a JavaScript attachment and a dummy file

Figure 7: Another example of a JavaScript attachment and a dummy file

These URLs are mostly short-lived. But when successfully downloaded, the malware, in this case Ransom:Win32/Locky, enters the system and proceeds in its destructive mission.

It is interesting to note that an Office attachment with malicious macros typically requires two or more clicks on the document to run it. One click to open the document, and another click to enable the macros.

On the other hand, the JavaScript attachments only takes one or two clicks for it to start executing.

It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. You should be wary of it and should not click or open it.

Figure 8: A screenshot of how the JavaScript attachment gets executed.

Same stuff, new package

It has been a common vector for malware to spread through email attachment. In the past months, we have seen Office file attachments that contains malicious macro. The code is simple and straightforward, it’s main objective is to download and execute other malware, such as password stealers, backdoors and ransomwares.

The JavaScript-toting email spam is no different.

These malicious email attachments are distributed through spam campaigns. Spam campaigns range from different social engineering areas that appeal to people’s curiosity – enough for them to take action and click what shouldn’t be clicked: from finance-related subjects like receipts, invoice and bank accounts, to resumes and shipment notifications.

Figure 9: A screenshot of a sample bank-related email spam.

Figure 10: A screenshot of a sample remittance-themed email spam.

Figure 11: A screenshot of a sample invoice-themed email spam.

Figure 12: A screenshot of a sample resume-themed email spam.

Figure 13: A screenshot of a shipment notification-themed email spam.

Figure 14: A screenshot of a sample debt case-themed email spam.

Mitigation and prevention

To avoid falling prey from those JavaScript-toting-emails’ social engineering tricks

• Use Windows Defender for Windows 10 as your antimalware scanner.
• Ensure that Microsoft Active Protection Service has been enabled.
• Use Office 365 Advanced Threat Protection. It has a machine learning capability to help your network administrators block dangerous email threats. See the Overview of Advanced Threat Protection in Exchange: new tools to stop unknown attacks, for details.
• Be wary of emails with JavaScript attachments. It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. Do not click or open it.
• Use the AppLocker group policy to prevent dubious software from running.
• Though ransomware and macro-based malware are on the rise, there’s still something that you or your administrators can proactively do:

• Ensure that a strong password policy is implemented throughout the enterprise.
• Disable the loading of macros in Office programs.
• Disable macro loading through the Group Policy settings.
• Keep your software up-to-date to mitigate possible software exploits.
• Protect derived domain credentials with Credential Guard for Windows 10 Enterprise.
• Secure your code integrity with Device Guard for Windows 10 Enterprise.
• Secure the lateral account movement in your enterprise.
• Use two-factor authentication with Microsoft Passport and Windows Hello.

See some of the related blogs and threat reports:

• New feature in Office 2016 can block macros and help prevent infection
• Locky malware, lucky to avoid it
• Social engineering tricks open the door to macro-malware attacks – how can we close it?
• Macro malware report

Alden Pornasdoro

MMPC

You may have seen reports of the Locky malware circulating the web; we think this is a good time to discuss its distribution methods, and reiterate some best-practice methods that will help prevent infection.

We’ve seen Locky being distributed by spam email, not in itself a unique distribution method, but this means that spreading is broad and not isolated to any particular region. This ransomware knows no borders, and we’ve seen high infection rates across the world.
The Locky email attachment usually arrives as a Word document, but could also be an Excel document, that appears to be an invoice. We’ve also seen the following downloaders distribute Ransom:Win32/Locky.A:

• TrojanDownloader:O97M/Bartallex
• TrojanDownloader:BAT/Locky.A
• TrojanDownloader:JS/Locky.A

If you open this file and allow the macro to run, the malware is downloaded and runs on your PC, encrypting your files. A ransom message is then displayed demanding payment in order to unlock your encrypted files. Note that once your files are encrypted, the only guaranteed way to restore them is from backup. Microsoft does not recommend you pay the ransom; there is no guarantee that this will give you access to your files.

While Microsoft detects and removes Locky, we recommend you disable macros to help prevent this and other macro-downloaded threats from infecting your PC, and then only enable macros that you trust, on a case-by-case basis. To help keep your enterprise secure, consider using a trusted location for files in your enterprise, then you can store documents that require macros there.  You can also use our cloud protection services to help boost your protection; this, and other advice on how to help keep your PC protected are outlined below.

Disable all except digitally signed macros in Microsoft Word

To help prevent malicious files from running macros that might download malware automatically, we recommend you change your settings to disable all except digitally signed macros.

To do this:

1. Open a Microsoft Word document.
2. Click the File tab.
3. Click Options.
4. In the Trust Center, click Trust Center Settings.

5. Select Disable all macros except digitally signed macros.

6. Click OK.

Block macros from running in Office files from the Internet in your enterprise

Office 16 provides a Group Policy setting that enables you to block macros from running in Word, Excel and PowerPoint files from the Internet. Read about how to block macros from running in Office 16 files from the Internet.

Only enable trusted content

If you have disabled macros, when you open a file that has macros you’ll see a message bar similar to the following:

Only click Enable Content if you trust the file, that is, you know where it’s from and are certain that running the macro is harmless.

Use advanced threat and cloud protection

You can boost your protection by using Office 365 Advanced Threat Protection and also enabling Microsoft Active Protection Service (MAPS).

Office 365 helps by blocking dangerous email threats; see the Overview of Advanced Threat Protection in Exchange: new tools to stop unknown attacks, for details.

MAPS uses cloud protection to help guard against the latest malware threats. You should check if MAPS is enabled on your PC.

Help prevent malware infections on your PC

There are a number of other things you can do to help prevent malware infections, for example:

• Use up-to-date security software
• Keep your software up to date
• Turn on your firewall
• Limit user privileges
• Use trusted locations for files in your enterprise

So to wrap this up: this ransomware is bad, but infection is preventable! Microsoft detects and removes this threat, but by ensuring that you only run known, trusted macros, you’ll help prevent a Locky infection – and any other malware that relies on malicious macros. Generally, a good approach is to only allow digitally signed macros that you trust to run on any of your documents.

Stay safe, from all of us at the MMPC.

-Jasmine Sesso, MMPC