The Adventures of the Elusive Malvari, Part II: Secret VBA Scripts
This article is part of the Fileless Malware series. All other parts of the series:
- The Adventures of the Elusive Malvari, Part I
- The Adventures of the Elusive Malvari, Part II: Hidden VBA Scripts (we are here)
I am a fan of the hybrid analysis website (HA). This is a kind of malware zoo where you can safely watch wild "predators" from a safe distance without being attacked. HA launches malware in safe environments, records system calls, generated files and Internet traffic, and displays all these results for each sample you analyze. Thus, you can not waste your time and energy by yourself solving the confusing code, but immediately understand all the intentions of the hackers.
Fortunately, HA automatically decodes Base64 and immediately shows everything in a readable form. Essentially, you don’t need to focus on how these scripts work, because you can see the full output of the commands for running processes in the corresponding HA section. See an example below:
Hybrid analysis intercepts Base64 encoded commands sent to PowerShell:
... and then decodes them for you. # magically
PowerShell Empire and Reverse Shell
One goal of this exercise is to show how (relatively) easily a hacker can get around classic perimeter defenses and antiviruses. If an IT blogger without programming skills like me can create a fully undetected (FUD) malware in a couple of evenings , imagine the possibilities of a young hacker interested in this!
And if you are a person providing IT security, but your manager is not aware of the possible consequences of these threats, just show him this article.
Hackers dream of gaining direct access to a laptop or victim’s server. It is very simple to do this: all the hacker needs is to get some confidential files on the CEO’s laptop.
Somehow I already wroteAbout the PowerShell Empire post-production runtime. Let's remember what it is.
In essence, it is a PowerShell-based penetration testing tool that, among many other features, makes it easy to run a reverse shell. You can learn more about it on the PSE homepage .
Let's do a little experiment. I set up a secure malware testing environment in the Amazon Web Services cloud. You can follow my example to quickly and safely show a working example of this vulnerability (and not be fired for launching viruses inside the enterprise perimeter).
If you start the PowerShell Empire console, you will see something like the following:
First, you start the listener process on your hacker computer. Enter the “listener” command, and specify the IP address of your system using “set Host”. Then start the listener process with the execute command (below). Thus, for your part, you start waiting for a network connection from the remote shell:
The magic of the reverse shell. This encoded PowerShell command will connect to my listener and start the remote shell.
Now, when you run Evil.doc, a hidden background process will connect to the server with PowerShell Empire. Having put on the white hat of the hacker-pentester, I returned to the PowerShell Empire console and now I see a message that my remote agent is active.
Then I entered the “interact” command to open the shell in PSE - and here I am! In short, I hacked into a Taco server, which I myself set up once.
What I just demonstrated does not require so much work from you. You can safely do all this for a lunch break for one to two hours to improve your knowledge of information security. It is also a great way to understand how hackers circumvent external security perimeter protection and covertly deploy on your systems.
IT managers who believe that they have built indestructible protection against any penetration will also probably find it informative - well, if, of course, you can convince them to sit next to you for a long time.
Back to reality
As I expected, a real hack that is not visible to the average user is just a variation of what I just described. To collect material for the next publication, I started looking for a sample on HA that works in the same way as my invented example. And I did not have to look for it for a long time - the site has many options for such an attack technique.
The malware I ended up finding on HA is the \ VBA script that was built into the Word document. That is, I don’t even need to fake the doc extension, this malware is really the most common-looking Microsoft Word document. If you're interested, then I chose this sample, called rfq.doc .
I quickly found out that often you won’t be able to directly extract malicious VBA scripts from a document. Hackers compress and hide them, and they are not visible in Word's built-in macro tools. You will need a special tool to extract it. Fortunately, I came across Frank Baldwin's OfficeMalScanner . Thank you, Frank.
Using this tool, I was able to pull out a very confusing VBA code. It looked something like this:
Obfuscation was done by professionals. I was impressed!
The attackers are really good at messing up the code, not like my efforts at creating Evil.doc. Well, ok, in the next part we will get our VBA debuggers, go a little deeper into this code and compare our analysis with the HA results.