Different Forms of Malicious Word Macro Continues to be Distributed...

ASEC analysis team has been continuously analyzing attacks exploiting malicious macro files and has been urging users to take caution. This post will introduce a recent word macro file that was distributed by the attack group TA551. The attack group has been showing changes in their attack method in almost every week.

TA551 usually sent out documents that contain malicious macros using emails in order to distribute malware. The main operation method of the DOC file downloading an additional malware after dropping HTA file upon enabling macro remains the same. However, there is a significant change in the types of malware that are additionally downloaded.

 Figure 1. Operation Method of Malicious DOC Macro Distributed by TA551

The following is an explanation of how the malicious macro in the diagram above works.

The attacker sends an email with attachments that consist of malicious MS Word documents. Once the recipient opens the email, downloads the attached file, and runs the macro, the malicious HTA file gets dropped. A code that exists within the HTA file can download additional malware from the external URL. If the URL link is valid, the ultimate malware that the attacker intended to distribute is downloaded and starts to operate.

 Figure 2. Names of DOC files (HTA, and DLL used to Distribute TrickBot malware)

The names of malicious DOC files used to distribute TrickBot malware this time and of dropped HTA files (same as that of DLL files) are displayed in the table shown above.

The purpose of distribution of TrickBot did not change much, and the same can be said for the operation method of the macro code found in the distribution process of altered malicious macro files continuously used by the TA551 group. It used to be IcedId malware that TA551 steadily distributed since last year, however, the end malware to be downloaded is slightly varying, which is a notable change.

 Figure 3. Behaviors Shown When Enabling DOC Macro (AhnLab RAPIT)

[document.xml] – excerpt

[Macro Code] – excerpt

Taking a look into the macro code for each version that shows changes, we can see the pattern of utilizing the internal data of the initially obfuscated document.xml object and creating hta that is obfuscated for the second time. A simple sample shows that it can slightly change the process of combining commands that execute the hta file. In certain types, they may use the data within document.xml that simply reverses the text order as shown above.

 Figure 4. Malicious DOC Macro File

 Figure 5. Part of Dropped HTA file after Macro is Executed

 Figure 6. Result of Unobfuscating Part of HTA Data

Recently distributed sample shows that when you enable macro in the word file that includes malicious macro as shown in Figure 2, the HTA file from Figure 3 is dropped to the C:\ProgramData path. Unobfuscating a part of the code within the HTA file reveals the following code that downloads additional malware (vbaQueryCount.jpg) from the external malicious URL and saves it in the C:\Users\Public path. The jpg file downloaded is not an image file, but the DLL malware executed with regsvr32.exe.

 Figure 7. TrickBot Malware Downloaded after Disguising itself as an Image File with JPG Extension

 Figure 8. Ultimate DLL File Operated by TrickBot (AhnLab RAPIT)

TrickBot is a malware that is ultimately downloaded, and it attempts malicious behaviors of stealing sensitive information such as that of web browser and financial transaction from the user PC. As shown in Figure 8 (process tree provided by AhnLab RAPIT, malware auto-analysis infrastructure), the malware collects the information of the infected PC using normal processes such as ipconfig.exe, net.exe, nltest.exe, etc.

Recent trend in changes shows that the malware that ultimately runs has changed to financial info-stealing malware.

• IcedID download type

• Ursnif download type

• Trickbot download type

Users should refrain from opening emails from unknown sources, and should not run or enable macro when downloading attachment files. If the security level of the document program is set to low, macro may run automatically without any notification. Therefore, users should maintain the security level high to prevent any unintended features from being run.

Also, users are advised to update the anti-malware engine pattern to its latest version.

AhnLab’s anti-malware product, V3, detects and blocks the types of malicious files introduced in this post (DOC, HTA, DLL, etc.) using the following aliases.

[File Detection]

Downloader/DOC.TA551

Downloader/DOC.TA551.S1535

Downloader/DOC.Agent

Downloader/DOC.Generic

Dropper/MSOffice.Generic

Downloader/HTA.TA551

Downloader/Script.Agent

Trojan/JS.TrickBot

Trojan/Win.Generic.C4531900

[IOC]

47e580efca5c42565af7b214bd601d80

24d2245c3657caba1e3a3bbe14e0cc25

35ff8c7a28c72c64e0f5f9fc75e9a4aa

8333d57a044a01797f6e120b4c1b1dc2

97b1bb23455fb9a9607f37df266459fc

ebda58ce60415f80968457e8548b9fec

b736f5dc071bb3d2bb3f4f9e2e0155d1

86ddb37be7e54511c8761308c1d7fa91

2478032eded8e67228c05e8e1fdc7a89

hxxp://championriced[.]com

hxxp://app.bighomegl[.]at

To learn more about the recent attacks exploiting word macros, visit ASEC blog.