Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le mai 30, 2017, 23:02:34

Titre: [FireEye]Targeted Attacks against Banks in the Middle East
Posté par: igor51 le mai 30, 2017, 23:02:34

Targeted Attacks against Banks in the Middle East

[html]

  Introduction

 

In the first week of May 2016,     href="/content/fireeye-www/en_US/products/dynamic-threat-intelligence/dti-ati-datasheet.html">FireEye’s
  DTI identified a wave of emails containing malicious attachments
  being sent to multiple banks in the Middle East region. The threat
  actors appear to be performing initial reconnaissance against would-be
  targets, and the attacks caught our attention since they were using
  unique scripts not commonly seen in crimeware campaigns.

 

In this blog we discuss in detail the tools, tactics, techniques and
  procedures (TTPs) used in these targeted attacks.

 

  Delivery Method

 

The attackers sent multiple emails containing macro-enabled XLS
  files to employees working in the banking sector in the Middle East.
  The themes of the messages used in the attacks are related to IT
  Infrastructure such as a log of Server Status Report or a list of
  Cisco Iron Port Appliance details. In one case, the content of the
  email appeared to be a legitimate email conversation between several
  employees, even containing contact details of employees from several
  banks. This email was then forwarded to several people, with the
  malicious Excel file attached.

 

  Macro Details

 

The macro first calls an Init() function
  (shown in Figure 1) that performs the following malicious activities:

 

1. Extracts base64-encoded content from the cells within a
       worksheet titled "Incompatible".
2. Checks for the
       presence of a file at the path       class="code">%PUBLIC%\Libraries\ update.vbs. If the file is
       not present, the macro creates three different directories under
         %PUBLIC%\Libraries, namely       class="code">up, dn, and tp.

   
3. The extracted content from step one is decoded using PowerShell
       and dropped into two different files:       class="code">%PUBLIC%\Libraries\update.vbs and
     %PUBLIC%\Libraries\dns.ps1
4. The macro then creates a
       scheduled task with name:     class="code">GoogleUpdateTaskMachineUI, which executes     class="code">update.vbs every three minutes.

 

Note: Due to the use of a hardcoded environment variable   class="code">%PUBLIC% in the macro code, the macro will only
  run successfully on Windows Vista and subsequent versions of the
  operating system.

 

 

 

  Figure 1: Macro Init() subroutine

 

  Run-time Unhiding of Content

 

One of the interesting techniques we observed in this attack was the
  display of additional content after the macro executed successfully.
  This was done for the purpose of social engineering – specifically, to
  convince the victim that enabling the macro did in fact result in the
  “unhiding” of additional spreadsheet data.

 

Office documents containing malicious macros are commonly used in
  crimeware campaigns. Because default Office settings typically require
  user action in order for macros to run, attackers may convince victims
  to enable risky macro code by telling them that the macro is required
  to view “protected content.”

 

In crimeware campaigns, we usually observe that no additional
  content is displayed after enabling the macros. However, in this case,
  attackers took the extra step to actually hide and unhide worksheets
  when the macro is enabled to allay any suspicion. A screenshot of the
  worksheet before and after running the macro is shown in Figure 2 and
  Figure 3, respectively.

 

 

 

  Figure 2: Before unhiding of content

 

 

 

  Figure 3: After unhiding of content

 

In the following code section, we can see that the subroutine   class="code">ShowHideSheets() is called after the   class="code">Init() subroutine executes completely:

 

  Private Sub Workbook_Open()