FIN7 Evolution and the Phishing LNK[html]
FIN7 is a financially-motivated threat group that has been associated
with malicious operations dating back to late 2015. FIN7 is referred
to by many vendors as “Carbanak Group”, although we do not equate all
usage of the CARBANAK backdoor with FIN7. FireEye recently observed a
href="https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html">FIN7
spear phishing campaign targeting personnel involved with United
States Securities and Exchange Commission (SEC) filings at various organizations.
In a newly-identified campaign, FIN7 modified their phishing
techniques to implement unique infection and persistence mechanisms.
FIN7 has moved away from weaponized Microsoft Office macros in order
to evade detection. This round of FIN7 phishing lures implements
hidden shortcut files (LNK files) to initiate the infection and
VBScript functionality launched by mshta.exe to infect the victim.
In this ongoing campaign, FIN7 is targeting organizations with spear
phishing emails containing either a malicious DOCX or RTF file – two
versions of the same LNK file and VBScript technique. These lures
originate from external email addresses that the attacker rarely
re-used, and they were sent to various locations of large restaurant
chains, hospitality, and financial service organizations. The subjects
and attachments were themed as complaints, catering orders, or
resumes. As with previous campaigns, and as highlighted in our href="https://www.fireeye.com/current-threats/annual-threat-report/mtrends.html">annual
M-Trends 2017 report, FIN7 is calling stores at targeted
organizations to ensure they received the email and attempting to walk
them through the infection process.
Infection Chain
While FIN7 has embedded VBE as OLE objects for over a year, they
continue to update their script launching mechanisms. In the current
lures, both the malicious DOCX and RTF attempt to convince the user to
double-click on the image in the document, as seen in Figure 1. This
spawns the hidden embedded malicious LNK file in the document.
Overall, this is a more effective phishing tactic since the malicious
content is embedded in the document content rather than packaged in
the OLE object.
By requiring this unique interaction – double-clicking on the image
and clicking the “Open” button in the security warning popup – the
phishing lure attempts to evade dynamic detection as many sandboxes
are not configured to simulate that specific user action.
Figure 1: Malicious FIN7 lure asking victim to
double click to unlock contents
The malicious LNK launches “mshta.exe” with the following arguments
passed to it:
vbscript:Execute("On Error Resume Next:set
w=GetObject(,""Word.Application""):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close")
The script in the argument combines all the textbox contents in the
document and executes them, as seen in Figure 2.
Figure 2: Textbox inside DOC
The combined script from Word textbox drops the following components:
\Users\[user_name]\Intel\58d2a83f7778d5.36783181.vbs
\Users\[user_name]\Intel\58d2a83f777942.26535794.ps1
\Users\[user_name]\Intel\58d2a83f777908.23270411.vbs
Also, the script creates a named schedule task for persistence to
launch “58d2a83f7778d5.36783181.vbs” every 25 minutes.
VBScript #1
The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher.
This VBScript checks if the “58d2a83f777942.26535794.ps1” PowerShell
script is running using WMI queries and, if not, launches it.
PowerShell Script
“58d2a83f777942.26535794.ps1” is a multilayer obfuscated PowerShell
script, which launches shellcode for a Cobalt Strike stager.
The shellcode retrieves an additional payload by connecting to the
following C2 server using DNS:
aaa.stage.14919005.www1.proslr3[.]com
Once a successful reply is received from the command and control
(C2) server, the PowerShell script executes the embedded Cobalt Strike
shellcode. If unable to contact the C2 server initially, the shellcode
is configured to reattempt communication with the C2 server address in
the following pattern:
