Targeted Attacks against Banks in the Middle East[html]
Introduction
In the first week of May 2016, href="/content/fireeye-www/en_US/products/dynamic-threat-intelligence/dti-ati-datasheet.html">FireEye’s
DTI identified a wave of emails containing malicious attachments
being sent to multiple banks in the Middle East region. The threat
actors appear to be performing initial reconnaissance against would-be
targets, and the attacks caught our attention since they were using
unique scripts not commonly seen in crimeware campaigns.
In this blog we discuss in detail the tools, tactics, techniques and
procedures (TTPs) used in these targeted attacks.
Delivery Method
The attackers sent multiple emails containing macro-enabled XLS
files to employees working in the banking sector in the Middle East.
The themes of the messages used in the attacks are related to IT
Infrastructure such as a log of Server Status Report or a list of
Cisco Iron Port Appliance details. In one case, the content of the
email appeared to be a legitimate email conversation between several
employees, even containing contact details of employees from several
banks. This email was then forwarded to several people, with the
malicious Excel file attached.
Macro Details
The macro first calls an Init() function
(shown in Figure 1) that performs the following malicious activities:
- Extracts base64-encoded content from the cells within a
worksheet titled "Incompatible". - Checks for the
presence of a file at the path class="code">%PUBLIC%\Libraries\ update.vbs. If the file is
not present, the macro creates three different directories under
%PUBLIC%\Libraries, namely class="code">up, dn, and tp.
- The extracted content from step one is decoded using PowerShell
and dropped into two different files: class="code">%PUBLIC%\Libraries\update.vbs and
%PUBLIC%\Libraries\dns.ps1 - The macro then creates a
scheduled task with name: class="code">GoogleUpdateTaskMachineUI, which executes class="code">update.vbs every three minutes.
Note: Due to the use of a hardcoded environment variable class="code">%PUBLIC% in the macro code, the macro will only
run successfully on Windows Vista and subsequent versions of the
operating system.
Figure 1: Macro Init() subroutine
Run-time Unhiding of Content
One of the interesting techniques we observed in this attack was the
display of additional content after the macro executed successfully.
This was done for the purpose of social engineering – specifically, to
convince the victim that enabling the macro did in fact result in the
“unhiding” of additional spreadsheet data.
Office documents containing malicious macros are commonly used in
crimeware campaigns. Because default Office settings typically require
user action in order for macros to run, attackers may convince victims
to enable risky macro code by telling them that the macro is required
to view “protected content.”
In crimeware campaigns, we usually observe that no additional
content is displayed after enabling the macros. However, in this case,
attackers took the extra step to actually hide and unhide worksheets
when the macro is enabled to allay any suspicion. A screenshot of the
worksheet before and after running the macro is shown in Figure 2 and
Figure 3, respectively.
Figure 2: Before unhiding of content
Figure 3: After unhiding of content
In the following code section, we can see that the subroutine class="code">ShowHideSheets() is called after the class="code">Init() subroutine executes completely:
Private Sub Workbook_Open()
