PowerShell used for spreading Trojan.Laziok through Google Docs[html]
Introduction
Through our multi-flow detection capability, we recently identified
malicious actors spreading Trojan.Laziok malware via Google Docs. We
observed that the attackers managed to upload the payload to Google
Docs in March 2016. During the brief time it was live, users accessing
the malicious page from Internet Explorer (versions 3 to 11) would
have become the unwilling hosts for the infostealer payload without
any security warning. After we alerted Google about its presence, they
quickly cleaned it and the original URL involved in propagation also
went down.
The Payload
Trojan.Laziok reportedly serves as a reconnaissance tool that
attackers use to collect information about systems they have
compromised. It has been seen previously in a cyber espionage campaign
targeting the energy sector, particularly in the Middle East name="_ednref1">. In that campaign, the malware was spread
using spam emails with malicious attachments exploiting the
CVE-2012-0158 vulnerability.
The techniques used for delivery in this case involve exploiting
users running versions of Internet Explorer that support VBScript.
Attack Delivery Point
The attacker stored the first stage of the attack on the Polish
domain hosting site cba[.]pl. As seen in Figure 1, the first stage
initiates the attack by running obfuscated JavaScript from
www.younglean. cba[.]pl/lean/.
Figure 1. Obfuscated code shown in the response
Once decoded, the JavaScript unpacks and runs vulnerability
CVE-2014-6332 through VBScript execution in Internet Explorer
(versions 3 to 11), exploiting the memory corruption vulnerability in
Windows Object Linking and Embedding (OLE) Automation to bypass
operating system security utilities and other protections and thus
enabling attackers to enter into ”GodMode” function.
