cyble.com
Open in
urlscan Pro
192.0.78.231
Public Scan
URL:
https://cyble.com/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/
Submission: On October 31 via api from US — Scanned from US
Submission: On October 31 via api from US — Scanned from US
Form analysis 4 forms found in the DOM
POST https://wordpress.com/email-subscriptions
<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog" data-hs-cf-bound="true" data-cb-wrapper="true">
<div class="wp-block-jetpack-subscriptions__form-elements">
<p id="subscribe-email">
<label id="subscribe-field-label" for="subscribe-field" class="screen-reader-text"> Type your email… </label>
<input required="required" type="email" name="email" class="no-border-radius has-ast-global-color-6-border-color" style="font-size: 16px;padding: 10px 15px 10px 15px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;"
placeholder="Type your email…" value="" id="subscribe-field" title="Please fill in this field.">
</p>
<p id="subscribe-submit" style="width: ;max-width: 100%;">
<input type="hidden" name="action" value="subscribe">
<input type="hidden" name="blog_id" value="221651828">
<input type="hidden" name="source" value="https://cyble.com/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/">
<input type="hidden" name="sub-type" value="subscribe-block">
<input type="hidden" name="app_source" value="">
<input type="hidden" name="redirect_fragment" value="subscribe-blog">
<input type="hidden" name="lang" value="en_US">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="dbb20961bb"><input type="hidden" name="_wp_http_referer" value="/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/"><input type="hidden" name="post_id"
value="69250"> <button type="submit" class="wp-block-button__link no-border-radius has-ast-global-color-6-border-color"
style="background: #cc0000;width: 100%;font-size: 16px;padding: 10px 15px 10px 15px;margin: 0; margin-left: 10px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe Now <span
class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
<path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
<path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
</svg></span></button>
</p>
</div>
</form>GET https://cyble.com/
<form class="search-form" action="https://cyble.com/" method="get" data-hs-cf-bound="true" data-cb-wrapper="true">
<fieldset>
<span class="text">
<label for="search-field" class="screen-reader-text">Begin Search...</label>
<input id="search-field" name="s" class="search-field" autocomplete="off" type="text" value="" placeholder="Begin Search..." tabindex="1">
</span>
<button aria-label="Search" id="search_submit" class="button search-submit" tabindex="2"><i class="astra-search-icon"> <span class="ast-icon icon-search"></span> </i></button>
</fieldset>
</form>POST https://wordpress.com/email-subscriptions
<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog-2" data-hs-cf-bound="true" data-cb-wrapper="true">
<div class="wp-block-jetpack-subscriptions__form-elements">
<p id="subscribe-email">
<label id="subscribe-field-2-label" for="subscribe-field-2" class="screen-reader-text"> Type your email… </label>
<input required="required" type="email" name="email" style="font-size: 16px;padding: 15px 23px 15px 23px;border-radius: 50px;border-width: 1px;" placeholder="Type your email…" value="" id="subscribe-field-2" title="Please fill in this field.">
</p>
<p id="subscribe-submit">
<input type="hidden" name="action" value="subscribe">
<input type="hidden" name="blog_id" value="221651828">
<input type="hidden" name="source" value="https://cyble.com/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/">
<input type="hidden" name="sub-type" value="subscribe-block">
<input type="hidden" name="app_source" value="atomic-subscription-modal-lo">
<input type="hidden" name="redirect_fragment" value="subscribe-blog-2">
<input type="hidden" name="lang" value="en_US">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="dbb20961bb"><input type="hidden" name="_wp_http_referer" value="/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/"><input type="hidden" name="post_id"
value="69250"> <button type="submit" class="wp-block-button__link" style="font-size: 16px;padding: 15px 23px 15px 23px;margin: 0; margin-left: 10px;border-radius: 50px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe <span
class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
<path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
<path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
</svg></span></button>
</p>
</div>
</form><form id="jp-carousel-comment-form" data-hs-cf-bound="true" data-cb-wrapper="true">
<label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
<textarea name="comment" class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea" id="jp-carousel-comment-form-comment-field" placeholder="Write a Comment..."></textarea>
<div id="jp-carousel-comment-form-submit-and-info-wrapper">
<div id="jp-carousel-comment-form-commenting-as">
<fieldset>
<label for="jp-carousel-comment-form-email-field">Email</label>
<input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-author-field">Name</label>
<input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-url-field">Website</label>
<input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field">
</fieldset>
</div>
<input type="submit" name="submit" class="jp-carousel-comment-form-button" id="jp-carousel-comment-form-button-submit" value="Post Comment">
</div>
</form>Text Content
Check your External Threat Exposure Get Free Threat Assessment Report
Try Cyble Vision for 30 days with our Experts Schedule Free Demo
×
Skip to content
* The Cybersecurity and Infrastructure Security Agency (CISA) Reports Urgent
Security Updates for Apple Products
Switch to Cyble
Report an Incident
Talk to Sales
We are Hiring!
Login
Login
* ProductsMenu Toggle
* For Enterprises(B2B) and GovernmentsMenu Toggle
* AI-Driven Cybersecurity Platforms
* Cyble VisionFor Enterprises
Award-winning cyber threat intelligence platform, designed to provide
enhanced security through real-time intelligence and threat detection.
* Cyble HawkFor Federal Bodies
Protects sensitive information and assets from cyber threats with its
specialized threat detection and intelligence capabilities built for
federal bodies.
* For Enterprises(B2B) and Individuals(B2C)Menu Toggle
* AmIBreached
Enables consumers and organizations to Identify, Prioritize and Mitigate
darkweb risks.
* Odin by CybleNew
The most advanced internet-scanning tool in the industry for real-time
threat detection and cybersecurity
* The Cyber ExpressSubscribe
#1 Trending Cyber Security News and Magazine
* We’ve just released an update!
Cyble has an update that enhances ASM, CTI and more...
Menu Toggle
* Schedule a Demo
* SolutionsMenu Toggle
* Detect > Validate > CloseMenu Toggle
* AI-Driven SolutionsPowered by AIMenu Toggle
* Attack Surface Management
Ensure digital security by identifying and mitigating threats with
Cyble's Attack Surface Management
* Brand Intelligence
Comprehensive protection against online brand abuse, including brand
impersonation, phishing, and fraudulent domains.
* Cyber Threat Intelligence
Gain insights and enhance your defense with AI-driven analysis and
continuous threat monitoring
* Dark Web Monitoring
Stay vigilant and ahead of cybercriminals with Cyble's comprehensive
Dark Web Monitoring.
* Vulnerability Management
Advanced scanning, risk evaluation, and efficient remediation
strategies to protect against cyber threats.
* Menu ItemMenu Toggle
* Takedown and Disruption
Fight cybercrime with Cyble’s top takedown services—remove fraud sites,
content, and disrupt malicious campaigns.
* Third Party Risk Management
Identify and mitigate third-party risks to keep your business secure in
external collaborations.
* Digital Forensics & Incident Response
Cyble offers comprehensive DFIR services to help businesses manage,
mitigate, and recover from cyber incidents.
* Physical Security Intelligence
Monitor multiple locations on one platform with real-time alerts, AI
insights, and tailored threat notifications for proactive security.
* Executive Monitoring
Protect your leadership with proactive threat detection, covering
impersonations, PII leaks, and dark web monitoring with prompt alerts.
* Solutions by Industry
Menu Toggle
* Healthcare & Pharmaceuticals
* Financial Services
* Retail and CPG
* Technology Industry
* Educational Platform
* Solutions by Role
Menu Toggle
* Information Security
* Corporate Security
* Marketing
* Why Cyble?Menu Toggle
* Compare CybleMenu Toggle
* Industry RecognitionAwards
* Customer Stories
* ResourcesMenu Toggle
* Thought LeadershipMenu Toggle
* Blog
Discover the latest in cybersecurity with Cyble's blog, featuring a
wealth of articles, research findings, and insights. CRIL is an
invaluable resource for anyone interested in the evolving world of cyber
threats and defenses, offering expert analysis and updates.
* Threat Actor Profiles
* SAMA Compliance
* Events
Conferences, Webinars, Training sessions and more…
* Data SheetsMenu Toggle
* Case Studies
Dive into Cyble's case studies to discover real-world applications of
their cybersecurity solutions. These studies provide valuable insights
into how Cyble addresses various cyber threats and enhances digital
security for different organizations.
* Research Reports
* Country Reports
* Industry Reports
* Ransomware Reports
* WhitepapersDownload
* External Threat Assessment ReportDownload Report
* Research ReportsLatest Report
Menu Toggle
* Free Tools
* Scan The Dark Web
* Scan The Internet
* CompanyMenu Toggle
* Our Story
Learn about Cyble's journey and mission in the cybersecurity landscape.
Menu Toggle
* Leadership Team
Meet our leadership team.
* CareersWe are hiring!
Explore a career with Cyble and contribute to cutting-edge cybersecurity
solutions. Check out Cyble's career opportunities.
* Press
* PartnersMenu Toggle
* Cyble Partner Network (CPN)Join Us
Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
This platform offers unique opportunities for partnerships, fostering
growth and shared success in tackling cyber threats together.
Menu Toggle
* Partner Login
* Become a PartnerRegister
Elevate your cybersecurity business with the Cyble Partner Network:
Access cutting-edge tools, expert support, and growth opportunities.
Ideal for MSSPs, resellers, and alliances.
Free Trial
Free Trial
Main Menu
* ProductsMenu Toggle
* For Enterprises(B2B) and GovernmentsMenu Toggle
* AI-Driven Cybersecurity Platforms
* Cyble VisionFor Enterprises
Award-winning cyber threat intelligence platform, designed to provide
enhanced security through real-time intelligence and threat detection.
* Cyble HawkFor Federal Bodies
Protects sensitive information and assets from cyber threats with its
specialized threat detection and intelligence capabilities built for
federal bodies.
* For Enterprises(B2B) and Individuals(B2C)Menu Toggle
* AmIBreached
Enables consumers and organizations to Identify, Prioritize and Mitigate
darkweb risks.
* Odin by CybleNew
The most advanced internet-scanning tool in the industry for real-time
threat detection and cybersecurity
* The Cyber ExpressSubscribe
#1 Trending Cyber Security News and Magazine
* We’ve just released an update!
Cyble has an update that enhances ASM, CTI and more...
Menu Toggle
* Schedule a Demo
* SolutionsMenu Toggle
* Detect > Validate > CloseMenu Toggle
* AI-Driven SolutionsPowered by AIMenu Toggle
* Attack Surface Management
Ensure digital security by identifying and mitigating threats with
Cyble's Attack Surface Management
* Brand Intelligence
Comprehensive protection against online brand abuse, including brand
impersonation, phishing, and fraudulent domains.
* Cyber Threat Intelligence
Gain insights and enhance your defense with AI-driven analysis and
continuous threat monitoring
* Dark Web Monitoring
Stay vigilant and ahead of cybercriminals with Cyble's comprehensive
Dark Web Monitoring.
* Vulnerability Management
Advanced scanning, risk evaluation, and efficient remediation
strategies to protect against cyber threats.
* Menu ItemMenu Toggle
* Takedown and Disruption
Fight cybercrime with Cyble’s top takedown services—remove fraud sites,
content, and disrupt malicious campaigns.
* Third Party Risk Management
Identify and mitigate third-party risks to keep your business secure in
external collaborations.
* Digital Forensics & Incident Response
Cyble offers comprehensive DFIR services to help businesses manage,
mitigate, and recover from cyber incidents.
* Physical Security Intelligence
Monitor multiple locations on one platform with real-time alerts, AI
insights, and tailored threat notifications for proactive security.
* Executive Monitoring
Protect your leadership with proactive threat detection, covering
impersonations, PII leaks, and dark web monitoring with prompt alerts.
* Solutions by Industry
Menu Toggle
* Healthcare & Pharmaceuticals
* Financial Services
* Retail and CPG
* Technology Industry
* Educational Platform
* Solutions by Role
Menu Toggle
* Information Security
* Corporate Security
* Marketing
* Why Cyble?Menu Toggle
* Compare CybleMenu Toggle
* Industry RecognitionAwards
* Customer Stories
* ResourcesMenu Toggle
* Thought LeadershipMenu Toggle
* Blog
Discover the latest in cybersecurity with Cyble's blog, featuring a
wealth of articles, research findings, and insights. CRIL is an
invaluable resource for anyone interested in the evolving world of cyber
threats and defenses, offering expert analysis and updates.
* Threat Actor Profiles
* SAMA Compliance
* Events
Conferences, Webinars, Training sessions and more…
* Data SheetsMenu Toggle
* Case Studies
Dive into Cyble's case studies to discover real-world applications of
their cybersecurity solutions. These studies provide valuable insights
into how Cyble addresses various cyber threats and enhances digital
security for different organizations.
* Research Reports
* Country Reports
* Industry Reports
* Ransomware Reports
* WhitepapersDownload
* External Threat Assessment ReportDownload Report
* Research ReportsLatest Report
Menu Toggle
* Free Tools
* Scan The Dark Web
* Scan The Internet
* CompanyMenu Toggle
* Our Story
Learn about Cyble's journey and mission in the cybersecurity landscape.
Menu Toggle
* Leadership Team
Meet our leadership team.
* CareersWe are hiring!
Explore a career with Cyble and contribute to cutting-edge cybersecurity
solutions. Check out Cyble's career opportunities.
* Press
* PartnersMenu Toggle
* Cyble Partner Network (CPN)Join Us
Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
This platform offers unique opportunities for partnerships, fostering
growth and shared success in tackling cyber threats together.
Menu Toggle
* Partner Login
* Become a PartnerRegister
Elevate your cybersecurity business with the Cyble Partner Network:
Access cutting-edge tools, expert support, and growth opportunities.
Ideal for MSSPs, resellers, and alliances.
TRENDING
TARGETED INDUSTRIES -> IT & ITES | Government & LEA | Technology | Healthcare |
BFSITARGETED COUNTRIES -> United States | Russian Federation | China | United
Kingdom | GermanyTARGETED REGIONS -> North America (NA) | Europe & UK | Asia &
Pacific (APAC) | Middle East & Africa (MEA) | Australia and New Zealand
(ANZ)IOCs -> a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 |
7bdbd180c081fa63ca94f9c22c457376 |
c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 |
8c69830a50fb85d8a794fa46643493b2 | bbcf7a68f4164a9f5f5cb2d9f30d9790CVEs ->
CVE-2024-21887 | CVE-2023-46805 | CVE-2017-11882 | CVE-2024-21893 |
CVE-2021-44228TECHNIQUES -> T1082 | T1140 | T1486 | T1083 | T1105TACTICS ->
TA505 | TA0011 | TA0001 | TA0002 | TA0005TAGS -> security | the-cyber-express |
firewall-daily | the-cyber-express-news | malwareTHREAT ACTORS -> Lockbit |
Blackcat | Lazarus | VoltTyphoon | KimsukyMALWARE -> CobaltStrike | Qakbot |
Icedid | Trickbot | XmrigSOURCES -> Darkreading | The Cyber Express |
Bleepingcomputer | The Hacker News | Infosecurity Magazine
Home » Blog » HeptaX: Unauthorized RDP Connections for Cyberespionage Operations
* Malware
* October 25, 2024
HEPTAX: UNAUTHORIZED RDP CONNECTIONS FOR CYBERESPIONAGE OPERATIONS
Cyble uncovers an ongoing campaign by a persistent threat group leveraging
consistent techniques to gain unauthorized Remote Desktop access on compromised
systems, targeting a wide range of users.
KEY TAKEAWAYS
* Cyble Research and Intelligence Labs (CRIL) came across an ongoing
cyberattack campaign originating from malicious LNK files.
* The sophisticated multi-stage attack chain relies heavily on PowerShell and
BAT scripts to streamline the download and execution of additional payloads,
demonstrating the Threat Actor’s (TA) preference for script-based methods to
evade detection by traditional security solutions.
* The attack involves the creation of an administrative account on the victim’s
system and altering Remote Desktop settings to lower authentication
requirements, simplifying unauthorized RDP access for the attacker.
* The campaign deploys an additional well-known password recovery tool,
ChromePass, which collects saved passwords from Chromium-based browsers,
increasing the risk of broader account compromises.
* Based on its TTPs, we have not been able to attribute this campaign, so for
tracking purposes, we are naming it “HeptaX”.
OVERVIEW
CRIL has come across a multi-stage cyberattack campaign that begins with a ZIP
file containing a malicious shortcut file (.lnk). While the source of this ZIP
file remains unknown, it is suspected to be disseminated through phishing
emails. Based on the LNK file name, it is suspected that this campaign targets
the healthcare industry.
Upon execution, the LNK file triggers a PowerShell command that downloads and
executes a series of additional payloads, including PowerShell scripts and BAT
files, from a remote server. These scripts work in tandem to create a new user
account on the compromised system with administrative privileges and modify
Terminal Services (RDP) settings, lowering authentication requirements. This
setup enables the TAs to easily establish remote desktop access (RDP) to the
victim’s system, facilitating further malicious activities such as data
exfiltration, the installation of additional malware, or even system monitoring.
Furthermore, CRIL identified the presence of an unwanted application called
“ChromePass” within the threat actors’ network infrastructure. This hacking tool
is designed to steal saved passwords from Chromium-based browsers, adding
another layer of risk for victims by exposing their credentials. The image below
illustrates the infection chain.
Figure 1 – Infection chain
Based on the information obtained through pivoting, this group has been
operational since 2023 and has executed a range of attacks across different
sectors, as reflected in the names of the lure files. While the overall attack
flow has remained consistent, it is surprising that they are still active using
the same techniques. Several researchers have previously identified this
campaign [1],[2],[3],[4],[5], with the majority of findings shared by the
Malware Hunter Team.
CAMPAIGN ANALYSIS
Over the past 12 months, this unidentified group has consistently reemerged with
various lure themes while maintaining unchanged attack patterns. Tracked as
HeptaX,’ the campaign relies heavily on PowerShell and Batch scripts to gain
control over compromised systems. By pivoting the IP address, we uncovered
several additional artifacts associated with the same TAs used across different
campaigns.
Figure 2 – Project Description – PoC smart assistant Vhyro Project from jvope
signature.pdf (lure doc observed in Oct 2023)
Figure 3 – Blockchain_Trading_Website_Manager.docx (lure file observed in Sept
2023)
Figure 4 – WebContentWriting_Handout.pdf (lure observed in Oct 2023)
Figure 5 – Resume – professional sax, keys, and guitar player with over 40 years
experience working with own bands, accompanied world stars.pdf (lure observed in
Nov 2023)
Figure 6 – SOW_for_Nevrlate.pdf (lure file Observed in Nov 2023)
One of the notable files from this campaign is:
Your browser does not support the video tag.
* 202409_Resident_Care_Quality_Improvement_Strategies_for_Nursing_Homes_Enhancing_Patient_Satisfaction_and_Health_Outcomes.pdf.lnk
In addition, older campaigns attributed to this threat group over the past year
include malicious files with names such as:
* SOW_for_Nevrlate.pdf
* WebContentWriting_Handout.pdf
* Blockchain_Trading_Website_Manager.docx
* Project Description – PoC smart assistant Vhyro Project from jvope
signature.pdf
* Resume – professional sax, keys and guitar player with over 40 years
experience working with own bands, accompanied world stars.pdf
* dropshipping Elien project prposal-soft online service ventilization from
xihu.pdf.lnk
The diversity in file names and themes suggests that this group tailors its
campaigns to appeal to a variety of victims, indicating a broad targeting
strategy across multiple industries.
TECHNICAL ANALYSIS
Upon execution, the LNK file runs a PowerShell command that downloads and
executes subsequent payloads from a remote server. The image below shows a
partially de-obfuscated PowerShell command.
Figure 7 – De-Obfuscated PowerShell Code
First stage – bb.ps1
As an initial step, the downloaded PowerShell script constructs a base URL to
which it sends information and from which it downloads other stage payloads. The
PowerShell script contains multiple functions, the first of which retrieves a
unique identifier (UID) for the compromised system. This UID is obtained either
from a specific registry path (HKEY_LOCAL_MACHINE\SOFTWARE\Wireless) or from a
log file (id.log) in the “C:\Users\Public\Documents” directory. If neither
exists, a new GUID is generated and saved to a newly created id.log file.
Figure 8 – UID Generation
Next, the PowerShell script creates a shortcut file in the Windows Startup
folder for persistence. The contents of the newly generated LNK file match those
of the original malicious LNK file. The image below shows the function
responsible for creating the new LNK file in the startup folder.
Figure 9 – Shortcut Creation for Persistence
Then, the PowerShell script constructs a URL by appending the previously
generated UID to the remote server, forming the request
hxxp://157.173.104.153/up/get-command.php?uid=<UID>, and uses WebClient to send
a request to fetch commands from the server. Upon receiving a successful
response, it checks whether the response contains the string “autoreconnect”. If
this string is present, the Powershell script runs the code in the current
session using `iex`; otherwise, it executes the code as a background task in a
separate PowerShell process.
Figure 10 – Fetching commands from the command-and-control server
Afterward, the PowerShell script downloads a password-protected lure document
from the above-mentioned remote server, saves it in the system’s temporary
directory “C:\Users\<Username>\AppData\Local\Temp”, and then launches the
document. The image below displays the function code and the open directory
containing the lure PDF.
Figure 11 – Code to download and launch lure document
Figure 12 – Open directory containing lure PDF
Finally, the PowerShell script retrieves two registry values related to User
Account Control (UAC):
* HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin,
which controls the consent prompt behavior for administrators.
* HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA,
which indicates whether UAC is enabled.
If either of these values is 0, suggesting that UAC is either disabled or
configured to a less secure setting, the script proceeds to download and execute
another PowerShell script (b.ps1) from the remote server.
Figure 13 – Code to download next stage payload
Second Stage – b.ps1
The newly downloaded second-stage PowerShell script includes several functions,
some mirroring those from the first stage. The primary function of this script
is focused on evaluating the system’s User Account Control (UAC) settings,
utilizing the same registry checks employed earlier to determine whether UAC is
enabled and if the consent prompt for administrators remains active.
If UAC is disabled or the consent prompt behavior is configured to a less secure
state, the function sends a message to the remote server indicating that UAC is
off by default: (“hxxp://157.173.104[.]153/up/index.php?uid=$uid&msg=UAC off in
default!”).
If both settings are enabled, the function enters a loop, repeatedly attempting
to disable UAC by setting the “ConsentPromptBehaviorAdmin” value to 0. Once
successful, it sends a message to the remote server stating that UAC has been
forcefully disabled: (“hxxp://157.173.104[.]153/up/index.php?uid=$uid&msg=UAC
force disabled!”). The below image shows the function code responsible for
sending a POST request to the remote server, transmitting information about the
victim’s User Account Control (UAC) status.
Figure 14 – Code for sending a POST request to the C&C server with the victim’s
UAC status
After a brief 300-millisecond sleep, the PowerShell script calls the schReg()
function, which downloads three batch files from the remote server into the
system’s temporary directory ($env:TEMP). The files are named “k1.bat,”
“scheduler-once.bat,” and “k2.bat.” After downloading, the script runs the
“scheduler-once.bat” file using the “Start-Process” cmdlet with elevated
privileges. The image below shows the code responsible for downloading and
executing the batch files.
Figure 15 – Code to download and run batch file
Third Stage – scheduler-once.bat
The executed batch file copies “k1.bat” and “k2.bat” from the %temp% directory
to “C:\Windows\System32”, renaming them to “sysmon.bat” and “sysmon2.bat”. It
then deletes the original “k1.bat” and “k2.bat” files from the temp location.
Next, the batch file checks for and removes any scheduled tasks named:
* Intel(R) Ethernet Connection 1219-LM
* Intel(R) Ethernet2 Connection 1219-LM
Afterward, it creates a new scheduled task called “Intel(R) Ethernet2 Connection
1219-LM” to run “sysmon2.bat”. Finally, the script “scheduler-once.bat” deletes
itself to cover its traces from the system. The image below displays the
contents of the batch file “scheduler-once.bat”.
Figure 16 – Contents of the scheduler-once.bat file
Fourth Stage – sysmon2.bat
Once the scheduled task is triggered to execute the “sysmon2.bat” file, it first
checks for and removes any existing scheduled tasks named:
* Intel(R) Ethernet Connection 1219-LM2
* Intel(R) Ethernet2 Connection 1219-LM2
Afterward, it creates a new scheduled task called “Intel(R) Ethernet2
Connection1219-LM2” to run the “sysmon.bat” file located in the
“C:Windows\System32” folder. Notably, the previous third-stage batch file
performs similar checks, but the task names differ slightly. The image below
shows the content of the “sysmon2.bat” file.
Figure 17 – Contents of the sysmon2 file
Fifth Stage – Sysmon.bat
The sysmon.bat script executes a series of actions:
* Creates a new user account named “_BootUEFI_”.
* Sets the password for this newly added account to “123456!!!” and activates
it.
* Adds the “_BootUEFI_” account to the Administrators group, granting it
administrative privileges.
* Adds the “_BootUEFI_” account to the Remote Desktop Users group, allowing it
to utilize Remote Desktop.
* Removes the “_BootUEFI_” account from the Users group, ensuring it retains
only administrative and remote desktop privileges.
* Additionally, the batch file makes several registry modifications to enable
Remote Desktop and lower its security features. This includes hiding the
“_BootUEFI_” user from the login screen and adjusting Terminal Services
(Remote Desktop) settings to facilitate easier remote connections without
stringent authentication requirements.
* The batch file runs a PowerShell command that circumvents execution policy
restrictions and adds the System32 directory, which contains the three
malicious batch files, to the Windows Defender exclusion list.
* Finally, it initiates a background PowerShell process that downloads and
executes another PowerShell script from the remote server
(hxxp://157.173.104[.]153/up/a.ps1).
Figure 18 – Contents of the sysmon.bat file
Sixth Stage – a.ps1
The newly downloaded PowerShell script “a.ps1” functions similar to the first
stage script (bb.ps1). It constructs a URL by appending the previously generated
UID to the remote server address, forming a request to
“hxxp://157.173.104.153/up/get-command.php?uid=<UID>”.
The script then utilizes a WebClient to send a request and retrieve commands
from the server. Upon receiving a response, it checks for the presence of the
string “autoreconnect id.” If this string is found, the PowerShell script
executes the code in the current session using iex; otherwise, it runs the code
as a background task in a separate PowerShell process. Notably, in both stages,
we did not receive any specific commands such as “autoreconnect” or
“autoreconnect id”. The main difference in this sixth-stage script is that it
looks for the string “autoreconnect id” instead of just “autoreconnect”. The
below image shows the code for reconnecting to the server.
Figure 19 – Reconnecting to the C&C server
Seventh Stage – Server response PowerShell Script
Upon establishing a connection with the server, a new PowerShell script is
executed. This script contains several functions aimed at system reconnaissance,
data exfiltration, and interaction with the remote server.
The script collects detailed system information, including:
* Computer name and username.
* Retrieves recent files from the directory: C:\Users\<user
profile>\AppData\Roaming\Microsoft\Windows\Recent.
* Acquires network configuration details using “ipconfig /all”.
* List of users on the machine (net user).
* Obtains current logged-in user details.
* Identifies local user groups associated with the current user.
* Retrieves excluded directories in Windows Defender.
* Lists installed antivirus products.
* Captures running processes using “tasklist”.
* Gathers overall system information using “systeminfo”.
* All this data is saved in a log file located at
“C:\Windows\Temp\OneDriveLog\OneDrive.log”.
The script then reads the contents of the log file, converts the data into a
byte array, and encodes it in Base64 format. This encoded data, along with the
unique user ID (uid), is appended to the base URL”
hxxp://157.173.104[.]153/up/index.php” and sent via a POST request. After
successfully transmitting the data, the log file and its directory are deleted
to eliminate any traces of the data collection.
Figure 20 – Script partial content for making a POST request
Taking Remote desktop
With all the collected information, User Account Control (UAC) disabled, and a
new user account named “BootUEFI” created with administrative privileges, along
with lowered authentication requirements for Terminal Services, the TAs can
easily gain access to the compromised remote desktop. This access enables them
to perform various actions on the victim’s machine, such as:
* Installing additional malware
* Exfiltrating sensitive data
* Monitoring user activity
* Modifying system settings
* Utilizing the machine for malicious activities
Additionally, we observed an unwanted application—a hacking tool named
ChromePass—associated with the same network infrastructure at
“hxxp://157.173.104[.]153/up/Tool/ChromePass.exe” This tool is designed to steal
saved passwords from Chromium-based browsers.
CONCLUSION
Over the past year, this group has executed multiple attacks utilizing various
lures and targeting different victims, all while remaining largely unnoticed.
Their reliance on basic scripts has enabled TAs to gain remote access to
compromised systems seamlessly, allowing for extensive exploitation without
triggering alarms.
Additionally, the deployment of the ChromePass tool further underscores the
group’s intent to harvest sensitive information, such as saved passwords from
Chromium-based browsers, thereby posing a significant threat to the security of
individuals and organizations alike. This combination of tactics highlights the
need for enhanced detection and prevention measures to combat these stealthy
cyber threats effectively.
RECOMMENDATIONS
* The initial breach may occur via spam emails. Therefore, it’s advisable to
deploy strong email filtering systems to identify and prevent the
dissemination of harmful attachments.
* Exercise caution when handling email attachments or links, particularly those
from unknown senders. Verify the sender’s identity, particularly if an email
seems suspicious.
* Consider disabling the execution of shortcut files (.lnk) from email
attachments or implementing policies that require explicit user consent
before executing such files.
* Consider disabling or limiting the execution of scripting languages, such as
PowerShell and cmd.exe, on user workstations and servers if they are not
essential for legitimate purposes.
* Implement policies that prevent the unauthorized creation of privileged
accounts.
* Regularly track changes to User Account Control (UAC)- related registry keys,
such as “EnableLUA” and “ConsentPromptBehaviorAdmin.” Monitoring these keys
helps identify potential attempts to bypass UAC, enhancing system protection
against unauthorized changes.
* Strengthen the security of Remote Desktop Protocol (RDP) by enforcing strong
authentication mechanisms, such as multi-factor authentication (MFA), and by
using network-level authentication (NLA). Limiting RDP access to trusted IP
addresses and utilizing VPNs can also help mitigate risks.
* Set up network-level monitoring to detect unusual activities or data
exfiltration by malware. Block suspicious activities to prevent potential
breaches.
MITRE ATT&CK® TECHNIQUES
TacticTechniqueProcedureInitial Access (TA0001)Phishing (T1566)The LNK file may
be delivered through phishing or spam emailsExecution (TA0002)User Execution:
Malicious Link (T1204.001) Command and Scripting Interpreter: PowerShell
(T1059.001) Execution begins when a user executes the LNK file The LNK file
executes PowerShell commandsDefense Evasion (TA0005)
Obfuscated Files or
Information (T1027) Scripts include packed or encrypted data.Persistence
(TA0003)Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
(T1547.001)Adds LNK file in the startup folderPrivilege
Escalation
(TA0004) Abuse Elevation Control Mechanism (T1548) Account Manipulation
(T1098)Bypass User Account Control Manipulate accounts to maintain and/or
elevate access to victim systems.Discovery (TA0007)System Information Discovery
(T1082)Script gathers system information.Credential Access (TA0006)Credentials
from Password Stores: Credentials from Web Browsers (T1555.003) Retrieves
credentials from web browsers C&C
(TA0011) Ingress Tool Transfer
(T1105) Downloads files from webservers via
HTTP C&C
(TA0011) Application Layer Protocol
(T1071) Malware exe communicate to C&C server.
INDICATORS OF COMPROMISE
Indicators Indicator
TypeDescription6605178dbc4d84e789e435915e86a01c5735f34b7d18d626b2d8810456c4bc72SHA256Zip
File18e75bababa1176ca1b25f727c0362e4bb31ffc19c17e2cabb6519e6ef9d2fe5
5ff89db10969cba73d1f539b12dad42c60314e580ce43d7b57b46a1f915a6a2bSHA256Malicious
LNK
file1d82927ab19db7e9f418fe6b83cf61187d19830b9a7f58072eedfd9bdf628dabSHA256bb.ps1a8d577bf773f753dfb6b95a3ef307f8b4d9ae17bf86b95dcbb6b2fb638a629b9SHA256b.ps1999f521ac605427945035a6d0cd0a0847f4a79413a4a7b738309795fd21d3432SHA256K1.bat4b127e7b83148bfbe56bd83e4b95b2a4fdb69e1c9fa4e0c021a3bfb7b02d8a16SHA256GooglePasshxxp://157.173.104[.]153/up/index.php
hxxp://157[.]173.104.153/up/b.ps1 hxxp://157.173.104[.]153/up/bb.ps1
hxxp://157.173.104[.]153/up/scheduler-oncex
hxxp://157.173.104[.]153/up/trigger
hxxp://157.173.104[.]153/up/Tool/ChromePass.exe
hxxp://157.173.104[.]153/up/get-command.php
hxxp://157.173.104[.]153/up/bait/202409_Resident_Care_Quality_Improvement_Strategies_for_Nursing_Homes_Enhancing_Patient_Satisfaction_and_Health_Outcomes.pdfURLRemote
server
REFERENCES
https://twitter.com/malwrhunterteam/status/1701669714244542758
https://twitter.com/AzakaSekai_/status/1846482785009348692
https://twitter.com/fmc_nan/status/1701427951714345296
https://twitter.com/malwrhunterteam/status/1708219656488571188
https://twitter.com/malwrhunterteam/status/1701672325580550176
RELATED
PHISHING CAMPAIGN TARGETING UKRAINE: UAC-0215 THREATENS NATIONAL SECURITY
Threat actor UAC-0215 launches a phishing campaign threatening Ukraine's public,
industrial, and military sectors.
October 29, 2024
In "Phishing"
NEW MALWARE CAMPAIGN ABUSING RDPWRAPPER AND TAILSCALE TO TARGET CRYPTOCURRENCY
USERS
Threat actors spotted creating a reverse connection to target cryptocurrency
users by leveraging RDPWrapper and Tailscale.
July 17, 2024
In "Malware"
THE ROLE OF INITIAL ACCESS IN THE ECOLOGY OF CYBERCRIME
Cyble discusses the pivotal role that Initial Access Brokers play in Organized
Cybercrime.
June 28, 2022
In "Cybercrime"
Technical Content! Subscribe to Unlock
Sign up and get access to Cyble Research and Intelligence Labs' exclusive
contents
Email
Country
Phone
Unlock this Content
GET THREAT ASSESSMENT REPORT
Identify External Threats Targeting Your Business
Get My Report
Free
Your browser does not support the video tag.
*
*
CISO’S GUIDE TO THREAT INTELLIGENCE 2024: BEST PRACTICES
Stay Ahead of Cyber Threats with Expert Insights and Strategies. Download Free
E-Book Now
Search for your darkweb exposure
Use Cyble's Largest Dark Web Monitoring Engine to Assess Your Exposure. Make
Sure You're Aware of the Risks by Searching Through Our 150,447,938,145 Records!
We Have Over 50,000 Data Breaches, Several Hacking Forums, Conversations
Indexed.
Download Now
Cybercrime Magazine · AI's Impact On Cybersecurity. Microsoft Recall & Beyond.
Beenu Arora, Co-Founder & CEO, Cyble.
Business Email Address*
Type your email…
Subscribe Now
Share the Post:
PrevPreviousCyble Unveils Four Groundbreaking Capabilities for Enhanced Threat
Intelligence
NextNew Vulnerabilities Identified in Philips Smart Lighting and Matrix Door
ControllerNext
RELATED POSTS
THE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA) REPORTS URGENT
SECURITY UPDATES FOR APPLE PRODUCTS
October 30, 2024
STRELA STEALER TARGETS CENTRAL AND SOUTHWESTERN EUROPE THROUGH STEALTHY
EXECUTION VIA WEBDAV
October 30, 2024
QUICK LINKS
Main Menu
* Home
* About Us
* Blog
* Cyble Partner Network (CPN)
* Press
* Responsible Disclosure
* Knowledge Hub
* Sitemap
PRODUCTS
Main Menu
* AmIBreached
* Cyble Vision
* Cyble Hawk
* Cyble Odin
* The Cyber Express
SOLUTIONS
Main Menu
* Attack Surface Management
* Brand Intelligence
* Threat Intelligence Platform
* Dark Web Monitoring
* Takedown and Disruption
* Vulnerability Management
PRIVACY POLICY
Main Menu
* AmIBreached
* Cyble Vision
* Cyble Trust Portal
SCHEDULE A PERSONALIZED DEMO TO UNCOVER THREATS THAT NO ONE TELLS YOU
Book a Demo
© 2024. Cyble Inc.(#1 Threat Intelligence Platform Company). All Rights Reserved
Made with from Cupertino
Twitter Linkedin Youtube
Request a demo
Upcoming Events
Research Reports
Talk To Sales
START TYPING AND PRESS ENTER TO SEARCH
Begin Search...
Scroll to Top
DISCOVER MORE FROM CYBLE
Subscribe now to keep reading and get access to the full archive.
Type your email…
Subscribe
Continue reading
Loading Comments...
Write a Comment...
Email Name Website
We use cookies to ensure that we give you the best experience on our website. If
you continue to use this site we will assume that you are happy with it.Ok
Stay ahead in Cybersecurity with Cyble Research. You can unsubscribe at any
time.
AllowCancel