Executive summary

Cisco Talos recently discovered a new malware loader being used to deliver and infect systems with a previously undocumented malware payload called "Divergent." We first dove into this malware after we saw compelling data from Cisco Advanced Malware Protection's (AMP) Exploit Prevention.

This threat uses NodeJS— a program that executes JavaScript outside of a web browser — as well as the legitimate open-source utility WinDivert to facilitate some of the functionality in the Divergent malware. The use of NodeJS is not something commonly seen across malware families.

The observed malware campaigns associated with Divergent feature the use of persistence techniques most commonly associated with "fileless" malware, leaving behind few artifacts for researchers to look at. This malware can be leveraged by an attacker to target corporate networks and appears to be primarily designed to conduct click-fraud. It also features several characteristics that have been observed in other click-fraud malware, such as Kovter.

Technical Details

Talos has identified a new moduler malware that is being used to facilitate the installation of a previously undocumented malware family, which we are referring to as Divergent, due to the naming convention used by the malware during variable declaration and the creation of environment variables. While we were unable to determine the delivery mechanism used, we were able to perform analysis of the malware loader as well as the Divergent malware that it is used to install on victim systems. Divergent is a malware family designed to generate revenue for attackers via the use of click-fraud, similar to other click-fraud malware such as Kovter. Technical details associated with both the installation and operation of the Divergent malware are described in the following sections.

Installation

The malware has many similarities with other popular fileless malware families, particularly Kovter. Like Kovter, it relies heavily on the registry for staging and storage of configuration data while avoiding more traditional on-access endpoint scanning of files on disk. It also uses a key in the registry to maintain persistence, and relies on PowerShell to install itself on the infected host.

When first delivered and executed on a victim's machine, the malware is in the portable executable (PE) format. Its first task, however, is to install itself to the system in a less suspicious form, namely as an HTML Application (HTA) that will load the malware from the registry.

Installation begins by creating several registry keys containing the different parts of the loader as well as the data of the malware PE. The malware reads all the information embedded in its data section and creates three new randomly named registry keys, each holding a different stage of the loader code needed to execute the malware PE using reflective injection.

Next, the HTA loader is written to the CSIDL_COMMON_APPDATA folder (typically C:\ProgramData\) and set to execute each time the user logs on by adding an entry to the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" registry key.

An example of an HTA loader and the accompanying registry entries necessary to execute the malware once installed are:

• 17T21vYHOb.hta :: e4a49af295d6e61877a458a014fe63b733be942c506496b53070aa3d9ca421d8
• ZfjrAilGdH.reg :: 5863f35959aa542a27319e098f40166f3ace09d265f4ec6d739318c0b739745e

This registry file contains the following subkeys in the key HKLM\Software\ZfjrAilGdH which are set by the installation process (the key names are randomly generated and will be different for each installation):

• Lvt4wLGLMZ :: JScript executed by ZfjrAilGdh.hta
• kCu2DZ9WI0 :: PowerShell used to reflectively inject the malware
• 4FLJBnefsN :: hex data representing the malware PE

Fileless malware loader

The HTA is heavily obfuscated but when cleaned up, evaluates to an eval of the JScript in the registry key "HKLM\Software\ZfjrAilGdh\Lvt4wLGLMZ" via a "ActiveXObject.WScript.Shell.RegRead" (shown here as pseudo code):
The JScript in the reg key executes the following powershell (shown here deobfuscated):
This code will execute the code found in the registry location HKLM\Software\ZfjrAilGdH\kCu2DZ9WI0 after setting the variable regkeyname to the data found in the registry location HKLM\Software\ZfjrAilGdH\4FLJBnefsN. The registry key 4FLJBnefsN contains the bytes of the malicious portable executable (PE) with a modified DOS header, namely the MZ has been replaced with null bytes.

The code from kCu2DZ9WI0 is a version of PowerShell Empire's reflective PE injection script that will inject the malware:
At this point, the malware executes.

Divergent malware

There are two main parts of this threat: one to receive and execute commands from a C2 server and another to execute external component scripts. The configuration for each part is stored in the registry in JSON format.

The component configuration describes which components should be executed and how. This example configuration will execute three different JScript components:
Each entry is parsed, and each filename and args value is passed along for execution by the malware. Detailed analysis of the call_03 (see Now I See You), all_socks_05 (see Click Fraud), and block_av_01 (see Block AV Component) components can be found below.

The network configuration stores two classes of C2: "accl" is a list of URLs that the malware should attempt to contact for system information delivery and for commands to execute, while "acll" is a list of URLs the malware should attempt to contact for possible updates to either configuration file. The default values from ZfjrAilGdH.reg are:
Notice that "version" is an epoch timestamp, converting to Saturday, March 30, 2019 7:14:29 PM GMT. The earliest reference we found containing several IOCs from this malware sample dates back to February 2019.

Once executed, the malware begins with five anti-analysis checks. If any of these checks fail, a beacon is sent to a static URL containing a direct IP and sleeps indefinitely:
The beacon message indicates which anti-analysis check failed to pass. The malware checks for unwanted processes and loaded modules by hashing process file names and module names respectively, then comparing each hash against two separate pre-computed lists for each. The lists contain hashes for endpoint security software and hypervisor services as running the sample under both scenarios failed these checks. It also checks for a host CPU with at least two cores, the presence of a debugger, and finally compares system uptime intervals to determine if the sample is running within a sandbox or virtual machine.

If the process is running with the appropriate privileges, it uses WMI (Windows Management Instrumentation) to query recognized anti-virus software installed on the host. In particular, it's looking for the antivirus software Windows Defender. If found, it proceeds to disable various components of Windows Defender and Windows Updates.
Once completed, it attempts to bypass UAC using CMSTP, if needed. Additional code is executed to check for any updates to the malware's two configuration files. Empty POST requests are sent to each of the URLs in the first configuration's accl key. These URLs are later contacted with a comprehensive set of sensitive information from the host. Most are non-responsive but still online. Many appear to be, or once were, compromised hosts used for the C2 network.

The set of direct IP URLs found in the first configuration's acll key are contacted until one server responds back with a configuration update. A response containing an RC4 encrypted update to the first of the malware's configurations in the Registry. In this sample, the RC4 key "seiC4aimaish9zah8kah" is static, and decryption results in a lengthier update for the first configuration:
The data is stored in the pre-existing registry subkey to update the value (in this example, HKLM\SOFTWARE\ZfjrAilGdH\194956). As of Sept. 9, 2019, the version timestamp for the latest config pulled was Thursday, Aug. 29, 2019 11:50:19 a.m.

The second configuration is stored in the last remaining value in the ZfjrAilGdH registry subkey (HKLM\SOFTWARE\ZfjrAilGdH\2177774). Default values mentioned near the beginning of this section remained in use during runtime.

The primary flow of the malware code reaches an end but repeats select tasks every 90 minutes. It continues to check for configuration updates, continues to send encrypted sensitive information from the infected host, and continues to process any C2 responses that might contain additional commands to execute. The following commands and parameters are supported by the C2 protocol used by Divergent:

• killall: Terminate all processes initiated by the malware, delete corresponding files
• kill: Find process of specified component, terminate process, and delete the file
• stop: Find process of specified component, terminate process
• resume: Given pre-existing component, execute file
• modules: From the same response data, pull additional configuration data from the following keys:
• name
• filename
• args
• version
• type
• download
• Key

Using this data, the malware sends additional requests to download each specified file. The files are written to disk and executed.

• update: From the same response data, pull additional configuration data from the following keys:
• filename
• download
• Key

Same as the modules command, the malware sends additional requests to download each specified file. Each file is written to disk and executed. Finally, the task deletes the Registry data stored in its subkey (handles both HKCU and HKLM).

The command update_interval modifies the main thread's sleep counter for the ending loop (the default time is 90 minutes).

Components

Block AV component

The block_av_01 component attempts to block anti-virus software from receiving updates by blocking all outbound TCP connections on port 80 and port 443. With older revisions of this malware package, this functionality was delivered via a JScript file named bav01.js but in newer versions, this has been seen delivered by PowerShell in the fake PNG trpl.png (see Fake PNG PowerShell Delivery).

This installation script starts by creating a new folder (e.g. SystemConfigInfo000) to hold the files necessary for execution. The two files to be installed are WinDivert.dll and either WinDivert32.sys or WinDivert64.sys, depending on the host CPU architecture. These are the legitimate WinDivert binaries and are used by the malware to create its packet filter.

The WinDivert binaries are embedded in bav01.js as comments and written to disk with .b64 extensions. The following is the code to retrieve the embedded resource named arch5 from the script, embedded in a comment block in the format /*[<resource name>[resource data]]*/:
Each WinDivert binary is then decoded from base64 using the Windows Certificate Services utility certutil.exe. For example:
This script is set to execute as a task each time the computer starts. This is accomplished by creating a scheduled task with a random-looking service name that is set to run as the SYSTEM user at the highest run level:
Next, the following PowerShell command is executed (shown here decoded) to execute the base64 encoded PowerShell commands in the environment variable 'nttyuuyt':
The 'nttyuuyt' environment variable was set by bav01.js previously and contains a base64 encoded PE and the PowerShell commands necessary to reflectively inject this executable (truncated for readability):
At this point in the script, installation is complete and the PE-based module to block anti-virus HTTP/HTTPS connections is loaded.

To achieve its anti-virus blocking, the reflectively loaded PE periodically checks the names of all running processes against a predefined list. If any process names appear in the list, the PIDs are added to the filter string passed to WinDivertOpen which will block all traffic to that process on remote ports 80 or 443. An example filter string is:

((processId=620 or processId=736) and (remotePort==80 or remotePort==443))

Example process names that would be blocked include msmpeng.exe (Windows Defender) and svchost.exe.

Click Fraud

The all_socks component is a NodeJS-based Socket.IO client that is commanded to navigate to arbitrary web pages by the attacker ostensibly for monetization and click fraud purposes. With older revisions of this malware package this functionality was delivered via a JScript file named either 04sall.js or 05sall.js, but in newer versions this has been seen delivered by PowerShell in the fake PNG strpk.png (see Fake PNG PowerShell Delivery).

Like the anti-virus blocking component, the click fraud component makes use of the WinDivert library and therefore installs the necessary WinDivert DLL and driver in the same manner as bav01.js, described above. Additionally, the NodeJS executable and a NodeJS Socket.IO client named app.js are part of the installation process for this component. Older versions of this component also installed two executables, divergent.exe and mdivergent.exe, however in later versions, these are executed from memory via reflective PE injection.

The malicious NodeJS application, seen either as app.js or init.js, is a simple Socket.IO client that takes a base64 encoded IP address as its only parameter.

node.exe app.js <base64 encoded IP>

In all samples we have encountered, the IP address has been 176.9.117.194 (encoded as MTc2LjkuMTE3LjE5NA==). Upon execution, the malicious NodeJS app will make a request to the IP passed as a parameter:
The response from this server is the address of the next server which the application will connect to. This new connection uses Socket.IO web sockets to maintain continuous communication between the victim and the server so the server can periodically send commands. The commands sent from this second server contain the host address of an advertisement revenue service and the entire HTTP request that should be made to that server, effectively faking a click on an advertisement link.
To protect themselves from these kinds of fraudulent requests, advertisement monetization services may go to extra lengths to confirm the device making the request is the type of device it claims to be. For example, if the monetization service only expects mobile devices, it may reject requests that have the characteristics of desktop devices. We believe the divergent.exe and mdivergent.exe executables are used by the 04sall.js/05sall.js components to circumvent these kinds of checks (see TCP/IP stack fingerprinting).

The divergent and mdivergent PEs make use of the WinDivert library to intercept and rewrite the first SYN packet of the 3-way TCP handshake for all outgoing connections the infected host attempts to make. The changes made to the SYN packets depend on which executable was used, either divergent.exe or mdivergent.exe; divergent.exe will rewrite the TCP header options to follow the same format as Android devices while mdivergent.exe will rewrite the TCP header options to follow the format as iOS devices. Which version of the divergent executable is used is dependent on the app.js deployment script (either 04sall.js or 05sall.js). These scripts contain code that decides which version should be used depending on a variable named macchance which can be passed to the deployment script as its only parameter. This variable contains the probability that mdivergent.exe will be deployed instead of divergent.exe (the PowerShell parameter, normally base64 encoded, is shown here in its decoded form):
In the code shown above, the variables and and mac correspond to the code necessary to reflectively inject divergent.exe and mdivergent.exe respectively, i.e. and represents Android and mac represents iOS.

For either of these divergent executables to work properly, several changes to the TCP/IP stack on the infected machine must be made; these include setting the TTL to 64, turning on the timestamp TCP header options, and changing the MTU to 1440. Once those changes have been made, the system is forced to reboot with a false message of Critical_Windows_Update:
With these changes made, the divergent executables can perform the necessary modifications to each SYN packet so that they follow the standards of the device the host should be disguised as.

Now I See You

The component named call_03 by the malware's configuration file, which is delivered by the em_02.js and em_03.js scripts, appears to be a means of installing a remote assist tool on the infected machine that would allow the attacker to view and possibly control the victim's computer.

Like the previous components, the PE associated with em_03.js is executed via reflective PE injection, this time with the environment variable fdghjgfdhj.
The PE to be injected is a DLL which, according to its export table, was originally called now_i_see_you.dll. This DLL has a single exported function named VoidFunc which contains all of its functionality. When VoidFunc is executed, it makes an HTTP GET request to the hxxps://uoibppop[.]tk/. It then takes the response from this server and treats it as a new URL to navigate to. Using COM objects, the DLL launches an instance of Internet Explorer, resizes the window to fit the entire screen and navigates to the URL in the response. At the time of analysis, the server was active but did not respond with any data so we were unable to confirm what was being hosted there.

Additionally, the DLL hides the Windows taskbar so the user is more compelled to comply with any instructions on the page that is presented to them. Next, the malware enters a loop looking for a process containing the string gotoassist (older versions also looked for teamviewer), ostensibly for confirming that the user followed the instructions in Internet Explorer by downloading and running the attacker's malware. Once this process is running, the Windows Taskbar is restored to view. A process list is gathered and sent to the URL hxxps://uoibppop[.]tk/clean; no response is expected from the server. The registry key `HKEY_CURRENT_USER\Software\fbsjbdfhsv` is created and the key value `weqr` is set to 1, indicating that execution was successful, then the process exits. Instead of a URL, the attacker has the option to send the word stop to the victim which will cause the DLL to forcefully reboot the infected machine.

While we do not know what URL the victim is intended to navigate to and therefore which program they are to be tricked into running, based on the process names gotoassist and teamviewer and the original DLL name of now_i_see_you.dll, it is likely that the victim is intended to install one of these remote administration software.

Fake PNG PowerShell delivery

Newer versions of the Divergent malware package no longer deliver and execute components as JScript, instead multi-stage PowerShell scripts are used. The first stage will retrieve the second stage from a static URL. The first-stage PowerShell is heavily obfuscated:
Here is our deobfuscated version:
While the requested resource features the extension normally associated with PNG images, it is actually malicious Powershell that has been encrypted using RC4 with the encryption key "raimeey2nu," which was stored in the previous PowerShell (the particular implementation of RC4 used can be found here).

We have encountered following URLs to retrieve the encrypted PowerShell:

• hxxp://1292172017[.]rsc.cdn77[.]org/images/trpl.png
• hxxp://1292172017[.]rsc.cdn77[.]org//imtrack/strkp.png

The first URL delivers the PowerShell version of bav01.js and the second delivers the PowerShell version of 05sall.js.

Taking a deeper look at the PowerShell version of 05sall.js, we see Base64 encoded blobs corresponding to binaries associated with WinDivert. Like its JScript counterpart, the Powershell decodes these blobs and saves them to the filesystem location defined by the environment variable %ALLUSERSPROFILE%.
Shellcode stored within the PowerShell is loaded into a new memory region using the Windows API function VirtualAlloc and then executed to continue the infection process:

Conclusion

The malware loader described is currently under active development. Talos has observed multiple versions of the loader being used to install the Divergent malware. Attackers are attempting to monetize these infections through the use of click fraud. The threat landscape is constantly evolving as attackers test new techniques and methodologies to maximize their revenue generation capabilities. Organizations should be aware of these changes and ensure that their security programs are able to remain effective against these changing tactics, techniques, and procedures. This threat is successfully stopped by the Cisco Advanced Malware Protection (AMP) Exploit Prevention engine, and the resulting event data assisted with our analysis of the threat. Talos will continue to monitor the threat landscape to ensure that customers remain protected.

Coverage

Additional ways our customers can detect and block this threat are listed below.


Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Indicators of Compromise (IOCs)

The following IOCs have been observed as being associated with these malware campaigns.

HTA Hashes:

47b5dac9152220fbbf122eff89ac93d42e9196f5ab665a2a6d99594246ab8a81
062688aec1bdf1208bd72a77696e1fbcd1076f54bd6e59141ed12b6f8e3ba32c

PE32 Hashes:

c7052f4676102bfe39ab19c227832861caa2959933e296ee1806973619948624
781adc919a705ca3e8a82fe1d1eac68f651c50ba402172aea033eaec7879e932
05fbd38ea0b99621d22ce5f057173fdec40f3dccd63f887e1c301766c6597714
2135acda2d2739773fbb827e8d180ac901c040d2f071127bb597a714591672cd
72b6a8bf9598bd445e26a04ab58be62ed3941fb1fe4cf4a094a6272a77b66009
ba04eacaa80bb5da6b02e1e7fdf3775cf5a44a6179b2c142605e089d78a2f5b6
a82dd93585094aeba4363c5aeedd1a85ef72c60a03738b25d452a5d895313875
2f4a9ef2071ee896674e3da1a870d4efab4bb16e2e26ea3d7543d98b614ceab9
77498f0ef4087175aa85ce1388f9d02d14aaf280e52ce7c70f50d3b8405fea9f
b2d29bb9350a0df93d0918c0208af081f917129ee46544508f2e1cf30aa4f4ce
bf2cdd1dc2e20c42d2451c83b8280490879b3515aa6c15ab297419990e017142
ba04eacaa80bb5da6b02e1e7fdf3775cf5a44a6179b2c142605e089d78a2f5b6
a7656ccba0946d25a4efd96f4f4576494d5f1e23e6ad2acc16d2e684656a2d4f
607b2f3fd1e73788a4d6f5a366c708dbb12d174eba9863ade0af89ca40e1fdba

URLs:

hxxps://1292172017[.]rsc[.]cdn77[.]org/images/trpl.png
hxxps://1292172017[.]rsc[.]cdn77[.]org/imtrack/strkp.png

Mutexes:

Global\Divergent
Global\CreatorsPatch
Global\LocalLow7

IP Addresses:

95[.]70[.]244[.]209
13[.]228[.]224[.]121
54[.]241[.]31[.]99
103[.]31[.]4[.]11
103[.]31[.]4[.]54
198[.]41[.]128[.]74
198[.]41[.]128[.]55
131[.]0[.]72[.]36
131[.]0[.]72[.]59
188[.]114[.]96[.]87
188[.]114[.]96[.]116
43[.]250[.]192[.]98
43[.]250[.]192[.]87
217[.]160[.]231[.]125
208[.]91[.]197[.]25
184[.]168[.]221[.]42
103[.]224[.]248[.]219
31[.]31[.]196[.]120
217[.]160[.]223[.]93
103[.]224[.]248[.]219
184[.]168[.]221[.]45
119[.]28[.]87[.]235
23[.]227[.]38[.]32
50[.]63[.]202[.]39
216[.]239[.]34[.]21
83[.]243[.]58[.]172
5[.]9[.]41[.]178
88[.]198[.]26[.]25
62[.]75[.]189[.]110
109[.]239[.]101[.]62
107[.]186[.]67[.]4
184[.]168[.]221[.]63
45[.]55[.]154[.]177
104[.]28[.]2[.]169
202[.]56[.]240[.]5
89[.]163[.]255[.]171
185[.]243[.]114[.]111

Aleksandar Nikolic of Cisco Talos discovered this vulnerability.

Foxit PDF Reader contains a remote code execution vulnerability in its JavaScript engine. Foxit aims to be one of the most feature-rich PDF readers on the market, and contains many similar functions to that of Adobe Acrobat Reader. The software uses JavaScript at several different points when opening a PDF. A bug exists in the JavaScript reading function that results in a large amount of memory to be allocated, which quickly uses up all available memory. An attacker could exploit this vulnerability to then gain the ability to remotely execute code.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Foxit to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Foxit PDF Reader JavaScript Array.includes remote code execution vulnerability (TALOS-2019-0793/CVE-2019-5031)

An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted PDF document can trigger an out-of-memory condition which isn't handled properly, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that Foxit PDF Reader, version 9.4.1.16828 is affected by this vulnerability.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 49648, 49649

By Warren Mercer and Paul Rascagneres.

Introduction

Cisco Talos recently observed attackers changing the file formats they use in an attempt to thwart common antivirus engines. This can happen across other file formats, but today, we are showing a change of approach for an actor who has deemed antivirus engines perhaps "too good" at detecting macro-based infection vectors. We've noticed that the OpenDocument (ODT) file format for some Office applications can be used to bypass these detections. ODT is a ZIP archive with XML-based files used by Microsoft Office, as well as the comparable Apache OpenOffice and LibreOffice software.

There have recently been multiple malware campaigns using this file type that are able to avoid antivirus detection, due to the fact that these engines view ODT files as standard archives and don't apply the same rules it normally would for an Office document. We also identified several sandboxes that fail to analyze ODT documents, as it is considered an archive, and the sandbox won't open the document as a Microsoft Office file. Because of this, an attacker can use ODT files to deliver malware that would normally get blocked by traditional antivirus software.

We only found a few samples where this file format was used. The majority of these campaigns using malicious documents still rely on the Microsoft Office file format, but these cases show that the ODT file format could be used in the future at a more successful rate. In this blog post, we'll walk through three cases of OpenDocument usage. The two first cases targets Microsoft Office, while the third one targets only OpenOffice and LibreOffice users. We do not know at this time if these samples were used simply for testing or a more malicious context.

Case study No. 1: ODT with OLE object and HTA script

The first campaign we'll look at used malicious ODT documents with an embedded OLE object. A user must click on a prompt to execute the embedded object. We saw attackers use this methodology to target both Arabic and English-speaking users.



In both campaigns, the OLE Object deployed an HTA file and executed it:



The two HTA scripts downloaded a file on top4top[.]net. This website is a popular Arabic file-hosting platform:



The two campaigns downloaded a remote administrative tool (RAT). In the Arabic campaign, the payload is the longstanding NJRAT malware. The C2 server in this case is amibas8722[.]ddns[.]net, which pointed to an Algerian ISP:



RevengeRAT was the payload in the English campaign, with its C2 server hidden behind the portmap platform (wh-32248[.]portmap[.]io). The PE is stored in registry and executed with a scheduled task and PowerShell script:



The operating mode is similar to the one we previously published here. In both cases, the same RAT with the same patches, the payload is stored in the registry, a PowerShell script decodes and executes it and, finally, the Portmap platform hides the final IP of the attacker infrastructure. Based on these elements, we assess with medium confidence that these two cases are linked by the same actor or framework.

Case study No. 2: ODT with OLE object and embedded malware

In the second case, the ODT file also contains an OLE object:

$ unzip -l 80c62c646cce264c08deb02753f619da82b27d9c727e854904b9b7d88e45bf9e
Archive:  80c62c646cce264c08deb02753f619da82b27d9c727e854904b9b7d88e45bf9e

Length      Date    Time    Name
---------  ---------- -----   ----

39  1980-01-01 00:00   mimetype
1540  1980-01-01 00:00   settings.xml
805  1980-01-01 00:00   META-INF/manifest.xml
1026  1980-01-01 00:00   meta.xml
491520  1980-01-01 00:00   Object 1
17784  1980-01-01 00:00   ObjectReplacements/Object 1
3354  1980-01-01 00:00   content.xml
6170  1980-01-01 00:00   styles.xml

---------                     -------
522238                     8 files

Again, this document requires user interaction. The OLE execution writes "Spotify.exe" to the victim machine, which is clearly not the legitimate Spotify platform executable. This .NET binary deflates a new binary stored as a resource. The new PE is a new binary packed with a multitude of different packers such as Goliath, babelfor.NET and 9rays.



Once all the layers are unpacked, the final payload is AZORult. We can see the infamous strings of this stealer in the final binary:

Case study No. 3: ODT with StarOffice Basic

We also discovered a third campaign that targeted OpenOffice and LibreOffice, but not Microsoft Office. In this case, the attackers used the equivalent of macros in Microsoft Office documents in the StarOffice Basic open-source software. StarOffice Basic's code is located in the Basic/Standard/ repository inside the ODT archive:

$ unzip -l 525ca043a22901923bac28bb0d74dd57
Archive:  525ca043a22901923bac28bb0d74dd57

Length      Date    Time    Name
---------  ---------- -----   ----
0  2019-08-19 12:53   Thumbnails/
728  2019-08-19 12:52   Thumbnails/thumbnail.png
10843  2019-08-19 12:52   styles.xml
0  2019-08-19 12:53   Basic/
0  2019-08-19 13:22   Basic/Standard/
1317  2019-08-19 13:00   Basic/Standard/Module1.xml
348  2019-08-19 12:52   Basic/Standard/script-lb.xml
338  2019-08-19 12:52   Basic/script-lc.xml
8539  2019-08-19 12:52   settings.xml
0  2019-08-19 12:53   Configurations2/
0  2019-08-19 12:53   Configurations2/accelerator/
0  2019-08-19 12:52   Configurations2/accelerator/current.xml
0  2019-08-19 12:53   META-INF/
1390  2019-08-19 12:52   META-INF/manifest.xml
899  2019-08-19 12:52   manifest.rdf
1050  2019-08-19 12:52   meta.xml
39  2019-08-19 12:52   mimetype
3297  2019-08-19 12:52   content.xml
---------                     -------
28788                     18 files

Here is an example:



The code downloads and executes a binary called "plink." The software creates SSH communications. The IP is a local network IP and not an IP available on the internet, which is interesting because the other documents we identified download an executable from the local network. We do not know if it is a test, a pentest framework, or if it was used in a specific context. There is the possibility that an actor could use this to carry out additional lateral movement within an already compromised environment.

We identified attempts to download Metasploit payloads:



And finally, some more obfuscated versions using WMI in order to execute the downloaded payload:



These samples only targets users using OpenOffice and StarOffice. We still do not know the final payload or the context under which this document was deployed.

Conclusion

Microsoft Office is a commonly attacked platform and is considered the most popular productivity suite on the market. This, similarly to the Microsoft Windows operating system, makes it a prime target for threat actors.

By attacking known platforms, attackers increase their chances of gaining access to machines. And the use of the ODT file format shows that actors are happy to try out different mechanisms of infection, perhaps in an attempt to see if they are these documents have a higher rate of infection or are better at avoiding detection. As we point out some AV engines and sandboxes do not handle these file formats with the appropriate method so they become "missed" in some instances. Whilst less people may avail of these pieces of software the actor may have a higher success rate due to low detections. The potential for specifically targeted attacks can also increase with the use of lesser used file formats. This can be coupled with OSINT from an attacker to understand who has potentially began to use LibreOffice formats by referring to the LibreOffice public migration page here, whilst this is a nice feature to show the uptake in their software it also leaves a valuable piece of information pertaining to what infrastructures are running their software.

Coverage

Intrusion prevention systems such as SNORT® provide an effective tool to detect this activity due to specific signatures present at the end of each command. In addition to intrusion prevention systems, it is advisable to employ endpoint detection and response tools (EDR) such as Cisco AMP for Endpoints, which gives users the ability to track process invocation and inspect processes. Try AMP for free here.

Additional ways our customers can detect and block these threats are listed below.



Cisco Cloud Web Security (CWS) orWeb Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such asNext-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source SNORTⓇ Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

IOCs

Case #1

ODT Documents:

de8e85328b1911084455e7dc78b18fd1c6f84366a23eaa273be7fbe4488613dd
f24c6a56273163595197c68abeab7f18e4e2bedd6213892d83cdb7a191ff9900

PE:

02000ddf92ceb363760acc1d06b7cd1f05be7a1ca6df68586e77cf65f4c6963e
19027327329e2314b506d9f44b6871f2613b8bb72aa831004e6be873bdb1175d

C2 servers:

wh-32248[.]portmap[.]io
amibas8722[.]ddns[.]net

Payload storage:

top4top[.]net

Case #2

ODT document: 80c62c646cce264c08deb02753f619da82b27d9c727e854904b9b7d88e45bf9e

PE: 20919e87d52b1609bc35d939695405212b8ca540e50ce8bece01a9fccfa70169

Case #3

2f4aa28974486152092669c85d75232098d32446adefeeef3a94ad4c58af0fc8
d099eac776eabf48f55a75eb863ad539a546202da02720aa83d88308be3ce4ca
84cb192cc6416b20293dfb8c621267e1584815a188b67757fa0d1af29a7cfdcd
b2b51864fa2f80f8edbdaf6721a6780e15a30291a748c2dfc52d574de0d8c3ed
f9138756639104e2c392b085cc5a98b1db77f0ed6e3b79eacac9899001ed7116
efb81fb8095319f5ee6fd4d6741b80386a824b9df05460d16d22cad1d6bbb35d
f5194cc197d98ed9078cceca223e294c5ec873b86cbeff92eb9eaca17fc90584
429d270195bed378495349cf066aee649fd1c8c450530d896844b1692ddddc77

By Jon Munshaw.

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday discloses 60 vulnerabilities, nine of which are considered "critical," with the rest being deemed "important."

This month’s security update covers security issues in a variety of Microsoft services and software, the Chakra Scripting Engine, the Windows operating system and the SharePoint software.

Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post here.

Critical vulnerabilities

Microsoft disclosed nine critical vulnerabilities this month, eight of which we will highlight below.

CVE-2019-1333 is a client-side remote execution vulnerability in Remote Desktop Services (RDP) that occurs when a user visits a malicious server. An attacker could exploit this vulnerability by having control of a malicious server, and then convincing the user to connect to it — likely via social engineering or a man-in-the-middle attack. An attacker could also compromise a legitimate server and then host malicious code on it, waiting for a user to connect. If successful, the attacker could gain the ability to remotely execute code on the victim machine that connected to the server.

CVE-2019-1238 and CVE-2019-1239 are remote code execution vulnerabilities that exist in the way VBScript handles objects in memory. These bugs all could lead to memory corruption in a way that would allow an attacker to execute arbitrary code on the victim machine. An attacker could exploit these vulnerabilities by tricking a user into visiting a specially crafted, malicious website through Internet Explorer. They could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that utilizes the Internet Explorer rendering engine.

CVE-2019-1307, CVE-2019-1308, CVE-2019-1335 and CVE-2019-1366 are all memory corruption vulnerabilities in the Chakra Scripting Engine inside of the Microsoft Edge web browser. An attacker could use these bugs to corrupt memory on the victim machine in a way that would allow them to remotely execute arbitrary code. A user could trigger these vulnerabilities by visiting a specially crafted, malicious website in Edge.

CVE-2019-1372 is an elevation of privilege vulnerability on Azure Stack when the Azure App Service fails to properly check the length of a buffer prior to copying memory to it. An attacker could exploit this vulnerability to copy any function run by the user, thereby executing code in the context of NT AUTHORITY/system, which could allow the attacker to escape a sandbox.

There is also CVE-2019-1060, a remote code execution vulnerability in  Microsoft XML Core Services.

Important vulnerabilities

This release also contains 51 important vulnerabilities.

• CVE-2019-0608
• CVE-2019-1070
• CVE-2019-1166
• CVE-2019-1230
• CVE-2019-1311
• CVE-2019-1313
• CVE-2019-1314
• CVE-2019-1315
• CVE-2019-1316
• CVE-2019-1317
• CVE-2019-1318
• CVE-2019-1319
• CVE-2019-1320
• CVE-2019-1321
• CVE-2019-1322
• CVE-2019-1323
• CVE-2019-1325
• CVE-2019-1326
• CVE-2019-1327
• CVE-2019-1328
• CVE-2019-1329
• CVE-2019-1330
• CVE-2019-1331
• CVE-2019-1334
• CVE-2019-1336
• CVE-2019-1337
• CVE-2019-1338
• CVE-2019-1339
• CVE-2019-1340
• CVE-2019-1341
• CVE-2019-1342
• CVE-2019-1343
• CVE-2019-1344
• CVE-2019-1345
• CVE-2019-1346
• CVE-2019-1347
• CVE-2019-1356
• CVE-2019-1357
• CVE-2019-1358
• CVE-2019-1359
• CVE-2019-1361
• CVE-2019-1362
• CVE-2019-1363
• CVE-2019-1364
• CVE-2019-1365
• CVE-2019-1368
• CVE-2019-1369
• CVE-2019-1371
• CVE-2019-1375
• CVE-2019-1376
• CVE-2019-1378

Jared Rittle and Patrick DeSantis of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
There are several vulnerabilities in the Schneider Electric Modicon M580 that could lead to a variety of conditions, the majority of which can cause a denial of service. The Modicon M580 is the latest in Schneider Electric's Modicon line of programmable automation controllers. The majority of the bugs we will discuss exist in the Modicon's use of FTP.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Schneider Electric to ensure that these issues are resolved and that an update is available for affected customers. Talos previously disclosed a separate round of vulnerabilities in this product in June.

Vulnerability details

Versions affected

Cory Duplantis and Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities.

Cisco Talos recently discovered multiple remote code execution vulnerabilities in NitroPDF. Nitro PDF allows users to save, read, sign and edit PDF files on their machines. There are two versions of the product: a free and a paid version called “Pro.” The paid version offers several features the free one does not, including the ability to combine multiple PDFs into one file and to redact sensitive information in the file. These bugs all exist in the Pro version of the software.

In accordance with Cisco's vulnerability disclosure policy, we are disclosing these vulnerabilities without a patch from NitroPDF due to the expiration of our 90-day deadline.

Vulnerability details

NitroPDF jpeg2000 ssizDepth remote code execution vulnerability (TALOS-2019-0814/CVE-2019-5045)

A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.

Read the complete vulnerability advisory here for additional information.

NitroPDF Page Kids remote code execution vulnerability (TALOS-2019-0819/CVE-2019-5050)

A specifically crafted PDF file can lead to a heap corruption vulnerability when opened in NitroPDF, version 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.

Read the complete vulnerability advisory here for additional information.

NitroPDF ICCBased color space remote code execution vulnerability (TALOS-2019-0817/CVE-2019-5048)

A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.

Read the complete vulnerability advisory here for additional information.

NitroPDF CharProcs remote code execution vulnerability (TALOS-2019-0816/CVE-2019-5047)

An exploitable use-after-free vulnerability exists in the CharProcs-parsing function of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a use after free. An attacker can craft a malicious PDF to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

NitroPDF jpeg2000 yTsiz remote code execution vulnerability (TALOS-2019-0815/CVE-2019-5046)

A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.

Read the complete vulnerability advisory here for additional information.

NitroPDF stream length memory corruption vulnerability (TALOS-2019-0830/CVE-2019-5053)

An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a use-after-free condition. An attacker can craft a malicious PDF to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that version NitroPDF, version 12.12.1.522 is affected by these vulnerabilities.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 49906 - 49911, 49948 - 49950

By Jon Munshaw

Researchers from Cisco Talos brought up the top award at this year’s Virus Bulletin conference.

Talos received the Péter Ször Award— named for the prolific security researcher who was a longtime contributor to Virus Bulletin and passed away in 2013 — for our research into several DNS-related attacks over the past year.


The award “aims to recognize the best piece of technical security research published each year,” according to Virus Bulletin, and was awarded at the annual Virus Bulletin conference last week. It is widely considered the most prestigious award in the field of threat research. Szor was one of the pioneers of malware research, publishing several original findings on threat hunting and spending time working at Symantec, McAfee and Pasteur AntiVirus. Talos researchers Paul Rascagneres and Warren Mercer were in attendance to receive the award, and also presented their research at the conference.



Virus Bulletin specifically honored Talos for the article “DNS hijacking abuses trust in core internet service,” which covered the campaign we called “Sea Turtle.” In the post, we outlined the work of a state-sponsored attacker that manipulated DNS to unknowingly send users to malicious websites.

“This research not only details the specific activities of the Sea Turtle actor, it also highlights the weak spot DNS is in the global internet infrastructure,” Martijn Grooten, the editor of Virus Bulletin, said. “Though the award is given for this specific research, one should also note that these authors are very prolific contributors to the threat intelligence conversation.”

DNS is a major foundation of the internet, and any attacks on it or manipulation of that system have the potential to undermine the trust users have in the internet. Based off this attack, we emphasized that nation-states should avoid targeting DNS as part of any cyber attacks, and called on world governments and the security industry to agree on the standard that DNS and the organizations that control it are off-limits, and to push back against any attackers that target the system.

Sea Turtle targeted public and private entities primarily located in the Middle East and North Africa, even going after national security organizations. Talos believes these attacks could have begun as early as January 2017. At least 40 different organizations across 13 countries were compromised during this campaign.

The actors behind Sea Turtle used DNS hijacking to trick users into visiting malicious websites. In these kinds of campaigns, the attackers illicitly modify DNS name records to point users to an actor-controlled server. The Department of Homeland Security even issued an alert on these kinds of attacks on Jan. 24, warning that an attacker could redirect user traffic and obtain users’ encryption certificates to then re-use inside the user’s organization’s domain names.

This wouldn’t be Talos’ only foray into the world of DNS. In July, we discovered Sea Turtle was still active, utilizing a likely new DNS hijacking technique to go after additional victims. This time, Sea Turtle compromised a country’s code top-level domain (ccTLD) registry, which manages the DNS records for every domain that uses that country’s code. They then used that access to compromise additional government entities.

DNS attacks are not going to go away any time soon, and if actors continue down this path, it could be very dangerous for the internet at large. We appreciate Virus Bulletin highlighting the importance of this research and the hard work of all our researchers who assisted with it.

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

It’s that time again to update all your Microsoft products. The company released its monthly update Tuesday, disclosing more than 60 vulnerabilities in a variety of its products. This month’s security update covers security issues in a variety of Microsoft services and software, the Chakra Scripting Engine, the Windows operating system and the SharePoint software. We’ve got a rundown of the most important bugs here, and all our Snort coverage here.

We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.

P.S., we have to give ourselves a pat on the back for the researchers who took home the top honors at the Virus Bulletin conference, winning the Péter Ször Award.

Upcoming public engagements with Talos

Event: “It’s Never DNS…. It Was DNS: How Adversaries Are Abusing Network Blind Spots”  at SecureWV/Hack3rCon X
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Nov. 15 - 17
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.

Event: Talos at BSides Belfast 
Location: Titanic Belfast, Belfast, Northern Ireland
Date: Oct. 31
Synopsis: Several researchers from Talos will be on hand at BSides Belfast to deliver four different talks. Martin Lee will provide a general overview of the benefits of threat hunting, Nick Biasini and Edmund Brumaghin will walk through a recent wave of supply chain attacks, then, Brumahin and Earl Carter will deliver their “It’s Never DNS....It Was DNS” talk, and, finally, Paul Rascagneres walks through his recent research into attacks on iOS.

Cyber Security Week in Review

Title:Microsoft discloses 60 vulnerabilities as part of monthly security update
Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday discloses 60 vulnerabilities, nine of which are considered "critical," with the rest being deemed "important."
This month’s security update covers security issues in a variety of Microsoft services and software, the Chakra Scripting Engine, the Windows operating system and the SharePoint software.
Snort SIDs: 51733 - 51736, 51739 - 51742, 51781 - 51794

Title: Multiple vulnerabilities in Schneider Electric Modicon M580 
Description: There are several vulnerabilities in the Schneider Electric Modicon M580 that could lead to a variety of conditions, the majority of which can cause a denial of service. The Modicon M580 is the latest in Schneider Electric's Modicon line of programmable automation controllers. The majority of the bugs exist in the Modicon's use of FTP. Schneider Electric Modicon M580, BMEP582040 SV2.80, is affected by these vulnerabilities.
Snort SIDs: 49982, 49983

Most prevalent malware files this week

Recorded Sept. 27, 2019 

We are missing Matt and Joel this time, so Mitch, Craig and Nigel are taking you through this episode. We cover some recent posts from Talos with Divergent and Tortoiseshell. Turns out, people get a bit excited when you target U.S. veterans with malware — even other malware authors thinks that’s scummy. That takes us into a chat about social engineering in general, and we end up talking about some interesting stuff with unpatchable vulnerabilities and why deleting /var on install could be described as "a bad idea" for a Google Chrome update.

The timeline:

• 01:00 — Roundtable: Hammering off your thumb...guess who did that one?
• 09:30 — Divergent LO(BYOL)Bins: Bringing NodeJS with you does not a LOLbin make
• 19:45 — Tortoiseshell: Social engineering vets looking for jobs makes you a special kind of scumbag
• 34:00 — Social engineering and Newton’s third law
• 38:30 — Selecting VPN providers that don’t make you the product
• 45:00 — Unpatchable BootROM zero-day in iPhones, and let's delete /var!
• 52:30 — Closing shots and parting thoughts

Some other links:

• Divergent (Talos blog post)
• Tortoiseshell (Talos blog post)
• Unpatchable iPhone zero-day