Hackers Increasing the use of “Command Line Evasion and Obfuscation” to Spread Advance Level Threats

Advance level threats are increasing day by day and attackers using more Sophisticated Techniques to bypass the Detection. Evasion and obfuscation technique give more pain to Researchers in 2017 Compare to previous years.

Command line evasion and obfuscation are the most used technique among many numbers of advance level attacks which are increased its use by attackers with their phishing and Malware attacks.

Malicious hackers use Fileless malware to achieve stealth, privilege escalation, to gather sensitive information and achieve persistence in the system, so the malware infection can continue to carry on its effect for a longer period of time.

More over sometime VB Script code aslo has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand

It used to create with Advanced level obfuscation to bypass both static and dynamic analysis method and attacker always on step ahead from  signature-based detection methods.

Also Read  Creating and Analyzing a Malicious PDF File with PDF-Parser Tool

Environment Variable Attack by Advance Level Threats

An earlier time of 2017 ,FIN8 malware received command using standard input to evade detection based on process command line arguments by using environment variables paired with Power Shell.

Powers hell command that ends with Dash “-“ ,that will Execute the command by using standard input (Stdin) and the only dash will appear in powershell.exe’s command line arguments.

FIN8 environment variable commands extracted (Source: FireEye)

According to FireEye , In the February 2017 phishing document “COMPLAINT Homer Glynn.doc” (MD5: cc89ddac1afe69069eb18bac58c6a9e4tt), the file contains a macro that sets the PowerShell command in one environment variable(_MICROSOFT_UPDATE_CATALOG) and then the string “powershell -” in another environment variable (MICROSOFT_UPDATE_SERVICE).

Evasion and obfuscation detection’s based parent-child process relationships. FIN8 crafted this macro to use WMI to spawn the “cmd.exe” execution.

Therefore, WinWord.exe never creates a child process, but the process tree looks like: wmiprvse.exe > cmd.exe > powershell.exe. 

Also Read  Most important considerations with Malware Analysis Cheats And Tools list

Application whitelisting Bypass

To stay away from many Detection techniques and Defenders, Attackers using extra layers of obfuscation by new application whitelisting bypass techniques.

According to FireEye , The regsvr32.exe  application whitelisting bypass exploit done by few Groups

1. APT19 in their 2017 campaign against law firms
2. The cyber espionage group APT32 heavily obfuscates their backdoors and scripts
3. Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017

Regsvr32 is a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry. Regsvr32.exe is installed in the %systemroot%\System32 folder in Windows XP and later versions of Windows.

APT32 used cmd.exe obfuscation techniques to attempt to break signature-based detection of this argument ,Instead of using the argument /i:https for the regsvr32.exe bypass.

FireEye Identified New obfuscation Technique in both JavaScript and cmd.exe levels and perform the initial infection, it hiding shortcut files (LNK files) in their DOCX and RTF phishing documents. Read more here for complete Analyse.