Cybercriminals using a malicious macro that changes the target of Desktop Shortcuts to download malware and when the user clicks on the altered shortcut file, the malware executes.
With this new campaign, attackers used common tools like WinRAR, and Ammyy Admin to gather information instead of their own tools.
Security researchers from Trend Micro uncovered the new campaign, the malware and macro are not sophisticated and researchers believe that malware development was not yet completed.
Malicious Macro Infection Chain
The attack starts with a malicious word document that contains contents written in Russian with a house image and it instructs users to enable macro’s to get the full document.
Once the user enables macro it searches for the shortcut files in desktop and replace’s with the corresponding linked files. It primarily targets file shortcut files that include Skype, Google Chrome, Mozilla Firefox, Opera, and Internet Explorer.
If the user executes the shortcut from the desktop shortcut or Quick launch bar it executes the malware instead of the original file.
Once the malware triggered it drops WpmPrvSE.exe in system32 or SysWoW64 depending on the operating system type and it starts up a service called WPM Provider Host, which allow’s application on your computer to request system information.
Along with WpmPrvSE.exe it also drops a rar.exe, possibly for later use and then it recovers’s the shortcut files to its original state again.
Researchers say that “While the malware is working, the malicious service that the malware activated would already be downloading the final payloads. It downloads a RAR archive from Google Drive and GitHub.”
The download RAR archive contains config file, key, and other tools, the installer file run through the certutil command-line program and also it decodes the wsvchost[.]key the file which is the actually a well-known remote desktop utility Ammyy Admin.
By installing Ammyy Admin on user’s system and granting full permission to attackers ID via malware, an attacker could get full system access through Ammyy Admin. Trend Micro published a detailed analysis report.
Microsoft has macro’s disabled by default an it is not recommended to enable and download macro for documents form unknow resources. Also, Microsoft shows warning while enabling macros.
Researchers said the malware is not widely distributed and it is still in the PoC stage and will have further versions.
Also Read
MyloBot – Highly Sophisticated Botnet Shutdown Windows Defender & Blocking Ports on the Firewall
GZipDe – A Sophisticated Malware Attack using Metasploit Backdoor with Encrypted Payload
