Tuesday, June 25, 2024

UNC1151 Hackers Weaponizing Excel Documents To Attack Windows Machine

Mandiant identified a UNC1151 information campaign targeting Ukraine, Lithuania, Latvia, and Poland with disinformation, as CRIL linked a recent malicious XLS campaign to UNC1151. 

The attackers used spam emails with Excel documents containing VBA macros that dropped LNK and DLL files, where executing the LNK loaded the DLL, likely infecting the system. 

The campaign differs from prior ones in that the DLL downloaded an encrypted JPG for final payload deployment. Here, an encrypted SVG is downloaded, suggesting a possible switch to a different final payload like AgentTesla, Cobalt Strike, or njRAT. 

Cyble vision Threat Library 

In 2023, a cyber campaign targeted Ukrainian and Polish entities. The campaign used weaponized Excel and PowerPoint files disguised as legitimate documents to trick users into enabling macros.

With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis

The macros then downloaded and executed obfuscated DLLs or downloaders, as encrypted payloads were hidden within seemingly harmless JPG image files, where these payloads deployed njRAT, AgentTesla, and Cobalt Strike for information theft and remote system access. 

Differences in the infection chain of the UNC1151 malware campaign 

A spearphishing attack targeted the Ukrainian military in April 2024, where emails containing a compressed archive were sent, including drone images and a malicious Excel spreadsheet (.xls) with a macro. 

When the user opens Excel and enables macros, a VBA macro drops a shortcut file (CybereasonActiveProbe.lnk) and a malicious DLL (F072d76c85A40hjf9a3c0ab.dll).

The macro then uses Rundll32.exe to execute the shortcut, which in turn launches the DLL with the SrvLicInitialize parameter through another Rundll32.exe call.  

Process tree

This malware campaign leverages an Excel document with enticing content in Ukrainian to trick users into enabling macros. Upon enabling macros, the VBA code drops an LNK shortcut and a malicious DLL file in specific user directories. 

The macro then executes the LNK using Rundll32.exe, which leverages Regsvr32.exe to launch the DLL file, achieving malicious behavior that creates a chain of execution disguised as legitimate Windows processes. 

Dropped LNK shortcut file 

The DLL loader, a malicious .NET file, first verifies the presence of specific processes and terminates itself if any are found.

Then, it modifies system security settings and downloads an encrypted DLL from a remote server. The downloaded DLL is decoded using Base64 and XOR decryption and then executed using Rundll32.exe. 

After execution, the malware sleeps and deletes the DLL, which is different from previous campaigns where the DLL was executed using Regsvr32.exe and employed plain strings for malicious operations.

TTP changes

According to Cyble, this year’s TTP attack campaign differs from last year’s in terms of final payload deployment. Both loader files in 2024 download an encrypted payload from a malicious SVG URL, while last year, the encrypted payload was a JPG file. 

The code for downloading the next stage using RuntimeBinder has become more complex.Binder functionality instead of the simpler Assembly.Load function, and the decrypted payload this year is a DLL launched using Rundll32.exe and the “SrvLicInitialize” parameter.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo 


Latest articles

Hackers Exploit Multiple WordPress Plugins to Hack Websites & Create Rogue Admin Accounts

Wordfence Threat Intelligence team identified a significant security breach involving multiple WordPress plugins. The initial...

Hackers Attacking Windows IIS Server to Upload Web Shells

Windows IIS Servers often host critical web applications and services that provide a gateway...

WikiLeaks Founder Julian Assange Released in Stunning Deal with U.S.

WikiLeaks founder Julian Assange has been released from prison after reaching a deal with...

Four Members of FIN9 Hackers Charged for Attacking U.S. Companies

Four Vietnamese nationals have been charged for their involvement in a series of computer...

BREAKING: NHS England’s Synnovis Hit by Massive Cyber Attack

In a shocking development, the NHS has revealed that it was the victim of...

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles