UNC1151 Hackers Weaponizing Excel Documents To Attack Windows Machine

Mandiant identified a UNC1151 information campaign targeting Ukraine, Lithuania, Latvia, and Poland with disinformation, as CRIL linked a recent malicious XLS campaign to UNC1151. 

The attackers used spam emails with Excel documents containing VBA macros that dropped LNK and DLL files, where executing the LNK loaded the DLL, likely infecting the system. 

The campaign differs from prior ones in that the DLL downloaded an encrypted JPG for final payload deployment. Here, an encrypted SVG is downloaded, suggesting a possible switch to a different final payload like AgentTesla, Cobalt Strike, or njRAT. 

In 2023, a cyber campaign targeted Ukrainian and Polish entities. The campaign used weaponized Excel and PowerPoint files disguised as legitimate documents to trick users into enabling macros.

With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis

The macros then downloaded and executed obfuscated DLLs or downloaders, as encrypted payloads were hidden within seemingly harmless JPG image files, where these payloads deployed njRAT, AgentTesla, and Cobalt Strike for information theft and remote system access. 

A spearphishing attack targeted the Ukrainian military in April 2024, where emails containing a compressed archive were sent, including drone images and a malicious Excel spreadsheet (.xls) with a macro. 

When the user opens Excel and enables macros, a VBA macro drops a shortcut file (CybereasonActiveProbe.lnk) and a malicious DLL (F072d76c85A40hjf9a3c0ab.dll).

The macro then uses Rundll32.exe to execute the shortcut, which in turn launches the DLL with the SrvLicInitialize parameter through another Rundll32.exe call.  

This malware campaign leverages an Excel document with enticing content in Ukrainian to trick users into enabling macros. Upon enabling macros, the VBA code drops an LNK shortcut and a malicious DLL file in specific user directories. 

The macro then executes the LNK using Rundll32.exe, which leverages Regsvr32.exe to launch the DLL file, achieving malicious behavior that creates a chain of execution disguised as legitimate Windows processes. 

The DLL loader, a malicious .NET file, first verifies the presence of specific processes and terminates itself if any are found.

Then, it modifies system security settings and downloads an encrypted DLL from a remote server. The downloaded DLL is decoded using Base64 and XOR decryption and then executed using Rundll32.exe. 

After execution, the malware sleeps and deletes the DLL, which is different from previous campaigns where the DLL was executed using Regsvr32.exe and employed plain strings for malicious operations.

According to Cyble, this year’s TTP attack campaign differs from last year’s in terms of final payload deployment. Both loader files in 2024 download an encrypted payload from a malicious SVG URL, while last year, the encrypted payload was a JPG file. 

The code for downloading the next stage using RuntimeBinder has become more complex.Binder functionality instead of the simpler Assembly.Load function, and the decrypted payload this year is a DLL launched using Rundll32.exe and the “SrvLicInitialize” parameter.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo