Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer’s memory.
Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe.
The emails contained the recipients’ names as well as specific information about the companies they worked for, which is not typical of widespread spam campaigns. This attention to detail lent more credibility to spam messages and made it more likely that victims would open the attached documents, the researchers said.
The documents contained macros that, if allowed to run, execute a hidden instance of powershell.exe with special command-line arguments. Windows PowerShell is a task automation and configuration management framework that’s included in Windows by default and comes with its own scripting language.
The PowerShell command executed in this case was designed to check if the Windows OS was a 32-bit or a 64-bit version and to download an additional PowerShell script that corresponded to the OS architecture.
The rogue script performs a variety of checks on the computer. First it tries to determine if the environment is a virtual machine or sandbox like those used by malware analysts. It then scans the network configuration for strings like school, hospital, college, health and nurse. It also scans the network for other machines with names including teacher, student, schoolboard, pediatrics, orthoped, as well as POS, store, shop and sale. Cached URLs are scanned for a number of financial websites and names like Citrix and XenApp.
According to the Palo Alto researchers, the goal of these checks is to find systems that are used to conduct financial transactions and to avoid systems that belong to security researchers as well as medical and educational institutions.
Only systems that match what the attackers are looking for are flagged and reported back to a command-and-control server. For those systems, the script downloads a malicious encrypted DLL (dynamic link library) file and load it into memory.
“Due to the target-specific details contained within the spam emails and the use of memory-resident malware, this particular campaign should be treated as a high threat,” the Palo Alto researchers said in a blog post.
A similar combination of PowerShell and fileless malware was observed last week by researchers from the SANS Institute’s Internet Storm Center.
That malware creates a registry key that launches a hidden PowerShell instance at every system start-up. The PowerShell command executes an encoded script that’s stored in a separate registry key. Its goal is to decrypt and load an executable file directly into memory without ever writing it to disk.
“By using PowerShell the attackers have been able to put malware that might otherwise be detected on a hard drive into the Windows Registry,” senior SANS instructor Mark Baggett, said in a blog post.
Storing malicious code in the system registry, abusing the Windows PowerShell and adding malicious macros to documents are not new techniques. However, their combination can make for very potent and hard-to-detect attacks.