I have downloaded this Microsoft shortcut malicious sample from Virustotal for analysis
After downloading, I renamed as sample.lnk. (Microsoft shortcut extension .LNK)
When I opened properties tab of this file, found below properties which clearly shows its now shortcut of any application but a PowerShell script which executed on opening.
Target Type: Application
Target: PowerShell scrip
Description: Windows PowerShell
I copied and pasted PowerShell script to text file.
Behavior of PowerShell script:
Download another PowerShell script out-763347625.ps1 from URL https[:]// latinotca-ar[.]com
I double click on it to check the behavior, a command prompt windows opened and closed.
I could see the PowerShell script executed and tried to connect to the URL. WireShark captured the network traffic.
The web site has taken down. I tried to open the URL in browser, URL is inaccessible.
I have used Oletools to analyse word document properties and analyse content.
This word document has VBA macros.
After parsing word document using olevba, this tells, file has suspicious hex string and Base64 strings.
And file has below macros,
LUDoB_BX.cls
fkkkCAk.bas
ZAAcAA.bas
And macros will auto execute on opening document
I start debugging macros in word document,
After Enable Editing, Open View Macros under View tab
Click on Edit and change autoopen() function to autoopen2().
There are many small chunks of Base64 strings which are concatenating and creating a PowerShell script I have captured the Base64 string in text file and tried to decode. I didn’t get the complete base64 but some part of it and can be recognized it is PowerShell script.
during debugging, I got the below values are stored in the variable YAAAAAA and it is reading registry key values.
while debugging, I captured traffic using WireShark and found, connection has been made to web site emseenerji[.]com at IP 94[.]73[.]147[.]237. URL is still alive and can be accessed.
The complete URL which was accessed by this program http:// emseenerji[.]com/wp-content/RRKu/
My host machine AV blocked this URL and I couldn’t analyze traffic further from this URL to my VM.
