Rewterz Threat Alert – Hackers Abuse Windows Error Service in Fileless Malware Attack

Severity

High

Analysis Summary

A new attack called Kraken is discovered that injected its payload into the Windows Error Reporting (WER) service as a defense evasion mechanism. An unknown hacking group injected malicious code within the legitimate Windows Error Reporting (WER) service to evade detection as part of a fileless malware attack. Exploiting the WER service in attacks for defense evasion is not a new tactic but this campaign is most likely the work of a yet unknown cyber espionage group. That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.
This campaign is likely the work of an APT group that had earlier used a phishing attack enticing victims with a worker’s compensation claim. The threat actors compromised a website to host its payload and then used the CactusTorch framework to perform a fileless attack followed by several anti-analysis techniques. Some elements of the attack remind us of the Vietnamese APT32 group. This new attack started from a zip file containing a malicious document most likely distributed through spear phishing attacks. The document “Compensation manual.doc” pretends to include information about compensation rights for workers:

The file contains an image tag (“INCLDEPICTURE“) that connects to “yourrighttocompensation[.]com” and downloads an image that will be the document template.

Impact

• Detection Evasion
• Code Execution

Indicators of Compromise

Filename

• Compensation manual[.]doc

Hostname

• www[.]asia-kotoba[.]net
• yourrighttocompensation[.]com

MD5

• 0b82485b6bbb3aec9dba3bbbc5a4d04b
• dfd2147a425cbb72759b0bb82523a2a0

SHA-256

• 15a50bfe99cfe29da475bac45fd16c50c60c85bff6b06e530cc91db5c710ac30
• 31368f805417eb7c7c905d0ed729eb1bb0fea33f6e358f7a11988a0d2366e942
• d68f21564567926288b49812f1a89b8cd9ed0a3dbf9f670dbe65713d890ad1f4

SHA1

• ed1b70f8a982410d23263574fc5b6c6eb2dc92db
• 35a1d45faa068111902635eff0edd487b6d9585c

URL

• http[:]//yourrighttocompensation[.]com/?rid=UNfxeHM
• http[:]//yourrighttocompensation[.]com/ping
• http[:]//www[.]asia-kotoba[.]net/favicon32[.]ico
• http[:]//yourrighttocompensation[.]com/?rid=n6XThxD
• http[:]//yourrighttocompensation[.]com/download/?key=15a50bfe99cfe29da475bac45fd16c50c60c85bff6b06e530cc91db5c710ac30&id=0
• http[:]//asia-kotoba[.]net/favicon32[.]ico
• http[:]//yourrighttocompensation[.]com/?rid=AuCllLU

Remediation

• Block the threat indicators at their respective controls.
• Keep all systems and software updated to latest patched versions.
• Do not execute files accidentally downloaded from untrusted URLs.