Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
High
Analysis Summary
A new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on the research It’s clear that this adversary spent time understanding the victims’ network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks.
The attackers’ first attempt to compromise the user involved two malicious websites that mimicked legitimate sites that host job listings:
These sites hosted a malicious Microsoft Office document: hxxp://hr-suncor[.]com/Suncor_employment_form[.]doc.
The document is a copy of a legitimate file available on the website for Suncor Energy, a Canadian sustainable energy company, and contains a malicious macro.
Upon opening the first Office document, the user receives a message that says “Content Mode Available:”
The macros of the analysed samples can be divided into two steps:
When the document is opened, the macro will decode a PE file encoded with base64 and will drop it in %UserProfile%.oracleServices\svshost_serv.doc
When the document is closed, the macro will rename the file “svshost_serv.doc” to “svshost_serv.exe.” Then, the macro creates a scheduled task named “chromium updater v 37.5.0” in order to execute the binary. The scheduled task is executed immediately and repeatedly every minute.
The purpose of these two steps is to avoid sandbox detection.
The payload is executed when Microsoft Office is closed, meaning it requires human interaction to deploy it. The macros, while available through analysis, are also password-protected in Microsoft Word to stop the victim from exploring the macro code via Microsoft Office.
Additionally, the macro uses classical string obfuscation in order to avoid strings detection.
Impact
Alters DNS records
Indicators of Compromise
IP(s) / Hostname(s)
URLs
Malware Hash (MD5/SHA1/SH256)
Remediation