• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-8109 – Bitdefender Engines denial of service
October 7, 2020
Rewterz Threat Alert – Latest AZORult IOCs
October 7, 2020

Rewterz Threat Alert – Hackers Abuse Windows Error Service in Fileless Malware Attack

October 7, 2020

Severity

High

Analysis Summary

A new attack called Kraken is discovered that injected its payload into the Windows Error Reporting (WER) service as a defense evasion mechanism. An unknown hacking group injected malicious code within the legitimate Windows Error Reporting (WER) service to evade detection as part of a fileless malware attack. Exploiting the WER service in attacks for defense evasion is not a new tactic but this campaign is most likely the work of a yet unknown cyber espionage group. That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.
This campaign is likely the work of an APT group that had earlier used a phishing attack enticing victims with a worker’s compensation claim. The threat actors compromised a website to host its payload and then used the CactusTorch framework to perform a fileless attack followed by several anti-analysis techniques. Some elements of the attack remind us of the Vietnamese APT32 group. This new attack started from a zip file containing a malicious document most likely distributed through spear phishing attacks. The document “Compensation manual.doc” pretends to include information about compensation rights for workers:

maldoc_.png


The file contains an image tag (“INCLDEPICTURE“) that connects to “yourrighttocompensation[.]com” and downloads an image that will be the document template.

Impact

  • Detection Evasion
  • Code Execution

Indicators of Compromise

Filename

  • Compensation manual[.]doc

Hostname

  • www[.]asia-kotoba[.]net
  • yourrighttocompensation[.]com

MD5

  • 0b82485b6bbb3aec9dba3bbbc5a4d04b
  • dfd2147a425cbb72759b0bb82523a2a0

SHA-256

  • 15a50bfe99cfe29da475bac45fd16c50c60c85bff6b06e530cc91db5c710ac30
  • 31368f805417eb7c7c905d0ed729eb1bb0fea33f6e358f7a11988a0d2366e942
  • d68f21564567926288b49812f1a89b8cd9ed0a3dbf9f670dbe65713d890ad1f4

SHA1

  • ed1b70f8a982410d23263574fc5b6c6eb2dc92db
  • 35a1d45faa068111902635eff0edd487b6d9585c

URL

  • http[:]//yourrighttocompensation[.]com/?rid=UNfxeHM
  • http[:]//yourrighttocompensation[.]com/ping
  • http[:]//www[.]asia-kotoba[.]net/favicon32[.]ico
  • http[:]//yourrighttocompensation[.]com/?rid=n6XThxD
  • http[:]//yourrighttocompensation[.]com/download/?key=15a50bfe99cfe29da475bac45fd16c50c60c85bff6b06e530cc91db5c710ac30&id=0
  • http[:]//asia-kotoba[.]net/favicon32[.]ico
  • http[:]//yourrighttocompensation[.]com/?rid=AuCllLU

Remediation

  • Block the threat indicators at their respective controls.
  • Keep all systems and software updated to latest patched versions.
  • Do not execute files accidentally downloaded from untrusted URLs. 
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.