Rewterz Threat Alert – TA2101 Plays Government Imposter to Distribute Ransomware

November 15, 2019

Severity

High

Analysis Summary

TA2101 is found targeting German companies and organizations to deliver and install backdoor malware. This actor is distributing Maze ransomware through Microsoft Word attachments, which when opened execute a Microsoft Office macro that, in turn, executes a PowerShell script, which downloads and installs the Maze ransomware payload onto the victim’s system.
The lure appears to be a notification of law enforcement activities (“aggiornamento: attivita di contrasto all’evasione”) and states that the recipient should open and read the enclosed document in order to avoid further tax assessment and penalties.

The emails, as part of a low-volume campaign across multiple verticals, were targeted primarily at manufacturing companies, businesses and IT service companies and used an infection chain of Microsoft Office macros into a PowerShell script, which ultimately downloads and installs Maze ransomware. Opening the Microsoft Word Document and enabling macros installs Maze ransomware on the user’s system, encrypting all of their files, and saves a ransom note resembling the following in TXT format in every directory.

Impact

Financial loss
Files Encryption

Indicators of Compromise

Domain Name

agenziaentrate[.]icu

From Email

antowortensienicht@bzst-infomieren[.]icu
info@agenziaentrate[.]icu
antwortensienicht@bzstinform[.]icu

MD5

80043a5b285da88fb63d469243655751
53d5bdc6bd7904b44078cf80e239d42b
ad30987a53b1b0264d806805ce1a2561
1ffecd461b3d4b65e44faff8537f68d6
c09af442e8c808c953f4fa461956a30f
ee26e33725b14850b1776a67bd8f2d0a
2fbd10975ee65845a18af6b7488a5236

SH256

44991186a56b0d86581f2b9cc915e3af426a322d5c4f43a984e6ea38b81b7bed
cfd8e3a47036c4eeeb318117c0c23e126aea95d1774dae37d5b6c3de02bdfc2a
9f2139cc7c3fad7f133c26015ed3310981de26d7f1481355806f430f9c97e639
5f1e512d9ab9b915b1fc925f546ed559cbfa49df53229e2f954a1416cf6f5ee4
97043f23defd510607ff43201bb03b9916a23bd71b5bdf97db357e5026732506
d617fd4b2d0824e1a7eb9693c6ec6e71447d501d24653a8e99face12136491a8
7e3ab96d2628e0a9970802b47d0356dc9b99994d7f98492d4e70a5384891695a

URL

hxxp[:]//198.50.168.67/wordpack[.]tmp
hxxp[:]//conbase.top/sys[.]bat
hxxp[:]//104.168.198[.]208/wordupd.tmp
hxxp[:]//104.168.215[.]54/wordupd.tmp
hxxp[:]//104.168.174[.]32/wordupd_3.0.1.tmp
hxxp[:]//192.119.68[.]225/wordupd1.tmp
hxxp[:]//108.174.199[.]10/wordupd3.tmp
hxxp[:]//54.39.233[.]175/wupd19823.tmp
hxxp[:]//54.39.233[.]131/word1.tmp
hxxp[:]//104.168.198[.]230/wordupd.tmp

Remediation

Block the threat indicators at their respective controls.
Do not download files attached in untrusted emails.
Do not enable macros for untrusted files.