www.esentire.com Open in urlscan Pro
104.20.163.46  Public Scan

Form analysis
0 forms found in the DOM

Text Content

BLOG


FIN7 USES TRUSTED BRANDS AND SPONSORED GOOGLE ADS TO DISTRIBUTE MSIX PAYLOADS


BY eSentire Threat Response Unit (TRU)

May 8, 2024 | 6 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin





WANT TO LEARN MORE ON HOW TO ACHIEVE CYBER RESILIENCE?

TALK TO AN EXPERT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are
staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate,
contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks
in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical
Threat Response and Advanced Threat Analytics driven by our Threat Response Unit
– the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a
recent threat investigation. We outline how we responded to the confirmed threat
and what recommendations we have going forward.

Here’s the latest from our TRU Team…


WHAT DID WE FIND?

In April 2024, eSentire’s Threat Response Unit (TRU) observed multiple incidents
involving FIN7, a financially motivated threat group based in Russia that has
been active since 2013. The threat actors used malicious websites to impersonate
well-known brands, including AnyDesk, WinSCP, BlackRock, Asana, Concur, The Wall
Street Journal, Workable, and Google Meet.

In this TRU Positive, we will look at incident cases with FIN7 delivering
NetSupport RAT and DiceLoader for the subsequent stage in the infection chain.

Users visiting the malicious website via sponsored Google Ads would receive a
fake pop-up prompting them to download a fake browser extension (Figure 1). The
fake browser extension payload appears to be an MSIX file, a Windows app
packaging format.

Figure 1: Malicious website serving the malicious payload

We found other websites controlled by FIN7 impersonating trusted brands using
URLScan. You can find them here.

The MSIX files we have observed are signed with “SOFTWARE SP Z O O” and
“SOFTWARE BYTES LTD”. We submitted the request to GlobalSign to get the
certificates successfully revoked.


INFECTION CASE ONE

Let’s look at the first case involving the infection with NetSupport RAT.

Upon extracting the MSIX file, we see that it contains the malicious PowerShell
script (Figure 2).

Figure 2: Contents of the malicious MSIX file

The snippet of the malicious PowerShell script is shown below (Figure 3).

Figure 3: Snippet of the PowerShell payload (1)

The PowerShell script collects system information such as the OS version and
domain, retrieves the names of installed antivirus products, and generates a
GUID. It then constructs a URL incorporating these details to download and
Base64-decode a script from the C2 (Command and Control) server.

If the server response includes “usradm”, the script runs further commands to
retrieve payloads from the C2 server. Additionally, the script manages
exceptions during its execution and reports errors back to the C2 server via URL
parameters (Figure 4).

Figure 4: Snippet of the PowerShell payload (2)

The decoded script (Figure 5) downloads the NetSupport archive from the C2
server using a specific URL format:
hxxps://cdn46[.]space/974afa0a-d334-48ec-a0d4-4cc14efa730c-1d3d044a-e654-41e3-ad32-38a2934393e4?aklshdjahsjdh=25&ajhsdjhasjhd=nsd&iud=$iudValue
and user-agent “myUserAgentHere”.

Next, it extracts the contents of the zip file and stores the files under
C:\ProgramData\netsupport path. Finally, the script executes the extracted
NetSupport RAT executable.

Figure 5: The base64-decoded content


INFECTION CASE TWO

The infection chain for the second case is like the first one, the user visited
the malicious website meet-go[.]click to download a fake MSIX MeetGo installer.
The MSIX payload dropped NetSupport RAT on the user’s machine. The threat actor
connected to the machine approximately three hours later via NetSupport RAT. 

The threat actors used curl to retrieve csvde.exe (MD5:
b6f12d39edbfe3b33952be4329064b35) via hxxp://91.219.238[.]214:4673/01/csvde.exe,
which is a command-line tool for Windows that allows the import and export of
Active Directory data. The tool was used to execute the command:

 * csvde.exe  -r "(&(objectClass=Computer))" -l
   samAccountName,description,IPv4Address,info,operatingSystem -f 01cp.txt

The command exports data about computer objects into a text file (01cp.txt),
including specific attributes like the account name, description, IP address,
general info, and operating system details. Next, the threat actor used curl to
retrieve “Adobe_017301.zip” (MD5: e7b1fb0ef5dd20f4522945b902803f10) zip archive
via hxxp://91.219.238[.]214:4673/01/Adobe_017301.zip. 

The contents (Figure 6) of the zip file are then extracted to c:\programdata\
with the command:

 * tar  -zxvf c:\programdata\Adobe_017301.zip -C c:\programdata

svchostc.exe is the renamed python.exe file (MD5:
0740803404a58d9c1c1f4bd9edaf4186) and svchostc.py (MD5:
782621d1062a8fc7d626ceb68af314e5) is the Python payload.

Figure 6: Contents of Adobe_017301.zip

The threat actor then performed additional reconnaissance by running the command
“whoami /upn”, which displays the user principal name (UPN) of the currently
logged-in user.

The host's persistence is achieved via scheduled tasks. The threat actor created
the scheduled task “Updater” to run the Python payload “svchostc.py.”

 * SCHTASKS  /create /f /tn "Microsoft\Windows\Updater" /tr "cmd /c
   c:\programdata\Adobe_017301\svchostc.exe
   c:\programdata\Adobe_017301\svchostc.py" /sc minute /mo 1 /RU "NT
   AUTHORITY\SYSTEM"

The Python payload's decryption and execution are implemented in the lambda
function (_), which performs decryption operations such as string reversal and
base64 decoding.

zlib decompression to retrieve the original executable content (Figure 7).

Figure 7: Content of svchostc.py

The decrypted output would contain the encrypted DiceLoader payload and the
encrypted instructions to allocate memory with execute permissions, copy the
decrypted payload into memory, and create and execute a new thread that runs the
payload, effectively performing a process injection (Figure 8).

Figure 8: Decrypted code responsible for processing injection and memory
allocation

DiceLoader stores its C2 IPs and ports in the .data section. The data is XOR’ed
with a hardcoded key located within the same section (Figure 10).  

Figure 9: XOR key and encrypted data in DiceLoader payload

The incidents of FIN7 exploiting trusted brand names and using deceptive web ads
to distribute NetSupport RAT followed by DiceLoader highlight the ongoing
threat, particularly with the abuse of signed MSIX files by these actors, which
has proven effective in their schemes.


WHAT DID WE DO?

Our team of 24/7 SOC Cyber Analysts isolated the affected hosts and notified the
customer of suspicious activities.


WHAT CAN YOU LEARN FROM THIS TRU POSITIVE?

 * Users should exercise caution when clicking on sponsored Google Ads,
   understanding that even legitimate-looking advertisement links can redirect
   to harmful content.
 * The malicious websites impersonating reputable brands demonstrate the
   effectiveness of social engineering. Users should be cautious of downloading
   files from pop-up prompts, especially when browsing or redirected by ads.
 * The deceptive use of signed MSIX files underscores the need for vigilance
   even with seemingly legitimate files. Users should verify file sources and be
   skeptical of any unexpected download prompts.
 * The fact that the MSIX files were signed with company names but still
   contained malicious content highlights the importance of checking digital
   certificates and being aware that certification does not guarantee safety.


RECOMMENDATIONS FROM OUR THREAT RESPONSE UNIT (TRU):

We recommend implementing the following controls to help secure your
organization against FIN7:

 * Confirm that all devices are protected with Endpoint Detection and Response
   (EDR) solutions.
 * Implement a Phishing and Security Awareness Training (PSAT) Program that
   educates and informs your employees on emerging threats in the threat
   landscape.
 * Control MSIX execution via AppLocker.
 * Report certificate misuse.


INDICATORS OF COMPROMISE

You can access the indicators here.


REFERENCES

 * https://urlscan.io/search/#filename%3A%229e4e27b7-bcfb-4298-bf8f-2cf4a6bdb3bf-9b6b40d6-3f8e-4755-9063-562658ebdb95%22
 * https://github.com/esThreatIntelligence/iocs/blob/main/FIN7/FIN7_IOCs_5-3-2024.txt



ESENTIRE THREAT RESPONSE UNIT (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research
team committed to helping your organization become more resilient. TRU is an
elite team of threat hunters and researchers that supports our 24/7 Security
Operations Centers (SOCs), builds threat detection models across the eSentire
XDR Cloud Platform, and works as an extension of your security team to
continuously improve our Managed Detection and Response service. By providing
complete visibility across your attack surface and performing global threat
sweeps and proactive hypothesis-driven threat hunts augmented by original threat
research, we are laser-focused on defending your organization against known and
unknown threats.




READ THE LATEST FROM ESENTIRE

May 08, 2024

FIN7 USES TRUSTED BRANDS AND SPONSORED GOOGLE ADS TO DISTRIBUTE MSIX…

Learn More
May 08, 2024

SOCGHOLISH SETS SIGHTS ON VICTIM PEERS

Learn More
May 06, 2024

WELDING THE WEAK SPOTS: STRENGTHENING MANUFACTURING CYBERSECURITY…

Learn More

Cookies allow us to deliver the best possible experience for you on our website
- by continuing to use our website or by closing this box, you are consenting to
our use of cookies. Visit our Privacy Policy to learn more.

Accept
ARE YOU EXPERIENCING A SECURITY INCIDENT OR HAVE YOU BEEN BREACHED?
Call 1-866-579-2200


THE PROVEN CHOICE FOR
MANAGED DETECTION AND RESPONSE

GET STARTED → PARTNER LOGIN →


SALES AND
CUSTOMER SUPPORT

NORTH AMERICA 1-866-579-2200 EMEA (0)8000-443242 ANZ/APAC 1-519-651-2200

WHAT WE DO

Managed Detection and Response Digital Forensics and Incident Response Exposure
Management Services Extended Detection and Response (XDR) Security Operations
Center (SOC) Threat Response Unit (TRU) Cyber Resilience Team MDR for Microsoft
MDR for AWS Response and Remediation MDR Pricing

HOW WE DO IT

Network Endpoint Log Cloud Insider Threat

INDUSTRIES

Insurance Construction Finance Legal Manufacturing Private Equity Healthcare
Retail Food Supply Government and Education

USE CASES

Ransomware Third-Party Risk Sensitive Data Security Cloud Misconfiguration Zero
Day Attacks Cyber Risk Cybersecurity Compliance Do More With Less Cyber
Insurance

RESOURCES

Security Advisories Blog Resource Library Video Library TRU Intelligence Center
Case Studies Switch to eSentire Real vs Fake MDR Cybersecurity Glossary

TOOLS

Cybersecurity Assessment MDR ROI Calculator SOC Calculator MITRE ATT&CK® Tool

COMPANY

About Us Leadership Newsroom Event Calendar Careers Partners Australia & New
Zealand United Kingdom

2024 eSentire, Inc. All Rights Reserved.

Sitemap Terms and Conditions Privacy Policy Accessibility Legal
Get Started

What We Do
How We Do It
Resources
Company
Partners
Get Started
What we do
How we do it
Resources
Company
Partners
Get Started