By Dylan Main, Cofense Phishing Defense Center

With widespread financial uncertainty and talks of further stimulus funding in the news, many are desperate for some form of monetary relief. Threat actors have begun taking advantage of this desperation by creating campaigns tailored to these uncertain times. The Phishing Defense Center (PDC) has discovered a phishing attack that attempts to obtain personal information by exploiting hopes for economic relief.  

Figure 1: Email Body 

The email itself presents itself as a reply to a filled-out contact form and attempts to get the recipient’s attention through a tone of familiarity. By beginning with “Thank you for contacting us,” the threat actor has made it appear as though the recipient had previously expressed interest in a third party by filling out the form with their email address. The message body then lures the victim with a link to details of an emergency grant of $5,800 available from the U.S. government. By appealing to the current fiscal concerns of many Americans, the threat actor wants to entice the target into clicking the “Read details” link. 

Figure 2: Landing Page of Phish 

Clicking the link redirects to a detailed page that appears to be a legitimate federal government website (Figure 2). Unlike many campaigns, this one goes a step further in terms of attention to detail to make it look like a real government page. The threat actor has added several items to advance its validity, including financial statistics and a detailed outline of this “Emergency Financial Aid.” The page also has a button that allows the person interacting with it an option to verify their data to collect funds. 

Figure 3: Second Step of Phish 

Clicking the button takes the viewer to the actual phishing page, seen above in Figure 3. Much like the other page, it is detailed and is unlike generic phishing pages. This page asks the user to check compensation eligibility by providing their Social Security Number, address, date of birth and other personally identifiable information (PII). Another detail to note is the form gives a warning that checking another person’s data is strictly prohibited, adding to the seeming authority. By entering data into the requested fields and clicking the “Run Check” button, all of this private information is then sent to the threat actor. 

Figure 4: Phishing Page 

The Cofense Phishing Defense Center has also identified a new phishing page that redirects from the same infection URL (Figure 4). This page is similar to the original phish; however, it uses the allure of tax relief for the current coronavirus pandemic to lure people into giving their personal information.   

Figure 5: Phishing Page 

As you can see above, Figure 5 resembles Figure 3 in that it collects PII. However, on this page, a chat window at the bottom right appears to simulate actual conversations between other users apparently excited about the potential tax relief. This is an interesting tactic and adds to the illusion of authenticity.  

Figure 6: Final Confirmation Page 

After data is entered into either of the two phishing pages, it redirects to a confirmation page thanking the victim for providing their information and promising them a prompt reply. This is just the last of many tricks the threat actor uses to trick the victim into believing that this application is legitimate. It shows that they will attempt to take advantage of any, and all, situations to gain confidential information. 

 Indicators of Compromise 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. 

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc. 

By Kyle Duncan, Cofense Phishing Defense Center

As the world continues to contend with a tenacious pandemic, many employers are obliged to revisit medical-benefit policies. The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign that aims to harvest Microsoft login credentials by posing as a company-wide sick/medical leave policy update.  

Figure 1-2: Email Body 

The sender’s email address is spoofed to appear as though the email is originating from the company’s SharePoint services by using the format “Sharepoint@[companyname].com“. However, one look into the email’s header information shows that this is not the case and that the email originated from outside of the organization, potentially from a compromised account operated by the threat actor. 

The email body itself is put together well and, at a glance, appears as though it could be legitimate. It even contains little details such as “This link will only work for anyone at [company name]” and “Microsoft OneDrive for [user’s email].” The threat actor has spoofed a legitimate Microsoft notification to appear legitimate, using a format the recipient would quickly trust at first glance. Since the file being shared refers to the company’s approach on sick leave during COVID-19, users are naturally going to be curious about what their company is doing for them. 

The glaring flaw with the email body is where it references both Microsoft OneDrive and SharePoint. Since the spoofed email address is attempting to trick the user into thinking this is a shared SharePoint file, it does not make sense for the email body to reference both of these services. It thus raises suspicion. The button users are intended to click also references OneDrive and, hovering over it, it reveals that the domain of the destination (oraclecloud[.]com) has nothing to do with Microsoft. It is apparent that this is not what it claims to be. 

Upon visiting the malicious URL, users are taken to a fake Microsoft login page as shown in Figure 3.  

Figure 3: Phishing Page 

The email address field of the login is automatically populated with the user’s email so they would only have to include their password. The page even includes the company’s logo to more effectively pass the login off as legitimate. Once the credentials have been secured, the user is then redirected to a page containing COVID-19 documentation, as seen in Figure 4, that seemingly appears relevant to what was mentioned in the email. While many phishing attempts redirect the user to a legitimate login page, the use of this document instead is another attempt to prevent the realization that the user’s credentials were just stolen.

Figure 4: Final Redirect Page 

Indicators of Compromise 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.  

  
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

By Zachary Bailey, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) has seen the rise of threat actors impersonating common document-sharing services to harvest credentials. These attacks can also use legitimate services to host malicious documents that are delivered to an unsuspecting employee who trusts the domain where they are hosted.  

Some of these attacks do not need to spoof the sender, such as this Adobe phish (Figure 1) that was found in a Proofpoint environment. The email appears merely to include a purchase order with encryption via the Adobe Document Cloud. In the email, Adobe is just one of several components of the phish. It builds credibility by posing as a government agency and suggests that the recipient can sign into Adobe to decrypt the file – or download Acrobat Reader to view it instead.

Figure 1: Email Body 

This email appears to be a forwarded message, as though the recipient is expecting it – FW: Purchase Order 3500250780 as the subject, which also includes the name of the organization sending the PO. A common tactic used by threat actors is to create a fake reply chain by inserting “RE” or “FW” into the subject line to trick the recipient into thinking it is a response to a conversation they initiated or were involved in.  

Even though the address is clearly from a Gmail domain, it is not an uncommon practice for work-related emails to be shared between personal and corporate accounts.  

The email is rather informative, listing the correct postal address and contact information for the government office it is impersonating. As mentioned earlier, the email body says, “To read it you sign into Adobe Document Cloud or download the latest Adobe Acrobat Reader.” Recipients are not urged to sign in but are presented an alternative option that would not put their credentials at risk. The only urgency is regarding “with immediate effect please ensure all invoices are addressed as below”, but that is legitimate information regarding how to address the invoice.   

If the recipient chooses to sign into the Adobe Document Cloud, they will immediately open the document which then launches in their default web browser. This HTML file will pull its resources from Adobe’s website while the pop-up message in Figure 2 delays the victim from seeing the page. JavaScript is embedded in the page to enforce basic password guidelines, which increases the odds that a realistic password is entered into the form. After the user attempts to log on, the HTML file will also send out a POST request with their login information to the threat actor.

Figure 2: Step 1 of Attack 

When the document is inspected by the recipient, its contents are not immediately known. A popup message will cover up the assets being loaded in, which will be read before proceeding. This is not hosted on a website, so checking the URL will not immediately tip off users that something is amiss. To them, they are just viewing a file on their computer. The wording of the popup is “This document is electronically encrypted to the receiver’s email”, which is a strange way of saying that the document can only be unlocked by the recipient. If a user is not familiar with technical terms, it could still sound legitimate to them, but that should be the first hint something is amiss. The second part of the popup urges them to sign in with “authenticated email credentials”, an even more noticeable tip off that this form wants their login information.  

Figure 3: Step 2 of Attack 

After the user clicks through to access the login page, a full webpage appears that looks like the Adobe Document Cloud site. This is still occurring inside of the downloaded document, and the only way to analyze where the form is from – without pressing “sign in” – is to inspect the code itself. To verify where the login information is going, we pulled up the network traffic and sent a request through. Our information is now going to “infiniteworks[.]net/IDI/high.php”, which is not a part of Adobe.  

Figure 4: Final Redirect of Phish  

After exposing their Adobe account credentials to the attacker, the victim is redirected to a new webpage. If they check the URL again, they will discover that they are now in the actual Adobe website. With no new document being unencrypted, they should be fully aware that something is wrong. They should alert their security team immediately.  

Indicators of Compromise 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.  

  
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

By Ala Dabat and Adam Martin 

The Cofense Phishing Defense Center (PDC) team has seen a resurgence in the number of Emotet variants in the past few months, with the majority of payloads being delivered via highly obfuscated macros embedded within Microsoft word documents.  

We will be taking a look at an example of Emotet that has managed to bypass Office365 SEGs using simple email layouts with a limited number of red flags usually picked up by traditional spam filtering.  

Figure 1 

A common pattern being observed has involved the number of payload deliveries bypassing traditional security scanning methods through both compressing and password protecting folders containing the malicious file. This makes it impossible for security scan engines to examine folder content. 

Figure 2

Once the password protected file is decompressed the malicious Emotet payload is presented, ready for the target to open. 

Figure 3 

Figure 4 

A call–to–action command is then executed (usually using PowerShell) via heavily obfuscated macros. 

Figure 5 

The call to action then downloads up to several variants of both Emotet and other malware families from a number of different command–and–control operations, which is in stark contrast to earlier generations of Emotet malware. Emotet appears to have the capability of exploiting known Windows system vulnerabilities, as well as having the ability to scan Windows directories in order to harvest sensitive data.  

Figure 6 

Following on from the contacted URLs displayed in the above figure, some testing was carried out on payloads downloaded. The URL found in Figure 7 was used as a hosting service for the Emotet sample. This is illustrated by the executable downloaded to the host machine.  

Figure 7 

Once executed, this malicious binary will delete itself from the original folder it was downloaded to, and will terminate its running processes. Then it will create a carbon copy of itself in “/AppData/Local/XBAuthManagerProxy” under the name “security.exe.” A comparison of both the original SHA256 and the newly created file confirms they are identical.  

Figure 8 

Dynamic analysis of the dropped executable reveals a host of interesting functions being created and called. Native Windows DLLs associated with networking are utilized for connectivity seen in Figures 9 & 10.

Figure 9 

Figure 10 

Figure 11

A network traffic analysis confirms that information was posted to the aforementioned C2 address.

Figure 12 

Indicators of Compromise 

hxxp://paulospainting[.]com/wp-includes/uhkHig/ 

hxxp://personalizzabili[.]com/images/x04aAql/  

hxxp://goldcoastoffice365[.]com/temp/RAr9U/ 

hxxp://must-in[.]com/wp-admin/kej4f/ 

hxxp://indyoverheaddoors[.]com/wp-includes/sx9SD/ 

 hxxp://giral2[.]com/wp-includes/fj2mDY/  

hxxp://bytecreation[.]es/gestion/hE/174[.]106[.]122[.]139/SMqQhLXYVLsodW/qHPV 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.  

  
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.