Back 
Co-authored by Gustavo Palazolo and Ghanashyam Satpathy
Summary
In 2021, malicious Office documents accounted for 37% of all malware downloads detected by Netskope, showing favoritism for this infection vector among attackers. This is likely due to the ubiquitous usage of Microsoft Office in enterprises across the globe. Throughout 2021 we have analyzed many techniques used by attackers to deliver payloads through infected documents, which included the return of Emotet, a campaign that primarily uses infected documents to spread malware.
Since December 2021, Netskope Threat Labs has observed an increase in the usage of one specific file type from the Microsoft Office suite: PowerPoint. These relatively small files are being delivered through phishing emails, then downloading and executing malicious scripts through LoLBins, a common technique often used to stay under the radar.
We spotted this campaign delivering multiple malware, such as AveMaria (a.k.a. Warzone) and AgentTesla. These files are using Bitly to shorten URLs and different cloud services like MediaFire, Blogger, and GitHub to host the payloads. In this blog post, we will analyze a malicious PowerPoint Add-In file detected by Netskope that delivers multiple malware, including AgentTesla.
Stage 01 – Infected PowerPoint File
The infection flow starts with a phishing email that carries the infected file as an attachment, along with a message that lures the victim to download and open it.
The file is fairly small and it doesn’t contain anything but the malicious VBA macro.
The macro is obfuscated and it uses an internal function to decrypt important strings at runtime.
The script deobfuscation is straightforward and leads to the following VBA code.
This technique uses Outlook (COM Object) to execute PowerShell, which bypasses the child process created by PowerPoint.
The script is executed with a combination of PowerShell and mshta, a similar technique employed by BazarLoader.
Stage 02 – VBS File
The URL contacted by the mshta binary is shortened through the Bitly domain “j.mp”, and the payload is hosted on MediaFire, a cloud service for file storage and sharing.
The next stage is a VBS script that is lightly obfuscated within an HTML page, which is decoded and executed through a simple JavaScript function.
Once deobfuscated, the VBS script performs multiple tasks to:
- Create a persistence mechanism through the Windows registry to execute two PowerShell scripts from external URLs. The first script delivers AgentTesla, and the second script is used to disable some OS defenses, such as Windows Defender.
- Create a scheduled task that executes a script from an external URL through mshta approximately every hour. This script delivers a cryptocurrency stealer developed in PowerShell, hidden within a fake web page hosted with Blogger.
- Create a persistence mechanism through the Windows registry to execute a script from an external URL using mshta. Unfortunately, we can’t tell what was being executed as this URL was offline at the time of the analysis.
Stage 03 – AgentTesla
The first PowerShell script is responsible for executing AgentTesla, which is a .NET-based Remote Access Trojan with many capabilities, such as stealing browser’s passwords, capturing keystrokes, clipboard, etc.
The code is slightly obfuscated, protecting variables, function names, and strings. There are two large arrays that contain:
- Compressed bytes of AgentTesla;
- Compressed bytes of a .NET Injector used for process injection;
None of the executables are written to disk, which characterizes this attack as fileless.
Once both files are decompressed, the script loads the injector and calls a function named “Execute”, responsible for injecting AgentTesla payload into an instance of “aspnet_compiler.exe”, which is a binary from the .NET framework.