Macro-based Office Malware using Cloud Services

Netskope Threat Research Labs recently observed new strains of Microsoft Office macro-based document malware that extensively uses cloud storage services for downloading the second-stage malware payload. The macro-based malware is using either VBScript or PowerShell scripts. Netskope Threat Protection detects these macro-based malware as Backdoor.Generckd.4622234, W97M.Downloadr.FCG, and Backdoor.Generckd.4574697. The Netskope Active Platform can proactively protect customers by blocking the download of the second-stage malware from these cloud storage services,  especially those services whose enterprise readiness score is poor as per the Netskope Cloud Confidence Index (CCI).

The malicious macro code is embedded in Microsoft Office files using VBScript or PowerShell Script. A default Microsoft Office installation disables macros by default and will not execute macros automatically. Malware authors craft enticing messages in the documents, thereby convincing users to enable macros manually when the document is opened. As shown in Figure 1, if the user clicks the “Enable Content” option, the malicious code will execute, thereby downloading the second-stage payload to the user’s machine. We are observing a steady increase in the use of Cloud Storage services for hosting the second-stage payload to infect the end users’ devices. The usage of cloud storage service URLs in malicious macros is a significant evolution in the threat landscape.

In the new strains that we have analyzed, we found malicious macros that contained links to the cloud storage service 1Fichier, which hosted the second-stage payload. 1Fichier is a France-based cloud storage service that scores a “poor” and a numeric score of “11” out of “100” in the Netskope CCI. Netskope Threat Research Labs notes that 1Fichier has enterprise readiness gaps in all segments but one of the CCI measurements, including Certifications & Standards, Data Protection, Access Control, Auditability, Disaster Recovery & Business Continuity, and Legal & Privacy. In the rest of the blog, we provide an analysis of these new strains with the first being the latest variant of the Stampado ransomware, which is using PowerShell script with references to 1Fichier. This latest variant encrypts 1,342 file extensions, including extensions created when files are encrypted by other ransomware. We also provide an analysis of another macro-based malware using VBScript with references to 1Fichier.

Both of the macro-based documents we analyzed use VBscript and PowerShell to download the second-stage payload from 1Fichier. The macro code in the documents was not obfuscated and only had the downloader functionality code called from the Auto_Open() function.

Macro with PowerShell Script and Stampado Ransomware

This macro-based document, when executed, displays a message to “Enable Content” as shown in Figure 1. When the content is enabled, it downloads the second-stage payload.

The PowerShell code to download the second-stage payload from 1Fichier is shown in Figure 2.

Figure 2: PowerShell code with reference to downloading content from 1Fichier

At the time of analysis, this second-stage payload delivered the latest variant of Stampado ransomware detected by Netskope Threat Protection as Backdoor.Generckd.4637645. The Stampado ransomware was compiled with AutoIt and packed with a UPX packer. The analysis and functionality of this ransomware has been documented by BleepingComputer. We will detail the key functionalities and some new features of Stampado.

On execution, the sample drops a copy of itself in %Appdata%, named scvhost.exe and drops two files in the desktop named “How to recover my files.txt” and “Recover my files.exe,” related to recovery instructions. The encrypted files are renamed to the extension, “.locked.” The “Recover my files.exe” binary displaying the ransomware note is shown in Figure 3. The email address used for communications related to recovery is [email protected].

Figure 3: Stampado ransomware note

Stampado Ransomware File Extensions

This variant of Stampado ransomware encrypts files with 1,342 different file extensions, certainly among the most comprehensive we have seen. The file extensions are listed in the appendix at the end of this article.

Interestingly, Stampado ransomware also encrypts files encrypted by other ransomware. The following are the 41 file extensions belonging to other ransomware that are also encrypted by Stampado ransomware.

“*.pdcr;*.EnCiPhErEd;*.xyz;*.pzdc;*.kkk;*.PoAr2w;*.czvxce;*.magic;*.odcodc;*.rdm;*.windows10;*.payms;*.p5tkjw;*.fun;*.btc;*.darkness;*.kraken;*.crptrgr;*.legion;*.kernel_time;*.kernel_complete;*.rokku;*.bin;*.kernel_pid;*.73i87A;*.kimcilware;*.SecureCrypted;*.CCCRRRPPP;*.vvv;*.kratos;*.herbst;*.payrms;*.bitstak;*.paymts;*.paymst;*.pays;*.paym;*.info;*.padcrypt;*.paymrss;*.szf”

It is also interesting to find the entries created by KeRanger OSX ransomware, “.kernel_pid”, “.kernel_time” and “.kernel_complete” in the above list. At this time we cannot speculate the reason to specify a Mac OS X based ransomware file extension in a windows based ransomware variant. It is possible that the malware author is working on a Mac OS X variant of Stampado.

Countries/Regions of Interest

The AutoIt script also shows messages related to several languages for displaying the ransomware notes. Apart from English, other languages include Russian, Polish, Italian, Mongolian, and Dutch, as shown in Figure 4.

Figure 4: Stampado-supported languages

The presence of languages indicates countries/regions of interest for Stampado.

Decrypting Stampado Encrypted Files

The encrypted files of Stampado that we analyzed can be decrypted using the freely available decryptor tool provided by Fabian Wosar of Emsisoft. Since the Stampado ransomware has a unique “salt” that is specific to the ransomware victim, the ransom ID and email address need to be specified before initiating the decryption process.

Macro with VBScript

This macro-based document, when executed, displays a message to “Enable Content,” as shown in Figure 5. When the content is enabled, it downloads the second-stage payload.

Figure 5: Message displayed on execution of the macro-based document with VBscript

The VBscript to download the second-stage payload from 1Fichier is shown in Figure 6.

Figure 6: VBScript code with reference to downloading content from 1Fichier

At the time of analysis, the 1Fichier link was down and not serving any payload.

Conclusion

These malicious documents illustrate the use of cloud services with PowerShell script and VBScript. In addition to disabling macros by default, users must also be cautious of documents that only contain a message to enable macros to view the document and also not to execute unsigned macros and macros from an untrusted source. Administrators should educate employees about the impact of ransomware and ensure protection of the organization’s data by making regular backups of critical data.

As the use of cloud services by malware often evades traditional security solutions, and also, second-stage payloads like ransomware can lead to devastating consequences, including loss of business-critical and sensitive data, the use of a cloud-aware security solution such as Netskope Threat Protection becomes mandatory for enterprises.

As a recommended security measure, Netskope customers using the Netskope Active Platform can proactively protect their environments by blocking access to Cloud Storage services with poor enterprise-readiness scores or missing key enterprise-readiness features by consulting the Netskope Cloud Confidence Index. Netskope worked with 1Fichier to take down the URLs hosting the malicious payloads.

General Recommendations

Netskope recommends the following to combat cloud-based malware threats:

• Detect and remediate all threats in sanctioned and unsanctioned cloud services using a threat-aware cloud access security broker like Netskope
• Actively track usage of unsanctioned cloud services and enforce DLP policies to control files and data en route to or from your corporate environment
• Regularly back up and turn on versioning for critical content in cloud services
• Enable the “View known file extensions” option on Windows machines