A late-April malspam campaign delivers a previously unseen PowerShell malware family dubbed PowerDash, using a Word document exploiting CVE-2017-0199 to drop further payloads. The operation employs VBScript to PowerShell chaining, HTA-based stagers for persistence and payload delivery, a Python/Django C2 over a /dash endpoint, and extensive host information gathering before issuing commands. #PowerDash #PowerShell #HTA #CVE-2017-0199 #AdformTrack
Keypoints
- Malspam campaign in late April delivers a new PowerShell-based malware family named PowerDash.
- The lure uses a compromised email account and a Word document that exploits CVE-2017-0199 to fetch an HTA payload.
- HTA payloads drop and execute PowerShell stagers from the same host, with VBScript to PowerShell execution flow.
- Persistence is achieved by downloading an HTA payload, adding a Run key entry, and using mshta.exe to execute it.
- The final PowerDash payload is heavily obfuscated and then runs after collecting host information (UUID, OS, domain, antivirus, CPU, GPU) and contacting the C2.
- The C2 is a Python/Django-based server with a /dash route for bot registration and command delivery; IoCs include IPs, URLs, and SHA-256 hashes.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The lure email is fairly short and asks for price quotas on the attached inquiry. “The lure email is fairly short. It asks the recipient to provide price quotas on the inquiry attached to the email.”
- [T1203] Exploitation for Client Execution – The Word document exploits CVE-2017-0199 to fetch an additional HTA payload from a remote location. “The attachment is a MS Word document that exploits the CVE-2017-0199 vulnerability and fetches an additional HTA payload from a remote location.”
- [T1059.001] PowerShell – The HTA payload fetches and executes a PowerShell payload (stager) from the same host. “The HTA payload fetches and executes a PowerShell payload (stager) from the same host.”
- [T1059.005] VBScript – The malware uses VBScript to initiate PowerShell. “VBScript -> PowerShell”
- [T1547.001] Registry Run Keys/Startup Folder – Persistence via an Autorun registry key and mshta.exe execution. “adding an entry to the Autorun registry key to execute it using mshta.exe.”
- [T1218.005] Mshta – Execution via mshta.exe during persistence and final payload loading. “mshta.exe” is invoked to run dropped payloads.
- [T1082] System Information Discovery – The stager collects host information before contacting the C2. “collect a bunch of information about the host and then contacts the C2 for commands to execute.”
- [T1071.001] Web Protocols – C2 communications occur over HTTP(S) via the /dash endpoints. “What’s interesting for us is the /dash/ route – that’s the endpoint infected bots talk to.”
- [T1105] Ingress Tool Transfer – The stager downloads and writes payloads (e.g., PowerDash stager and final payload). “DownloadFile(‘http://5.63.152.179/pl/2ht/8164’, $Pth);”
Indicators of Compromise
- [IP] Host used for serving payloads – 5.63.152.179, and 2 more (other related hosts mentioned in the campaign)
- [IP] Malware C2 host – 95.163.240.184
- [URL] C2 endpoint – https://95.163.240.184:8000/dash/post_data/, and other dash endpoints
- [URL] Malicious HTA/doc delivery – http://5.63.152.179/doc/zal_nr_1_zap_ofert().doc
- [URL] Malicious PowerShell script – http://5.63.152.179/pl/1txt/, and http://5.63.152.179/pl/3txt/
- [URL] Malicious HTA script – http://5.63.152.179/pl/2ht/
- [Hash] SHA256 of Zapytanie_ofertowe_2023_0118806.doc – d5c03af59492198d99889f5ec84f96129019ba933c5d8e3614866861c28ab4e6
- [Hash] SHA256 of zal_nr_1_zap_ofert(8806).doc – 64502109c546fbd2d37644c030182a906b3871316b5086d31286c3697ca94362
- [Hash] SHA256 of 8806 – Stager – 2fd5c1a3787eec4d9bd6f935e5b93af0f4fd454544b03c6aa70c94e4b55d22a7
- [Hash] SHA256 of 8806 – HTA persistence – ec0a53f40414c1a1419d458af90a74b58d654de4af67841d689fa9f296ca617d
- [Hash] SHA256 of 8806 – PowerDash payload – a196711c42f3f3d378bf8232d3b10a92afd846b0f374cbf6cd54fcfda47b958d
- [URL] Track/redirect domain used for tracking or obfuscation – https://track.adform.net/adfserve/?bn=12345;redirurl=http://5.63.152.179/doc/zal_nr_1_zap_ofert(XXXX).doc
Read more: https://cert.pl/en/posts/2023/05/powerdash-malspam/