Elastic Security researchers describe GrimResource, a novel MSC-based code execution technique that leverages mmc.exe through specially crafted MSC files to achieve initial access and evasion. The technique chains together apds.dll XSS, DotNetToJScript loading, PASTALOADER, and payload injection into dllhost.exe, with a Cobalt Strike payload observed in the wild. #GrimResource #PASTALOADER #CobaltStrike #DotNetToJs #mmc.exe #apds.dll #DPRK
Keypoints
- Elastic Security researchers disclose a novel, in-the-wild code execution technique using crafted MSC files, dubbed GrimResource.
- GrimResource enables full code execution in Microsoft Management Console (mmc.exe) with minimal security warnings, aiding initial access and evasion.
- The technique relies on an XSS flaw in apds.dll to execute JavaScript within the mmc.exe context, paired with DotNetToJScript to load and run code.
- PASTALOADER retrieves the payload from environment variables and injects it into dllhost.exe, employing stealth techniques (DirtyCLR, unhooking, indirect syscalls).
- The wild sample had 0 static detections on VirusTotal at the time of reporting, highlighting its stealth.
- Elastic provides detections and guidance, including MMC-based suppression detections and methods like EQL/YARA rules to identify the technique primitives.
MITRE Techniques
- [T1218.005] Signed Binary Proxy Execution: MMC – GrimResource uses mmc.exe to execute code via a crafted MSC file. ‘GrimResource allows attackers to gain full code execution in the context of mmc.exe after a user clicks on a specially crafted MSC file.’
- [T1059.007] JavaScript – GrimResource executes JavaScript within the mmc.exe context via an XSS redirect. ‘execute arbitrary javascript in the context of mmc.exe.’
- [T1059.005] VBScript – The attack uses obfuscated VBScript and DotNetToJs to run the embedded loader. ‘The VBScript sets the target payload in a series of environment variables and then leverages the DotNetToJs technique to execute an embedded .NET loader.’
- [T1055] Process Injection – PASTALOADER spawns a new instance of dllhost.exe and injects the payload into it. ‘PASTALOADER spawns a new instance of dllhost.exe and injects the payload into it.’
- [T1027] Obfuscated/Compressed Files and Information – TransformNode obfuscation and obfuscated VBScript used to evade warnings. ‘This leads to an obfuscated embedded VBScript …’
Indicators of Compromise
- [SHA-256] Abused MSC file – 14bcb7196143fd2b800385e9b32cfacd837007b0face71a73b546b53310258bb, 4cb575bc114d39f8f1e66d6e7c453987639289a28cd83a7d802744cd99087fd7, and 1 more hash
- [File name] sccm-updater.msc, apds.dll, and redirect[?] – observed in the MSC/Tcache/redirect flow
- [Process name] mmc.exe, dllhost.exe – observed as the host processes involved in execution and payload injection
Read more: https://www.elastic.co/security-labs/grimresource