Threat hunting uncovered an attack that used malicious MSI delivery to trick a user into installing a browser hijacker, while legitimate tools like PowerShell were used in the process. The post emphasizes integrating threat hunting with SecOps to detect abuse of legitimate tools and drive defenses such as stronger logging and policy controls. #Wazawaka #PrintRecipes
Keypoints
- EDR alone is not sufficient; threat hunting is needed to baseline activity, detect deviations, and reduce false positives/negatives.
- Threat hunters initially investigated activity associated with the group “Wazawaka” but found the activity did not originate from them, though it warranted further investigation.
- Key indicators include a domain (g8v1en[.]com), a suspicious download URL (PrintRecipes domain), an MSI file (PrintRecipes_46069404.msi) and its hash (e1d6ea166a0a09b4af4f697a0a88ff8b638f7f1738b0a5fa14f43bdf8e85739e).
- The MSI was downloaded from the internet and executed via msiexec, with multiple PowerShell scripts using Net.WebClient to contact a suspicious domain.
- User interaction (clicking prompts after MSI extraction) allowed the payload to attempt browser hijacker installation, with several .tmp files behaving as portable executables.
- Post-incident actions included reimaging the device, revoking sessions, changing passwords, and process changes such as blocking MSI installs via GPO and enabling PowerShell transcription logging.
MITRE Techniques
- [T1189] Drive-by Compromise – Malvertising URL delivered an MSI file; “originated from a malvertising URL in an attempt to find recipes for zucchini bread.”
- [T1059.001] PowerShell – PowerShell scripts executing Net.WebClient to invoke web requests to a suspicious looking domain.
- [T1105] Ingress Tool Transfer – The MSI file was downloaded from the internet; “The source of the activity was msiexec.exe running an MSI file downloaded from the internet.”
- [T1204] User Execution – The user clicked through the prompts after extracting the MSI file.
Indicators of Compromise
- [Domain] Potential C2/download domains – g8v1en[.]com, print-recipes[.]com
- [IP Address] Observed server IPs – 52[.]84[.]125[.]31
- [Domain] Delivery/download domain – dl.print-recipes[.]com
- [File Hash] MSI hash – e1d6ea166a0a09b4af4f697a0a88ff8b638f7f1738b0a5fa14f43bdf8e85739e
- [URL] Download URL – hxxps://dl[.]print-recipes[.]com/ext/getsecurefile/46069404?appid=&cid=I8AZ0CDgUMExJklCJ0&url=&exeid=
- [URL] VT/file/domain references – https://www.virustotal.com/gui/file/e1d6ea166a0a09b4af4f697a0a88ff8b638f7f1738b0a5fa14f43bdf8e85739e, https://www.virustotal.com/gui/domain/dl.print-recipes[.]com