Beware of Phishing Emails Urging Command Execution through Paste (CTRL+V)

Two sentences summarizing the content: ASEC researchers found phishing emails distributing HTML attachments that urge recipients to paste commands to run them, leading to a multi-stage infection that drops DarkGate via PowerShell, HTA, and AutoIt components. The campaign downloads payloads from C2, decodes commands from Base64, and uses clipboard manipulation to obscure execution. #DarkGate #PowerShell #HTA #AutoIt #ASEC #HTMLPhishing

Keypoints

The threat actor distributes phishing HTML attachments via email to prompt users to open them and take action.
The emails simulate legitimate topics (fee processing, operation instruction reviews) to coax recipients into opening attachments.
Opening the HTML leads to a background message mimicking MS Word and prompts the user to click a button to view content offline.
On consent, users go through a sequence: Win+R → CTRL+V → Enter, while the PowerShell command is Base64-encoded and saved to the clipboard.
The PowerShell script downloads an HTA file from a C2 and executes it, while clearing the clipboard to obscure the command.
HTA launches the PowerShell command from the C2, and AutoIt (inside a ZIP) runs a script (script.a3x) as part of the infection chain, culminating in DarkGate malware.
Detected file types and IOCs include multiple HTA/HTML/PowerShell artifacts and a list of download URLs linked to the campaign.

MITRE Techniques

[T1566.001] Phishing: Attachment – The attacker distributes phishing HTML attachments that prompt users to take action. “The threat actor sent emails about fee processing, operation instruction reviews, etc. to prompt recipients to open the attachments.”
[T1204] User Execution – The recipient is guided to click through prompts to view content and run commands. “The message tells the user to click the ‘How to fix’ button to view the Word document offline.”
[T1059.001] PowerShell – The malicious PowerShell command is executed as part of the infection flow. “The malicious PowerShell command (see Figure 4) … is decoded and saved into the user’s clipboard.”
[T1140] Deobfuscate/Decode Files or Information – Base64-encoded PowerShell payload decoded during execution. “Base64-encoded by the JavaScript (see Figure 3) is decoded and saved into the user’s clipboard.”
[T1105] Ingress Tool Transfer – The payloads are downloaded from a C2 during the infection chain. “The PowerShell command downloads an HTA file from C2 and executes it.”
[T1218.005] HTA – The download and execution flow leverages an HTA to run the PowerShell command from the C2. “HTA executes the PowerShell command in C2.”
[T1059] Command and Scripting Interpreter – AutoIt script execution via the ZIP-delivered tool (script.a3x) represents scripting interpreter use. “Autoit3.exe inside the ZIP file uses the compiled malicious AutoIt script (script.a3x) as an argument to be executed.”

Indicators of Compromise

[File hash] 8b788345fe1a3e9070e2d2982c1f1eb2 – html file used in the initial delivery
[File hash] 404bd47f17d482e139e64d0106b8888d – script.a3x detected in the payload chain
[File hash] 30e2442555a4224bf15bbffae5e184ee – dark.hta involved in the dropper chain
[File hash] 4d52ea9aa7cd3a0e820a9421d936073f – another HTML artifact in the campaign
[Filename] script.a3x – invoked by AutoIt component during execution
[Filename] dark.hta – HTA component downloaded from C2
[Filename] 1.hta – additional HTA artifact observed in IOCs
[URL] hxxps://jenniferwelsh[.]com/header.png – one of the download indicators
[URL] hxxp://mylittlecabbage[.]net/qhsddxna – another download indicator