Phishing Campaign Targeting Companies via UpCrypter

MITRE Techniques

• [T1566 ] Phishing – used to deliver HTML attachments that redirect victims to spoofed pages tailored with the victim’s email/domain (“the script sets the target user’s email… and assigns the result to ‘window.location.href’ after 413 milliseconds”).
• [T1204.002 ] User Execution: Malicious File – victims are urged to download and open a ZIP containing an obfuscated JavaScript dropper (“the downloadFile() handler … submits the form, causing the delivery of a ZIP archive … ‘Please open it for review…’”).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – JavaScript constructs a Base64 PowerShell command and executes it with ShellExecute to run hidden PowerShell (-ExecutionPolicy bypass) (“it then calls ShellExecute to run PowerShell with ‘-ExecutionPolicy bypass’ and the decoded command using a window style of 0”).
• [T1218.011 ] Signed Binary Proxy Execution: Rundll32/Regsvr32/PowerShell – use of PowerShell to execute embedded loader code and scripts in-memory (“PowerShell is responsible for network verification, anti-analysis checking, and preparing for loader execution … executed directly in memory through .NET reflection”).
• [T1105 ] Ingress Tool Transfer – downloads additional files (01.txt, 02.txt, bu.txt) and loader/payload data from remote URLs to stage and execute the final payloads (“retrieves files ’01.txt,’ ’02.txt’ … and a payload from ‘ktc2005[.]com/bu[.]txt’”).
• [T1005 ] Data from Local System – reads system/registry/BIOS fields for anti-analysis checks (“reads the registry ‘HKEY_LOCAL_MACHINEHARDWAREDESCRIPTIONSystemBIOS’ to obtain BaseBoardManufacturer and BaseBoardProduct”).
• [T1490 ] Inhibit System Recovery – forces system restarts when anti-analysis checks or connectivity checks fail to disrupt analysis (“If this fails, it then restarts the computer… If any are found, it forces a system restart”).
• [T1106 ] Native API – uses WinExec and Shell.Application objects for execution and persistence (“creates a Shell.Application object… It then leverages WinExec to launch the attack”).
• [T1543.003 ] Create or Modify System Process: Windows Service – persistence via registry Run key (“adds the complete PowerShell execution into the registry ‘HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun’”).
• [T1027 ] Obfuscated Files or Information – heavy obfuscation of JavaScript, Base64/XOR fragmenting, and padding with junk code (“heavily obfuscated JavaScript file padded with large amounts of junk code… reconstructs a link by XORing a set of small string chunks with 0x15 and then applying ‘atob’”).
• [T1074.001 ] File Deletion – deletes staged artifacts and cleans working folders on detection (“writes the marker file ‘detect_analisse_process.txt’, deletes staged artifacts, cleans working folders, forces a restart, and exits”).
• [T1001.001 ] Indicator Removal on Host: Clear Windows Event Logs or other traces – cleaning working folders and deleting artifacts to minimize traces (“deletes staged artifacts, cleans working folders … minimizing traces”).