Full Report
Trend Micro detailed how attackers are using a fake proof-of-concept for a critical Microsoft vulnerability, designed to steal sensitive data from security researchers
Analysis Summary
# Tool/Technique: Fake PoC Exploit delivering Information-Stealing Malware
## Overview
This refers to a specific attack campaign where threat actors created a malicious proof-of-concept (PoC) repository targeting security researchers. The PoC was designed to appear legitimate (a fork of an original creator's work) but delivered information-stealing malware upon execution, leveraging interest in a recently disclosed critical Microsoft vulnerability (CVE-2024-49113).
## Technical Details
- Type: Attack Chain/Delivery Mechanism (using customized malware)
- Platform: Windows (implied by the use of PowerShell and targeting Microsoft vulnerability)
- Capabilities: Malware delivery, execution using legitimate system features (Scheduled Job, PowerShell), information theft, and exfiltration via FTP.
- First Seen: Context implies immediately following the December 2024 Patch Tuesday release related to CVE-2024-49113.
## MITRE ATT&CK Mapping
Since the primary reported activity centers around delivery, execution, and data staging/exfiltration, the mappings are derived from the observed actions:
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (The lure uses a PoC related to an exploit, though the malware itself relies on user execution)
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell
- T1204 - User Execution
- T1204.002 - Malicious File
- **TA0009 - Collection**
- T1005 - Data from Local System (Collecting computer info, processes, directories, updates)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel (Using FTP for exfiltration)
## Functionality
### Core Capabilities
- Hosting a malicious repository disguised as a critical security PoC.
- Dropping and executing `poc.exe` (packed with UPX).
- Dropping and executing a PowerShell script in the `%Temp%` folder.
- Creating a Scheduled Job to execute an encoded script.
- Downloading a secondary script from Pastebin.
### Advanced Features
- **Information Staging:** Collecting sensitive data including public IP address, computer information, process list, directory lists, network adapters, and installed updates.
- **Data Compression:** Compressing collected data into a ZIP file.
- **Hardcoded Exfiltration:** Using hardcoded credentials to upload the compressed data via FTP to an external server.
## Indicators of Compromise
*Note: Specific IOCs were not provided in the text, but derived indicators based on the described process are listed.*
- File Hashes: N/A (Specific hashes not detailed)
- *Potential hashes associated with `poc.exe` (UPX packed executable)*
- File Names: `poc.exe`
- Registry Keys: N/A (Focus on Scheduled Job creation)
- Network Indicators:
- Download Source: Pastebin URL (defanged)
- Exfiltration Destination: External FTP server (using hardcoded credentials) (defanged)
- Behavioral Indicators:
- Creation of a Windows Scheduled Job.
- Use of PowerShell to execute encoded and downloaded scripts.
- File compression (.zip) followed by outbound FTP activity.
## Associated Threat Actors
- Threat actors are utilizing this lure, although the specific group implementing this campaign is not named in the summary (Trend Micro reported on the activity).
## Detection Methods
- Signature-based detection: Signatures for the UPX-packed `poc.exe` or known FTP beacon destinations.
- Behavioral detection: Monitoring for PowerShell scripts executing from the `%Temp%` directory chained with Scheduled Task creation. Monitoring for unprompted file compression followed by outgoing FTP connections initiated by unusual processes.
- YARA rules: YARA rules targeting the specific packer signature (if distinct) or known embedded command strings.
## Mitigation Strategies
- Always download code, libraries, and dependencies from official and trusted repositories.
- Exercise extreme caution regarding repositories that appear to be recent forks of popular/trending security tools.
- Review repository commit history and contributor list for anomalies (e.g., rapid, suspicious changes).
- Verify the identity/provenance of the repository owner or organization before cloning or executing files.
- Be skeptical of repositories with low engagement (few stars, forks, contributors) claiming relevance to major security topics.
## Related Tools/Techniques
- Malware: Information-Stealing Malware (Infostealer)
- Delivery Mechanism: Social engineering via desirable security content (PoC/Exploit lure).
- Execution Tool: UPX packer (used to obfuscate the initial executable).
- Persistence/Execution Helper: Windows Scheduled Jobs.