The Evil MSI Background is Back!, (Fri, Jun 5th)
This report details a recent cyberattack utilizing a classic MSI-branded JPEG payload, a technique previously documented by the SANS Internet Storm Center. The attack began with a phishing email containing a WeTransfer link, leading to a JavaScript file that executed PowerShell commands to download and execute a malicious .NET DLL. The attacker leveraged Cloudflare workers and R2 storage services to host the payloads, employing obfuscation techniques like ROT13 and Base64 encoding to evade detection. The attack utilizes a modified TaskScheduler library and a PNG image potentially containing a further payload.
The attack began with a phishing email distributing a JPEG image disguised as an MSI background. This image contained a JavaScript file, "Remittance Advice.js" (SHA256:8a83de81fbac4eb0961f3d58982f299664a5fa4c874c7469e69f85f3fc5bd33f), which executed PowerShell commands to download and run a malicious .NET DLL. The PowerShell script utilized WMI to establish a connection and create a hidden process, ultimately executing the downloaded DLL. The attacker employed obfuscation techniques, including ROT13 encoding, to hinder initial analysis. The final payload is a modified version of Microsoft's TaskScheduler library, leveraging its capabilities for process management. The attacker further utilized Cloudflare workers and R2 storage services to host the payloads, a common tactic to avoid detection and maintain operational security.