Fake Purchase Order Emails Used in Malware Phishing Attacks

Summary

Threat actors are distributing phishing emails with malicious DOCX attachments disguised as purchase orders. The documents abuse the altChunk element to load a malicious RTF file, which exploits an Equation Editor vulnerability to execute VBScript. The final payload is the SnakeKeylogger infostealer, designed to steal credentials, capture keystrokes, and collect other sensitive information.

Investigation

AhnLab Security Intelligence Center (ASEC) analyzed the infection chain beginning with the malicious DOCX attachment. Researchers identified a multi-stage execution sequence involving an RTF file, VBScript, PowerShell, and a Python-based loader. The chain ultimately deploys SnakeKeylogger, which relies on specific decryption techniques to execute its embedded shellcode.

Mitigation

Users should verify sender email domains and remain cautious when receiving unexpected attachments or links. Organizations should configure email filtering to detect suspicious .docx files containing altChunk elements and monitor unauthorized execution of pythonw.exe or cscript.exe. Microsoft Office and other software should also be kept patched against known vulnerabilities.

Response

When malicious activity is detected, isolate affected systems to stop further data exfiltration. Perform forensic analysis to determine the scope of compromise and identify persistence through Registry Run keys. Reset credentials for accounts accessed from the infected host, particularly browser, email, and financial service credentials.

Simulation Execution

• Attack Narrative & Commands: An adversary sends a spear-phishing email containing a fake “Purchase Order” in DOCX format. When the victim opens the document, a macro or exploit triggers the extraction of a malicious payload named 832734.Vbs into a temporary directory. The attacker then executes this script via wscript.exe. This action is intended to establish an initial foothold and begin credential harvesting using the SnakeKeylogger infostealer. The detection rule is expected to catch the execution because the filename 832734.Vbs is present in the process creation command line.

• Regression Test Script:

  # Simulation script to replicate SnakeKeylogger filename-based execution
  $tempPath = $env:TEMP
  $maliciousFile = Join-Path $tempPath "832734.Vbs"
  
  # Create a dummy VBS file to simulate the payload
  "WScript.Echo 'Simulating SnakeKeylogger Payload'" | Out-File -FilePath $maliciousFile -Encoding ascii
  
  # Execute the file via wscript.exe to trigger the detection rule
  Start-Process "wscript.exe" -ArgumentList "`"$maliciousFile`""
  
  Write-Host "Simulation complete. Check security logs for process creation involving 832734.Vbs"

• Cleanup Commands:

  # Cleanup: Remove the simulated malicious file
  $tempPath = $env:TEMP
  $maliciousFile = Join-Path $tempPath "832734.Vbs"
  if (Test-Path $maliciousFile) {
      Remove-Item $maliciousFile -Force
      Write-Host "Cleanup successful: $maliciousFile removed."
  }