CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain

Summary

The investigation examines a sophisticated malware loader chain initiated through a ClickFix lure. The attack abuses the legitimate IBM SPSS IDE to execute multiple decoy DLLs before ultimately deploying a custom Remote Access Trojan (RAT) called CNCMachineRMS. The implant features a proprietary scripting language, extensive obfuscation, and broad remote administration capabilities.

Investigation

Researchers traced the multi-stage loader chain from the initial ClickFix lure through the legitimate IBM SPSS WinWrapIDE.exe process. The investigation uncovered COM object abuse used to trigger four decoy DLLs, with the final loader leveraging the EnumTimeFormatsEx API as a shellcode trampoline. The last stage was identified as CNCMachineRMS, distinguished by its unique configuration format and custom task execution engine.

Mitigation

Organizations should monitor for suspicious COM object activity and unexpected files created within %TEMP% and %LOCALAPPDATA% directories. Known C2 domains and IP addresses should be blocked, while defenders should watch for unauthorized local account creation and additions to privileged groups. Scheduled tasks should also be inspected for unusual service accounts or unexpected high-privilege execution.

Response

If CNCMachineRMS is detected, organizations should treat the compromise as a confirmed hands-on-keyboard intrusion. The affected host should be isolated immediately to limit lateral movement and further data exfiltration. Responders should conduct a comprehensive forensic investigation to determine attacker dwell time and establish whether additional payloads were deployed for data theft.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and seeks to establish persistence that is difficult to detect. Instead of using a known malicious binary, they identify that the IBM SPSS WinWrap Basic IDE is installed on the system. They decide to abuse a Registry Run Key to execute a malicious command through this legitimate IDE. The adversary will modify the HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun key, creating a value that points to the WinWrap IDE with a payload passed as an argument. This action triggers Event ID 4657 with the ‘IBM SPSS WinWrap Basic IDE’ string in the registry object path/name.

• Regression Test Script:

  # Simulation script to trigger detection of IBM SPSS WinWrap Basic IDE misuse via Registry
  $registryPath = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  $name = "MaliciousWinWrapTask"
  $value = "C:Program FilesIBMSPSSWinWrapBasicwrb.exe /execute 'C:UsersPublicmalicious.vbs'"
  
  Write-Host "[+] Simulating registry modification for IBM SPSS WinWrap Basic IDE..." -ForegroundColor Cyan
  
  # This action should trigger Event ID 4657 containing the targeted string
  New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType String -Force
  
  Write-Host "[+] Simulation command executed. Check SIEM for Event ID 4657." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup the registry key created during simulation
  $registryPath = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  $name = "MaliciousWinWrapTask"
  
  if (Get-ItemProperty -Path $registryPath -Name $name -ErrorAction SilentlyContinue) {
      Remove-ItemProperty -Path $registryPath -Name $name
      Write-Host "[+] Cleanup successful: Registry key removed." -ForegroundColor Green
  } else {
      Write-Host "[-] Cleanup failed: Key not found." -ForegroundColor Red
  }