Job Offer Lures Hide Two Sophisticated Multi-Stage Attack Chains

Summary

Two separate multi-stage attack chains use job-themed social engineering to deliver malware. Campaign 1 relies on a ZIP archive to deploy PureRAT through a Python-based loader that uses DLL side-loading and several persistence mechanisms. Campaign 2 delivers an LNK file that launches mshta.exe, which retrieves and executes a custom in-memory implant.

Investigation

The investigation linked Campaign 1 to a Vietnam-nexus criminal cluster with infrastructure overlap tied to a known PXA Stealer operation. Campaign 2 appeared to be a custom campaign with no identified public overlap. Both attack chains use advanced evasion techniques, including AMSI and ETW patching as well as reflective code loading.

Mitigation

Defenders should monitor for signed Microsoft binaries loading unsigned DLLs from user-writable directories and detect mshta.exe execution involving remote URLs. Egress filtering for non-standard high ports and auditing for COM-based scheduled task creation can help disrupt these infection chains. Strengthening memory integrity monitoring is also important.

Response

If malicious activity is detected, remediation should account for multiple persistence mechanisms, including WMI subscriptions and COM hijacking. Removing a single file or scheduled task may not fully eliminate Campaign 1 because of its self-repairing behavior. Responders should investigate staging directories and comprehensively remove all identified persistence artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and wishes to execute a malicious payload while masquerading as a common productivity application to evade suspicion. The attacker copies the legitimate mshta.exe from System32 to a local folder and renames it to WinWord.exe. They then place a malicious DLL in the same folder. When WinWord.exe (the renamed MSHTA) is executed, the system’s Image Load telemetry will record a process where the Image filename is WinWord.exe but the OriginalFileName metadata remains mshta.exe. This mismatch is the specific trigger for the detection rule.

• Regression Test Script:

  # Simulation of DLL Side-loading via Renaming
  $workDir = "$env:TEMPSimulation_SideLoad"
  New-Item -ItemType Directory -Force -Path $workDir
  Set-Location $workDir
  
  # 1. Copy the legitimate binary
  Copy-Item "C:WindowsSystem32mshta.exe" -Destination "WinWord.exe"
  
  # 2. Create a dummy/benign DLL to ensure the process can actually 'load' something 
  # (Note: In a real attack, this would be the malicious DLL. 
  # For telemetry triggering, we just need the renamed binary to run.)
  
  # 3. Execute the renamed binary
  # This will trigger Sysmon Event ID 7 for the image load of the renamed file
  Write-Host "[*] Executing renamed binary to trigger detection..."
  Start-Process ".WinWord.exe" -ArgumentList "javascript:alert('Attack Triggered');close();" -Wait
  
  Write-Host "[+] Simulation complete. Check SIEM for Image Load mismatch."

• Cleanup Commands:

  # Cleanup the simulation files
  $workDir = "$env:TEMPSimulation_SideLoad"
  if (Test-Path $workDir) {
      Remove-Item -Recurse -Force $workDir
      Write-Host "[+] Cleanup successful."
  } else {
      Write-Host "[-] Cleanup failed: Directory not found."
  }