Original Release Date: 6/26/2020
Huntress Labs discovered an attack using fake Windows error logs to store ASCII characters disguised as hexadecimal values that decode to malicious payloads used in script-based attacks. At first glance, the log file appears to be legitimate with timestamps and operating system references; however, the hexadecimal values convert to text and form the script to contact the threat actor’s command and control server. The malware delivered in these attacks is used to download additional malware and collect data on the compromised host. Several tricks are used to rename the legitimate file, hide it in plain sight as an existing scheduled task, and use a malicious payload stored in a realistic error log.
The NJCCIC recommends users adopt a defense-in-depth cybersecurity strategy, keep systems patched and up to date, and maintain cybersecurity best practices, including physical security. Additional technical information can be found in the Huntress Labs blog post.