Fake Windows Error Logs Hide Malicious Payloads in Plain Sight

NJCCIC Alert

Original Release Date: 6/26/2020

Summary

Huntress Labs discovered an attack using fake Windows error logs to store ASCII characters disguised as hexadecimal values that decode to malicious payloads used in script-based attacks. At first glance, the log file appears to be legitimate with timestamps and operating system references; however, the hexadecimal values convert to text and form the script to contact the threat actor’s command and control server. The malware delivered in these attacks is used to download additional malware and collect data on the compromised host. Several tricks are used to rename the legitimate file, hide it in plain sight as an existing scheduled task, and use a malicious payload stored in a realistic error log.

Recommendations

The NJCCIC recommends users adopt a defense-in-depth cybersecurity strategy, keep systems patched and up to date, and maintain cybersecurity best practices, including physical security. Additional technical information can be found in the Huntress Labs blog post.

New Jersey Cybersecurity & Communications Integration Cell

2 Schwarzkopf Dr, Ewing Township, NJ 08628

njccic@cyber.nj.gov

OUR COMMITMENT

The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.

Agency Seals of State of NJ, NJOHSP and NJCCIC

STAY CONNECTED:

View our Privacy Policy here.

View our Site Index here.