EHA
Home Malware NUMOZYLOD Malware Exploits MSIX Installers for Dangerous Code Execution

NUMOZYLOD Malware Exploits MSIX Installers for Dangerous Code Execution

0

Recent malware campaigns have seen a rise in trojanized MSIX installers targeting users seeking business software. These attacks, orchestrated by the threat actor “eugenfest,” leverage a PowerShell script named NUMOZYLOD to download additional malware payloads. 

NUMOZYLOD is part of a MaaS operation distributing various malware, including ICEDID, REDLINESTEALER, CARBANAK, LUMMASTEALER, and ARECHCLIENT2, underscoring the growing trend of threat actors collaborating in the underground economy to acquire specialized tools and services. 

The exploitation of MSIX as a covert method for bundling and distributing malware alongside legitimate software is also brought to light under this investigation.

NUMOZYLOD Attack Lifecycle

UNC4536 uses malvertising to distribute trojanized MSIX installers of popular software, which contain malicious payloads, such as NUMOZYLOD, that are executed using the Package Support Framework (PSF) during the installation process. 

The attackers leverage the PSF’s ability to run scripts before or after the main application starts by adding configuration items called startScript and endScript, respectively, which allows them to stealthily deploy malicious payloads onto victims’ systems.

 Package build

The analyzed trojanized MSIX files revealed a sophisticated attack technique, as the package structure, including the AppxManifest.xml, config.json, StartingScriptWrapper.ps1, and VFS folders, was carefully engineered to execute a malicious PowerShell script and gain initial access to the target system. 

It leveraged the ‘runFullTrust’ capability to bypass security controls and execute with elevated privileges; also, the VFS folder contained files for future stages of the attack, such as a decryption tool for downloaded payloads. The threat actor distributed the trojanized MSIX files through malvertising campaigns, targeting unsuspecting users.

The wrapper was observed to execute the malicious PowerShell script “Refresh2.ps1” (NUMOZYLOD) specified in the config.json

UNC4536, a malware distributor, uses NUMOZYLOD to deliver various payloads to its “business partners.” Two specific NUMOZYLOD variants were observed distributing CARBANAK and LUMMASTEALER. 

In the CARBANAK campaign, NUMOZYLOD gathered host information, downloaded CARBANAK, and executed it using DLL search order hijacking, while in the LUMMASTEALER campaign, a heavily obfuscated NUMOZYLOD variant delivered the LUMMASTEALER payload.

An obfuscation NUMOZYLOD variant

The NUMOZYLOD malware employs multi-layered obfuscation techniques to evade detection. By analyzing PowerShell script block logging and AMSI events, analysts can deobfuscate the malware and identify its malicious behavior. 

The malware first disables AMSI to bypass security measures, then downloads and executes a secondary payload from a C2 server, which is identified as LUMMASTEALER, gathers system information, and steals sensitive data.

Mandiant Hunt employs a multi-layered detection strategy to identify NUMOZYLOD malware, focusing on unusual file operations, PowerShell activity, and network connections. 

By analyzing events related to MSIX file distribution, “StartingScriptWrapper.ps1” creation, and Virtual File System folder interactions, security teams can detect early indicators of compromise.

The subsequent stages of the attack can be identified with the assistance of monitoring the execution of PowerShell for odd arguments, unexpected script locations, and policy changes.

Also Read:

NO COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Exit mobile version