eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
2024-06-15 - This blog has been updated with additional details regarding the purpose behind email signature modification.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
In April 2024, eSentire's Threat Response Unit (TRU) identified and traced hands-on-keyboard activity to a SocGholish infection initiated by a fake browser update. The fake update used obfuscated JavaScript to evade detection and establish a foothold in the environment.
Attackers used living-off-the-land techniques to collect sensitive credentials and notably, configured web beacons in both email signatures and network shares to map out local and business-to-business relationships. This behavior would suggest an interest in exploiting these relationships to target business peers of interest.
The infection began when the user visited a compromised website and downloaded a fake browser update named "Update.js," disguised as a JavaScript file (MD5: 44a0b845b30dcdc26c8017a6714c46e9).
The compromised webpage contained injected JavaScript (Figure 1), and the link led to obfuscated JavaScript code (Figure 2).
Figure 1: Injected JavaScript
Figure 2: Snippet of the obfuscated JavaScript
The snippet of the deobfuscated script is shown below (Figure 3).
Figure 3: Deobfuscated script
The script first checks if the browser is controlled by automation tools, such as Selenium, using the “navigator.webdriver” property. If this property is true, indicating that the browser might be under script or automation control, it triggers a function to load a script from a specified SocGholish URL and then terminates (lines 8-12). This behavior is highly likely designed to evade automated analysis and detection.
Next, the script checks whether the browser window has been manipulated significantly (e.g., if the difference between the outer and inner height or width of the window is unusually large). This can indicate an attempt to detect if it’s running in a potentially monitored or unconventional environment. If the manipulation is detected, it loads another script from a different URL (lines 14-21).
Additionally, the script examines whether the user is logged into a WordPress site by searching for specific cookie identifiers like “wordpress_logged_in” or “wp-settings”. If these cookies are detected, the script refrains from executing any further actions (lines 23-27).
If none of the mentioned conditions trigger, the script sets up an event listener for mouse movements. Upon the first mouse movement detected, it removes this listener and loads another script from yet another URL. This is possibly a technique to only trigger script loading after user interaction, which can help bypass certain types of detection mechanisms that look for malicious activity upon page load (lines 32-37).
The _0x4d8183 function (lines 40-47) is dynamically used to insert a script element into the webpage. This function takes a URL as an argument, creates a <script> element, sets its src attribute to the provided URL, and appends it to the first script tag found in the document. This method of script injection allows external code to be run within the webpage context.
These are triggered under specific conditions in the script that have been mentioned, executing external code when certain criteria are met, such as the detection of automation tools or particular user interactions.
The downloaded malicious Update.js file contains an obfuscated JavaScript (Figure 4).
Figure 4: Contents of Update.js
The script makes a POST request to the URL hxxps://tfuq.register.arpsychotherapy[.]com/editContent. The “send” method sends the request to the server with data “lpZw+wmbGiagWaoqNM/HmfLjMBYLsTv26io31cysSA==” (Figure 5).
Figure 5: Deobfuscated Update.js
Post-exploitation Activity
17 minutes after the malicious JavaScript payload was executed by the user, we identified hands-on-keyboard activity on the victim asset. This activity included stored password extraction, decryption, and reconnaissance.
Password Store Extraction
The threat actors extracted saved login data from Microsoft Edge and Google Chrome and copied them to a temporary file for exfiltration using the following commands:
"C:\Windows\System32\cmd.exe" /C type "C:\Users\username\AppData\Local\Google\Chrome\User Data\Default\Login Data" >> "C:\Users\username\AppData\Local\Temp\2\radC7958.tmp"
"C:\Windows\System32\cmd.exe" /C type "C:\Users\username\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" >> "C:\Users\username\AppData\Local\Temp\2\rad01734.tmp"
Shortly after, another command was run to copy login data files from both Edge and Chrome browsers to a different user's Downloads directory, then log activity or errors to a temporary file (username – is the primary infected user, usename_2 is another user on the same machine):
Staging the credential data under another user is likely done for redundancy purposes in case the main files are discovered.
Encryption Key Retrieval
Next, the threat actors attempted to run a base64-encoded command via PowerShell. The decoded command retrieves and decrypts Edge’s and Chrome's encryption keys for passwords and cookies using the DPAPI (Data Protection API) and outputs the results in a temporary file.
Subsequently, the threat actors attempted to execute and run the PowerShell command 10 times, which performs several operations related to downloading, extracting, and setting up a portable version of Python on an infected machine under the “AppDataLocalConnectedDevicesPlatform” path to possibly run additional Python payloads.
The command lists above all HTML (.htm) files in the directory used for storing Microsoft Outlook email signatures and replaces the </body> tag with a modified version that includes an <img> tag right before the original </body> tag. This <img> tag inserts an image from a remote server (specified by the URL in the command). The command then redirects any output from the PowerShell command to a temporary file for logging purposes.
The purpose of the command is to steal NetNTLM hashes via the email signatures (special thanks to Max Anderson, an Assistant Vice President at Pondurance, for bringing this to our attention). You can read more about the technique here.
Network Discovery
The threat actors then listed the members of the “domain users” group in a domain environment by running the C:\Windows\system32\net1 group "domain users" /domain command.
The last command is responsible for creating the shortcuts within the network share. The target path points to the network share location. The shortcut icon points to the SocGholish C2 server 170.130.55[.]72/Documentation.ico.
We assume that the purpose of this command is similar to the email signature case mentioned above.
The SocGholish intrusion campaign showcased a social engineering approach to first gain entry through fake updates and then initiate a series of scripted actions to extract sensitive data and monitor user interactions.
What did we do?
Our team of 24/7 SOC Cyber Analysts isolated the affected host and notified the customer of suspicious activities.
What can you learn from this TRU Positive?
The initial infection vector being a drive-by download disguised as a legitimate browser update highlights the critical need for user education about the risks associated with downloading files from unverified or suspicious sources.
The extraction and manipulation of sensitive data, such as login information from browsers and modifying email signatures for potentially monitoring interactions, underline the importance of comprehensive monitoring of network behavior and the analysis of unusual activities that could indicate a host compromise.
The use of encoded PowerShell scripts to decrypt stored passwords and the setting up of a portable Python environment for further malicious activities stresses the importance of understanding post-exploitation behaviors and potential indicators of compromise to better defend against and respond to intrusions.
Recommendations from our Threat Response Unit (TRU):
We recommend implementing the following controls to help secure your organization against SocGholish malware:
Encourage your employees to use password managers instead of using the password storage feature provided by web browsers. Use master passwords where applicable.
We recommend modifying the default 'open-with' settings for script files, ensuring they open with a basic text editor like Notepad instead of executing.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
