GrimResource: New attack uses MSC files and Windows XSS vulnerability

A new command execution technique, dubbed “GrimResource,” uses special MSC files and a Windows XSS vulnerability to execute code via the Microsoft Management Console.

In the summer of 2022, Microsoft disabled macros by default in Office. As a result, attackers began experimenting with new file types in attacks . Initially, they began using ISO images and password-protected ZIP files, as these file types did not properly display Mark of the Web (MoTW) flags in the extracted files.

After Microsoft fixed this issue, attackers started using new attachments, such as Windows Shortcuts and OneNote files.

See also: SolarWinds Serv-U flaw actively used in attacks

Now, hackers are using Windows MSC (.msc) files, which are used in the Microsoft Management Console (MMC) to manage various aspects of the operating system.

The misuse of MSC files for malware deployment was previously reported by cybersecurity Genian. Motivated by this research, Elastic discovered a new MSC file distribution technique, while also identifying the exploitation of an old but unpatched Windows XSS flaw. It is located in apds.dll and is used to deploy Cobalt Strike.

Elastic found a sample ('sccm-updater.msc') recently uploaded to VirusTotal that leverages the GrimResource technique. This means that attacks using this command execution technique are already underway. However, the worst part is that no antivirus engine on VirusTotal has flagged it as malicious.

According to analysts, this campaign appears to be using the technique to deploy Cobalt Strike, with the goal of initially gaining access to networks. However, it could certainly be used to execute other commands as well.

Furthermore, the XSS vulnerability has not been patched even in the latest version of Windows 11.

How the GrimResource technique works

The GrimResource attack begins with a malicious MSC file that attempts to exploit a cross-site scripting (XSS) vulnerability in the 'apds.dll' library. This allows JavaScript to be executed via a crafted URL.

See also: Phoenix UEFI vulnerability affects hundreds of Intel computer models

The vulnerability was reported to Adobe and Microsoft in October 2018, but Microsoft deemed it not to be an immediate fix. As of March 2019, the XSS bug remained unpatched and it is unclear whether it was ever addressed.

The malicious MSC file distributed by attackers contains a reference to the vulnerable APDS resource in the StringTable. When the target opens it, MMC processes it and triggers JS execution in the context of 'mmc.exe.'

Elastic explains that the XSS vulnerability can be combined with the 'DotNetToJScript' technique to execute .NET code through the JavaScript engine, bypassing any security in place.

The sample in question uses “transformNode” obfuscation to avoid ActiveX warnings, while the JS code reconstructs a VBScript that uses DotNetToJScript to load a .NET component named “PASTALOADER”.

PASTALOADER retrieves a Cobalt Strike payload from environment variables defined by VBScript, creates a new instance of "dllhost.exe" and installs it using the "DirtyCLR" technique along with function unhooking and indirect system calls.

GrimResource Technique: What to Watch Out For

System administrators are asked to pay attention to the following:

• File operations related to apds.dll and involving mmc.exe.
• RWX memory allocations from mmc.exe coming from script engines or .NET components
• Suspicious executions via MCC, especially processes created by mmc.exe with .msc file arguments.
• Unusual .NET COM object creation in non-standard script interpreters such as JScript or VBScript.
• Temporary HTML files in the INetCache folder, as a result of APDS XSS redirect.

Elastic Security has provided more details about the GrimResource technique on GitHub and provided YARA rules to help network defenders identify suspicious MSC files.

Extra protection measures

To protect themselves from such threats, users should ensure that their operating system and all applications are up to date with the latest security patches (although in this case, the vulnerability has not been patched).

Additionally, it is important to avoid opening MSC files from untrusted sources. Users should be cautious with email attachments and avoid downloading files from dubious websites.

See also: Chinese hackers UNC3886 exploit Fortinet, Ivanti and VMware vulnerabilities

Using a strong and up-to-date antivirus software can help detect and prevent malicious MSC files. Modern antivirus programs often include detection capabilities for known exploits and malware.

Finally, educating and raising awareness among users about social engineering techniques and cyber threats can help prevent attacks. Users who are aware of the tactics used by attackers are less likely to fall victim to these attacks.

source: www.bleepingcomputer.com