Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Case Study: From Bazar Loader to Network Reconnaissance

Summary: Unit 42 documented a BazarLoader infection that began with a macro-enabled .xlsb Excel spreadsheet using the DocuSign logo and a fake invoice page, which pulled a malicious DLL from pawevi[.]com and ran it via regsvr32.exe. About 41 minutes after infection, the host began Cobalt Strike HTTPS traffic to gojihu[.]com and yuxicu[.]com, and roughly two minutes later AdFind.exe appeared in C:\ProgramData to enumerate users, computers, file shares and trusts in the Active Directory environment.

Why it matters: The full chain from a single opened spreadsheet to Active Directory enumeration ran in under an hour, and the source notes this is the common pattern seen before attackers hit an organization with Conti or Ryuk ransomware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related