Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unique Office Loader Deploying Multiple Malware Families

Summary: Palo Alto Networks analyzed a Microsoft Office loader that uses obfuscated malicious macros and a UAC bypass technique first disclosed in August 2016, first seen in early December 2016 and observed in over 650 unique samples accounting for roughly 12,000 malicious sessions. Delivered mainly through phishing emails, it drops multiple commodity malware families, with High Tech, Professional and Legal Services, and Government among the most affected industries; 11 of the 650 samples used BITSAdmin instead of PowerShell for downloads, all in early December 2016.

Key Takeaway: The loader's UAC bypass works by writing to the HKCU\Software\Classes\mscfile\shell\open\command registry key so eventvwr.exe spawns the attacker's executable elevated - a built-in Windows behavior that turns a standard user account into an elevated one without a prompt. With roughly 12,000 malicious sessions across High Tech, Legal Services and Government from a single loader, the volume suggests commodity phishing infrastructure rather than a targeted actor, and the source states it is unclear whether one or more groups are using it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related