Kraken Malware Uses Microsoft Windows Error Reporting To Exploit System

October 15, 2020

Written by wukovits

kraken malware uses microsoft windows error reporting to exploit systemHackers are relentless when it comes to testing the boundaries of software for potential weaknesses to exploit.

It seems that an unknown group of hackers has found a new one.  Based on what researchers at Malwarebytes are seeing, a group of hackers has developed a new fileless attack technique designed to abuse Microsoft’s WER (Windows Error Reporting) service. They did this in order to slip unnoticed past whatever detection protocols are in place on the target system.

As with so many other attacks, this one relies on phishing techniques, with an email sent to an unsuspecting employee with access to the network the group wants to infiltrate. The researchers found the malicious file packaged in a .ZIP file and bearing the title “Compensation Manual.doc” with the body of the email claiming that the poisoned document contains detailed information relating to worker compensation rights.

Naturally, the document contains no such information. It does, however, contain a macro designed to load “Kraken.dll” into memory and execute it by way of VBScript. Once that happens, the binary will inject an embedded shellcode into WerFault.exe, which is a part of the aforementioned Windows Error Reporting System.

Here’s what the research team had to say about it:

“That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.”

Unfortunately, little else is known about the malicious code at this time, which the research team has dubbed “Kraken.” It’s designed to terminate if indications of analytic activities are detected, and there’s nothing in the code that clearly marks it as being the design of one of the well-known, well-established threat groups. This one’s sneaky and difficult to detect. Make sure your IT staff is aware of the threat.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

Key Considerations for Effective Cybersecurity Implementation

Consider this: In the realm of cybersecurity, things often get tangled in the web of "you should do it anyway" arguments. Yet, for busy business owners bombarded with daily "must-dos," deciphering the essentials from the fluff can feel like a cyber maze. We aim to...

Unlocking Small Business Success: The Impact of AI in a Digital Era

In the rapidly evolving business landscape, staying competitive necessitates embracing technological advancements. Artificial Intelligence (AI), once perceived as a luxury for larger enterprises, is now accessible to small businesses, offering new opportunities for...