Join Trustwave at the 2023 Gartner Security & Risk Management Summit in London, September 26-28. Learn More

Join Trustwave at the 2023 Gartner Security & Risk Management Summit in London, September 26-28. Learn More

Services
Capture
Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

twi-cloud-lock-color-svg
Managed Security Services

Expand your team’s capabilities and strengthen your security posture

twi-briefcase-color-svg
Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

twi-dashboard-color-svg
Penetration Testing

Subscription- or project-based testing, delivered by global experts

twi-database-color-svg
Database Security

Get ahead of database risk, protect data and exceed compliance requirements

twi-email-color-svg
Email Security & Management

Catch email threats others miss with layered security & maximum control

twi-managed-portal-color
Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trojanized OneNote Document Leads to Formbook Malware

Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and through this ongoing research, we uncovered threat actors using a OneNote document to move Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service. Formbook malware can steal data from various web browsers and from other applications. This malware also has keylogging functionality and can take screenshots. 

One file type that caught our eye on December 6, 2022, was the aforementioned OneNote attachment, with a .one extension attached to a spam email in our telemetry system. It’s not typical to email .one files, so we took a closer look at the email, which is shown below.

 

19365_picture1Figure 1: The email sample as viewed with the MailMarshal Console 

 

Translation

Dear (client) Good Afternoon, I hope this finds you well. 

My name is ___ from the Purchasing team at the ___ company.

Please provide a quote for the details below: 

I await your reply,

Thank You Very Much!

Regards 

Whatsapp:  

 

Once the OneNote attachment is opened, an image lure is displayed. When the user clicks on the ‘View Document’ part of the image, a security warning appears.

 

19366_picture2 Figure 2: The attached OneNote file pdf172.one

 

As shown in Figure 1, MailMarshal’s engine recognized and unpacked the contents of pdf172.one. One of the unpacked components is a Windows Script File (WSF), which is overlaid on the ‘View Document’ part of the image. When a user clicks on the 'View Document" part of the image, this causes the WSF file to be executed, and triggers a standard security alert that a file is being opened from the OneNote application.

Also, it is interesting that the filename of the WSF itself has some deception, likely an attempt to fool scanners. The filename contains a right-to-left override character (U+202E) after 'invoice', which causes the text that follows to be displayed in reverse. So, instead of displaying 'docx.wsf' some applications may display 'fsw.xcoD'.

When a user clicks on the 'View Document" part of the image, this causes the WSF file to be executed, and triggers a standard security alert that a file is being opened from the OneNote application.

 

19367_picture3

Figure 3: The WSF file overlayed to the lure image

 

When the user goes against the warning and clicks ‘OK,’ the malicious behavior of the file will start to manifest. The WSF embedded in the OneNote file launches ‘PowerShell’ commands to download and execute two files from a0745450[.]xsph[.]ru.

 

19368_picture4Figure 4: The WSF contained on the OneNote attachment

 

The first file to be retrieved is a decoy OneNote file. This will be downloaded from a0745450[.]xsph[.]ru/INVESTEMENT[.]one and saved as %temp%\invoice.one. The decoy file will be launched first to hide the downloading of the second file, which contains the payload.

The second file is an executable which will be downloaded from a0745450[.]xsph[.]ru/DT6832.exe and saved as %temp%\system32.exe. This executable is the Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service. Formbook malware can steal data from various web browsers and from other applications. This malware also has keylogging functionality and can take screenshots. 

In sum, a WSF file embedded in a OneNote document is likely to fly under the radar.  It also means that OneNote can now join the list of other Office Documents that need to be inspected for malicious components. As mentioned earlier, it’s not typical to see .one files attached to emails. As a mitigation step, organizations should consider blocking or flagging inbound email attachments with a .one extension.   

For Trustwave MailMarshal customers: Upon detecting this threat, the Trustwave SpiderLabs’ MailMarshal Team released extra heuristics for characteristics of the .one malicious attachment.

IOCs 

Hashes 

Pdf172.one (306792 bytes)
81bd8c431811f83f335735847d42fb4f64f80960 (SHA1) 

DT6832.exe (218925 bytes)
d5ee9183be486bf153d7666ca4301e600ea06087 (SHA1)

INVESTMENT.one (59472 bytes)
33d8fb75f471bdc4ebaff053e87146721f32667a (SHA1) 

URLs 

a0745450[.]xsph[.]ru/DT6832[.]exe

a0745450[.]xsph[.]ru/INVESTEMENT[.]one