After several weeks of nothing happening malware-related at work, my phone pinged and alerted me to someone caught red-handed clicking on something they shouldn’t have. An employee opened a message from a local car dealer with what was assumed to be a safe attachment. The dealer was even nice enough to comply with our policy of sending PII in an encrypted ZIP. Thankfully, endpoint protection snagged the encloser Word document as soon as the employee attempted to open it. So as the alert dropped into our inboxes, the helpdesk phone rang from a slightly upset employee that just had her Friday morning routine interrupted.

While our helpdesk tech assisted the employee and tripped off the virus scan, I went to work on some analysis. My first course of action was to pull the offending message out of the mail queue and open it on my investigation box. The first red flag was the generic and rather weak attempt to get someone to open a password protected ZIP. But the second flag was that the email was a reply from a message originally sent by the employee to this same dealer back in 2016. At this point, my assumption is the dealership has suffered an email breach and this attacker is simply injecting themselves into old conversations attempting to get any traction they can.

I check out the message headers and compare them to the published mail and web infrastructure. Red flag number 3 – the message did not originate from any of the known infrastructures. Since the MX and DNS point to GoDaddy, then we can assume their mail is hosted there as well. Checking the web hosting provider points us to a colo firm who’s front page testimonial talks about helping support car sales thru optimized IT services, which reinforces my assumption.

Message Headers:

Whois results:

So my last piece of analysis was to deploy the malware in a sandbox. I used JoeSandbox Basic for this task, mostly due to lack of my own sandbox. Honestly, I don’t want a sandbox of my own. Cats poop there…anyways. The report confirmed my suspicions. Once opened, the Word document attempts to get the victim to enable macros. From there a Powershell process is spawned, but I could not determine if this happens when opened or once macros where enabled. This process calls out to known malicious IPs attempting to download additional malware.

Based on all of this, my conclusion is the dealership either had their mail server breached or someone’s computer at the dealership is owned. We let the dealership know of the potential issue, and cross our collective fingers no one else fell for this. This is a great example of how attackers are focusing on smaller financial institutions. These attacks not only target the FI’s themselves, but the vendors, customers, and other businesses they work with on a regular basis. It scares me to think what could happen once they get inside…especially if they know what they have just gained access to.