Accenture Hogfish April 2018

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

A menuPass macro deletes files after it has decoded and decompressed them.

RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

RedLeaves can capture screenshots.

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

RedLeaves can gather browser usernames and passwords.