Dream Job-2

Scenario

In this Sherlock players will continue with threat intelligence and analyze malware used by the Lazarus Group.

Executive Summary

A Lazarus Group job-lure kit was triaged statically. Two macro-enabled Office files pose as Lockheed Martin recruitment material: one macro reaches for a follow-on document on a lookalike domain, the other builds a hidden folder under the user’s profile and checks for a database file in it. A separate ISO carries a UPX-packed executable that is a legitimate PDF reader under an internal-sounding name, with its original name and first-seen date recovered from the PE and VirusTotal. MITRE’s profiles for DRATzarus and Torisma supply the code lineage, the anti-debugging API, the packing and the C2 cipher details.

Artifacts

• Archive: DANGER.zip → extract with 7z or unzip. The password is in DANGER.txt beside it
• ISO image: BAE_HPC_SE.iso → list and extract with 7z, never mount
• Macro documents: Salary_Lockheed_Martin_job_opportunities_confidential.doc and 17.dotm → olevba for macros, file for document properties
• Reference: MITRE ATT&CK software pages for DRATzarus (S0694) and Torisma (S0678)

Gotcha: The archive password is not the usual infected. Read DANGER.txt first instead of guessing.

Resource Development

The DRATzarus entry on attack.mitre.org (S0694) names the earlier Lazarus family whose code it overlaps. Pure reference lookup, no evidence file needed.

Initial Access

Run olevba against the document and read the extracted VBA. One hard-coded URL on a lookalike domain points at a .docx, the macro’s next stage.

olevba Salary_Lockheed_Martin_job_opportunities_confidential.doc

OLE documents keep their creator and last-saved-by names in the summary stream, which file prints directly. Take the Author field here and Last Saved By for Q11.

file Salary_Lockheed_Martin_job_opportunities_confidential.doc

Same file output as Q10, different field. The two names differ, so two accounts touched the document.

Tip: Author and Last Saved By are separate fields. Do not reuse the Q10 value.

Execution

Dump the macros from 17.dotm and search the VBA for directory-creation and path-building calls. The path is built from the UserProfile environment variable in a function that returns the DLL path, so the answer is everything after the profile root, with a leading backslash as the format hint shows.

olevba 17.dotm > m.txt

Discovery

The same m.txt dump shows the macro testing whether a file exists at that path before it continues. The name looks like a local database.

grep -n -i 'notice' m.txt

Defense Evasion

List the ISO with 7z rather than mounting it. A single executable sits in the image; extract it for the next questions.

7z l BAE_HPC_SE.iso

7z x BAE_HPC_SE.iso

Hash the executable and look the SHA-256 up on VirusTotal. The file’s PE data carries no useful version info, so the name list on the VirusTotal record is where the original name shows up. A legitimate PDF reader under an internal-sounding name is the lure.

sha256sum InternalViewer.exe

Pull the full VirusTotal record for the Q6 hash and read the first_seen_itw_date attribute. It is an epoch value, so convert it to UTC.

sha256sum InternalViewer.exe

python3 -c 'import datetime;print(datetime.datetime.fromtimestamp(1597307263,datetime.UTC))'

Tip: The SHA-256 starts adce894e and ends c3ea802. “First seen in the wild” is a different field from the first-submission date.

The section table of InternalViewer.exe shows UPX0 and UPX1, the standard UPX layout, and VirusTotal tags it upx too. The question wants the expanded name, not the abbreviation.

strings -a InternalViewer.exe | grep -i upx

Same MITRE page as Q1 (S0694). The description names the API call used to check for an attached debugger, the Debugger Evasion behavior (T1622).

The Torisma page (S0678) describes how the sample is obfuscated: a compression algorithm, answered as the algorithm name followed by the word “compression”.

Gotcha: MITRE’s page renders the lowercase l in “lz4” like a capital I, so a literal copy gives Iz4. The algorithm is LZ4, with an L.

Command and Control

The Torisma entry (S0678) lists its C2 encryption. Besides XOR it uses a second, uncommon cipher, written as the format hint shows: four letters, a hyphen, two digits.

Attack Summary

Phase	Action
Initial Access	Lockheed Martin recruitment-themed documents delivered as lures (inferred from the content)
Execution	Macro in the .doc holds a hard-coded URL to a .docx on a lookalike domain
Execution	17.dotm macro creates a folder under the user’s AppData\Local\Microsoft
Discovery	Same macro checks for a database file in that folder
Defense Evasion	ISO carries a UPX-packed PDF reader renamed to InternalViewer.exe
Defense Evasion	DRATzarus checks for debuggers; Torisma is LZ4-compressed
Command and Control	Torisma encrypts C2 traffic with XOR and a second cipher

IOCs

Type	Value
URL	hxxps[://]markettrendingcenter[.]com/lk_job_oppor[.]docx
Domain	markettrendingcenter[.]com
Document	Salary_Lockheed_Martin_job_opportunities_confidential.doc
Document	17.dotm
ISO	BAE_HPC_SE.iso
File	InternalViewer.exe (renamed SumatraPDF, UPX-packed)
SHA-256	adce894e...c3ea802 (InternalViewer.exe, truncated)
Folder	%USERPROFILE%\AppData\Local\Microsoft\Notice
File	wsuser.db

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Attachment	T1566.001	Job-themed lure documents (inferred from the content)
User Execution: Malicious File	T1204.002	Victim opens the macro documents or the ISO payload
Command and Scripting Interpreter: Visual Basic	T1059.005	VBA macros in the .doc and 17.dotm
Masquerading	T1036	PDF reader renamed to InternalViewer.exe
Obfuscated Files: Software Packing	T1027.002	InternalViewer.exe packed with UPX
Obfuscated Files: Compression	T1027.015	Torisma packed with LZ4
Debugger Evasion	T1622	DRATzarus debugger check
Encrypted Channel: Symmetric Cryptography	T1573.001	Torisma C2 encrypted with XOR and a second cipher
File and Directory Discovery	T1083	Macro checks for a database file in the created folder

Defender Takeaways

Block or strip macros in documents from outside. Both lure files carry VBA that does the real work: one holds a hard-coded external URL, the other builds a folder under the user’s profile. Blocking macros in files with Mark-of-the-Web removes both paths, and olevba-style extraction at the mail gateway surfaces the URL before a user sees the document.

Compare a PE’s original filename with its on-disk name. The renamed reader is a legitimate signed-looking tool under a new name. A detection on OriginalFileName mismatch, or a hash-reputation lookup, flags it, especially when launched from a mounted ISO.

Treat mounted ISOs as an execution source. The payload shipped inside an ISO image. Alert on process creation from newly mounted virtual drives, and consider disabling ISO auto-mount for standard users.

Hunt on the macro’s footprint. A new, unfamiliar folder under AppData\Local\Microsoft followed by a lookup for a .db file inside it is a cheap file-creation signal that real Microsoft components do not produce.

Conclusion

Nothing in this kit needed a zero-day: macro documents, a renamed PDF reader in an ISO, UPX and LZ4 packing and a homemade C2 cipher. Each layer is visible to static triage in minutes, so a macro and file-reputation policy that acts on these simple traits would have cost the operator the whole chain.