Authored By Anandeshwar Unnikrishnan,Sakshi Jaiswal,Anuradha M 

McAfee Labs has recently observed a new Malware campaign which used malicious OneNote documents to entice users to click on an embedded file to download and execute the Qakbot trojan. 

OneNote is a Microsoft digital notebook application that can be downloaded for free. It is a note-taking app that allows collaboration across organizations while enabling users to embed files and other artifacts. It is installed by default in Microsoft Office 2021 and Microsoft 365.   

Malicious Actors are always trying to find new ways in to infect their victims. Such as their shift to LNK files after Microsoft introduced a policy change disabled office macros by default. Due to a feature that allows users to attach files to OneNote documents it makes them a good alternative to LNK files as distribution vehicle to deploy their malware. This blog contains analysis on how OneNote documents are used malicious and two specific campaigns that made use of OneNote documents to download and execute the Qakbot malware.  

OneNote Campaigns in the wild 

Figure 1 Campaign Heatmap

Figure 1  shows the geo wise distribution of McAfee customers detecting malicious OneNote files. 

 Based on the telemetry from our endpoints we have identified the following threat families deployed through OneNote documents: 

Iceid 
Qakbot
RedLine
AsyncRat
Remcos
AgentTesla
QuasarRAT
XWORM
Netwire
Formbook
Doubleback 

Overview Of Malicious OneNote Documents 

A holistic view of the phishing campaigns that weaponize OneNote document is shown in Figure 2 below.  The malicious document is delivered in either zip files or ISO images to the target through phishing emails. We have observed that most of the malicious documents either have Windows batch script that invokes Powershell for dropping the malware on the system or Visual Basic scripts that does the same.

Figure 2 Campaign Overview

The generic theme of the email is invoice or legal related. These types of themes are more likely to be opened by the vicim. An example email body and attachment is shown in Figure 3 and 4. 

Figure 3 Email Body
Figure 4 Attachment

A Deep Dive into OneNote File Format 

File Header 

To understand how the data is laid out in the file, we need to examine it at byte level. Taking a close look at OneNote document gives us an interesting observation as its magic bytes for the header is not a trivial one. Figure 5 shows the first 16 bytes of the document binary. 

Figure 5 OneNote Header

The first 16 bytes need to be interpreted as GUID value {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}. We can use the official documentation for OneNote specification to make sense of all the bytes and its structuring. Figure 6 shows header information taken from the OneNote specification document. 

Figure 6 OneNote Specification

The Data Stream in OneNote, Say Hello To FileDataStoreObject 

To find the embedded data in a OneNote document, we need to learn more about the FileDataStoreObject which has a GUID value of {BDE316E7-2665-4511-A4C4-8D4D0B7A9EAC}. The structure that holds the data is shown below: 

guidHeader (16 bytes) 
Size: 16 bytes 
Value: {BDE316E7-2665-4511-A4C4-8D4D0B7A9EAC} 
cbLength 
Size: 8 bytes 
Value: Size of the data 
unused 
Size: 4 bytes 
reserved 
Size: 8 bytes 
FileData 
Size: Variable 
guidFooter 
Size: 16 bytes 
Value: {71FBA722-0F79-4A0B-BB13-899256426B24} 

The FileData member of the FileDataStoreObject is the key member that holds the embedded data in the OneNote document. The size can be retrieved from the cbLength member. 

Figure 7 shows the “on disk” representation of the FileDataStoreObject  This is taken from a malicious OneNote document used to spread the Qakbot payload. The guidHeader for the data object is highlighted in yellow and the data is shown in red. As it is evident from the image the data represents a text file which is a script to launch PowerShell.  

Figure 7 Embedded data in Data object

For more information on the OneNote specification, go to reference section  

Artifact Extraction  

Now we have an idea of what the data object is, with this knowledge we can automate the process of extracting embedded artifacts for further analysis from the OneNote document by following the below algorithm. 

Search for FileDataStoreObject GUID in the binary. 
Interpret the FileDataStoreObject structure  
Retrieve cbLength member (size of the data represented by FileDataStoreObject) 
Read N bytes (cbLength) after Reserved 8 bytes in FileDataStoreObject. 
Dump the bytes read on to disk 
Repeat above steps for every FileDataStoreObject present in the binary

Embedded Executable Objects In OneNote  

Execution Of Embedded Entities  

Looking at the runtime characteristics of OneNote Desktop application we have observed that when an embedded file gets executed by the user, it is stored temporarily in the OneNote directory in the User’s Temp location. Each directory with GUID values represents a different document opened in the OneNote application. 

Figure 8 OneNote directory in Temp

By analyzing numerous malicious documents, we have been able to create a “test” OneNote document that executes a batch file that contains the “whoami” command. The image in Figure  9 show the batch file being created in the user’s temp location. 

Figure 9 OneNote drops embedded artifacts in Temp directory

Qakbot Campaign 1: 

This section contains specific details on a Qakbot campaign. In campaign 1, the malware author used phishing emails to deliver malicious OneNote document either as attachment or a URL link to zip file containing the OneNote document. The OneNote contained aHTA file that once executed would make use of  the curl utility to download Qakbot and then execute it. 

Infection Flow: 

Figure 10 Infection Chain

Spam email delivers a malicious OneNote file as an attachment or a link to a ZIP file that contains a OneNote file. 
OneNote file contains an embedded HTA  attachment and a fake message to lure users to execute the HTA  file 
The HTA file uses curl utility to download the Qakbot payload and is executed by rundll32.exe. 

Technical Analysis: 

The OneNote file with the embedded HTA file is shown in the Figure 11. Once this OneNote file is opened, it prompts the user with a fake message to double-click on open to view the attachment. 

Figure 11 OneNote Template

Upon clicking the Open button, it drops the HTA file with the name Open.hta to the %temp% Folder and executes it using mshta.exe. 

Figure 12 Drop file in Temp location

The HTA file contains obfuscated script as shown below: 

Figure 13 Obfuscated HTA script

The HTA file is loaded by MSHTA and creates a registry key in HKEY_CURRENT_USERSOFTWARE with obfuscated content as shown below: 

Figure 14 Registry key creation

The obfuscated registry is then read by MSHTA and the obfuscated code is de-obfuscated. The code is then initialized to a new function object as shown in Block1. 
Finally, MSHTA calls this function by passing the malicious URL as a parameter and then deletes the registry key as shown in Block 2.

De-obfuscated content from the HTA file is shown below: 

Figure 15 Deobfuscated HTA content

Curl is used to download the malicious DLL file in C:ProgramData Folder with .png extension. The script will then execute the downloaded file with Rundll32.exe with the export function Wind.

Figure 16 Downloaded payload in ProgramData

A fake error message is displayed after loading the downloaded payload and MSHTA is terminated.  

Figure 17 Fake error message

Figure 18 shows the process tree of Qakbot: 

Figure 18 Process Chain

IOCs: 

Type 
Value 
Product 
Detected 

Campain 1 – OneNote File 
88c24db6c7513f47496d2e4b81331af60a70cf8fb491540424d2a0be0b62f5ea 
Total Protection and LiveSafe 
VBS/Qakbot.a 

Campain 1 – HTA File 
e85f2b92c0c2de054af2147505320e0ce955f08a2ff411a34dce69c28b11b4e4 
Total Protection and LiveSafe 
VBS/Qakbot.b 

Campain 1 – DLL File 
15789B9b6f09ab7a498eebbe7c63b21a6a64356c20b7921e11e01cd7b1b495e3 
Total Protection and LiveSafe 
Qakbot-FMZ 

Campaign 2: 

Examining Malicious OneNote Documents 

The OneNote document for campaign 2 is shown in Figure 19. At first glance it it appears that there is a ‘Open’ button embedded within the document. The message above the ‘Open’ button instructs the user to “double click” in order to receive the attachment.

Figure 19 Malicious content

A closer look at the document reveals the graphical elements are all images placed in a layered style by the malicious actor. By moving the icons aside, we can see the malicious batch file which when executed downloads the payload from the Internet and executes on the target system. 

Figure 20 Hidden Malicious dropper script

Execution Of Payload Dropper 

Upon execution of the batch file, Powershell will be invoked and it fetch the Qakbot payload from Internet and execute it on the target system. This section will cover details of dropper script used to deploy QakBot. The Figure 21 Show the process tree after the execution of the script and you can see that powershell.exe was launched by cmd.exe and the parent of cmd.exe is onenote.exe. 

Figure 21 Process chain

The contents of process cmd.exe (7176) are shown below.  

Figure 22 Cmd.exe properties

The base64 decoded batch file is shown in Figure 23.  This will use powershell to download the payload and then execute it with rundll32.exe

Figure 23 Base64 Decoded instructions in dropper

 IOCS 

Type 
Value 
Product 
Detected 

Campain 2 – Zip File 
000fb3799a741d80156c512c792ce09b9c4fbd8db108d63f3fdb0194c122e2a1 

 

Total Protection and LiveSafe 
VBS/Qakbot.a 

Campain 2 – OneNote File 
2bbfc13c80c7c6e77478ec38d499447288adc78a2e4b3f8da6223db9e3ac2d75 
Total Protection and LiveSafe 
One/Downloader.a 

Campain 2 – Powershell File 
b4dd3e93356329c076c0d2cd5ac30a806daf46006bdb81199355952e9d949424 
Total Protection and LiveSafe 
PS/Agent.gs 

Campain 2 – OneNoteFile 
a870d31caea7f6925f41b581b98c35b162738034d5d86c0c27c5a8d78404e860  
Total Protection and LiveSafe 
VBS/Qakbot.a 

 
 
 
 

Domains: 

starcomputadoras.com 

Conclusion: 

Malware authors are getting more sophisticated when it comes to hiding their payloads. This Blog highlights the recent Qakbot campaign that delivers its payload which uses the OneNote application as a delivery mechanism. McAfee Customers should keep their systems up-to-date and refrain from clicking links and opening attachments in suspicious emails to stay protected. 

 References: 

https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-onestore/405b958b-4cb7-4bac-81cc-ce0184249670 

https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-onestore/8806fd18-6735-4874-b111-227b83eaac26 

The post Rising Trend of OneNote Documents for Malware delivery appeared first on McAfee Blog.

Read More