SUBTLE-PAWS

Lateral movement for the STEADY#URSA campaign relies solely on the use of USB drives in an attempt to deliver and spread the malware from system to system.

MITRE ATT&CK Matrix Tactics Techniques Execution T1059: Command and Scripting Interpreter

Throughout the entire attack campaign, most of the code executed by the malware was PowerShell.

The exploitation chain is relatively simple: it involves the target executing a malicious shortcut (.lnk) file which loads and executes a new PowerShell backdoor payload code.

Persistence is established by creating a new registry key at “ HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ” which uses an invoke expression to load and execute the “run” registry key saved into “ HKCU:\System “.

Persistence is established by creating a new registry key at “ HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ” which uses an invoke expression to load and execute the “run” registry key saved into “ HKCU:\System “.

These files contain a single PowerShell one liner containing a single variable consisting of a large Base64 string of the SUBTLE-PAWS backdoor.

A small amount of PowerShell obfuscation is used to break up strings in order to evade detection.

In an effort to improve OPSEC (Operational Security), the attackers introduced a failsafe where if the script fails to communicate with the IP over HTTPS, the script forcefully removes itself

This string gets decoded and executed towards the end of the script.

Lateral movement for the STEADY#URSA campaign relies solely on the use of USB drives in an attempt to deliver and spread the malware from system to system.

Executed code is encoded using a key and presented in Base64 in an effort to hide the original commands.

If the script fails to communicate with the IP over HTTPS, the script forcefully removes itself