Kraken Malware Uses Microsoft Windows Error Reporting To Exploit System

Hackers are relentless when it comes to testing the boundaries of software for potential weaknesses to exploit.

It seems that an unknown group of hackers has found a new one.  Based on what researchers at Malwarebytes are seeing, a group of hackers has developed a new fileless attack technique designed to abuse Microsoft's WER (Windows Error Reporting) service. They did this in order to slip unnoticed past whatever detection protocols are in place on the target system.

As with so many other attacks, this one relies on phishing techniques, with an email sent to an unsuspecting employee with access to the network the group wants to infiltrate. The researchers found the malicious file packaged in a .ZIP file and bearing the title "Compensation Manual.doc" with the body of the email claiming that the poisoned document contains detailed information relating to worker compensation rights.

Naturally, the document contains no such information. It does, however, contain a macro designed to load "Kraken.dll" into memory and execute it by way of VBScript. Once that happens, the binary will inject an embedded shellcode into WerFault.exe, which is a part of the aforementioned Windows Error Reporting System.

Here's what the research team had to say about it:

"That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack."

Unfortunately, little else is known about the malicious code at this time, which the research team has dubbed "Kraken." It's designed to terminate if indications of analytic activities are detected, and there's nothing in the code that clearly marks it as being the design of one of the well-known, well-established threat groups. This one's sneaky and difficult to detect. Make sure your IT staff is aware of the threat.