Menu
New ransomware abuses Windows PowerShell, Word document macros

New ransomware abuses Windows PowerShell, Word document macros

The PowerWare ransomware is written completely in the Windows PowerShell scripting language

A new ransomware program written in Windows PowerShell is being used in attacks against enterprises, including health care organizations, researchers warn.

PowerShell is a task automation and configuration management framework that's included in Windows and is commonly used by systems administrators. It has its own powerful scripting language that has been used to create sophisticated malware in the past.

The new ransomware program, dubbed PowerWare, was discovered by researchers from security firm Carbon Black and is being distributed to victims via phishing emails containing Word documents with malicious macros, an increasingly common attack technique.

The Carbon Black team found PowerWare when it targeted one of its customers: an unnamed healthcare organization. Multiple hospitals have recently fallen victim to ransomware attacks.

The malicious Word documents masqueraded as an invoice, the Carbon Black researchers said. When opened, it instructed users to enable Word editing and content, claiming that these actions were necessary to view the files.

In reality, enabling editing disables Microsoft Word's "preview" sandbox and enabling content allows the execution of the embedded macro code, which Office blocks by default.

If the malicious macro code is allowed to run, it opens the Windows command line (cmd.exe) and launches two instances of PowerShell (powershell.exe). One instance downloads the PowerWare ransomware from a remote server in the form of a PowerShell script and the other instance executes the script.

After this point, the infection routine is similar to that of other ransomware programs: The script generates an encryption key; uses it to encrypt files with specific extensions, including documents, pictures, videos, archives and source code; sends the key to the attackers' server and generates the ransom note in the form of an HTML file.

Based on the payment instructions, the attackers use the Tor anonymity network to hide their command-and-control server. The initial ransom is $500, but it goes up to $1,000 after a couple of weeks.

PowerWare is not the first ransomware implementation in PowerShell. Security researchers from Sophos found a similar Russian-language ransomware program back in 2013. Then in 2015, they found another one that used the "Los Pollos Hermanos" logo from the Breaking Bad TV show.

While PowerShell-based malware is not new, its use has increased in recent months and it is arguably harder to detect than traditional malware because of PowerShell's legitimate use and popularity, especially in enterprise environments.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments