Skip to main content

Kraken Malware Uses Microsoft Windows Error Reporting To Exploit System

By October 15, 2020May 5th, 2022Cybersecurity

Hackers are relentless when it comes to testing the boundaries of software for potential weaknesses to exploit.

It seems that an unknown group of hackers has found a new one.  Based on what researchers at Malwarebytes are seeing, a group of hackers has developed a new fileless attack technique designed to abuse Microsoft’s WER (Windows Error Reporting) service. They did this in order to slip unnoticed past whatever detection protocols are in place on the target system.

As with so many other attacks, this one relies on phishing techniques, with an email sent to an unsuspecting employee with access to the network the group wants to infiltrate. The researchers found the malicious file packaged in a .ZIP file and bearing the title “Compensation Manual.doc” with the body of the email claiming that the poisoned document contains detailed information relating to worker compensation rights.

Naturally, the document contains no such information. It does, however, contain a macro designed to load “Kraken.dll” into memory and execute it by way of VBScript. Once that happens, the binary will inject an embedded shellcode into WerFault.exe, which is a part of the aforementioned Windows Error Reporting System.

Here’s what the research team had to say about it:

“That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.”

Unfortunately, little else is known about the malicious code at this time, which the research team has dubbed “Kraken.” It’s designed to terminate if indications of analytic activities are detected, and there’s nothing in the code that clearly marks it as being the design of one of the well-known, well-established threat groups. This one’s sneaky and difficult to detect. Make sure your IT staff is aware of the threat.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.