This campaign reuses a JPEG “carrier” image that hides a malicious payload between BaseStart- and -BaseEnd tags. Initial access comes via Microsoft Equation Editor exploitation (CVE-2017-11882) in a crafted attachment, which downloads an HTA. The HTA runs PowerShell to retrieve a .NET binary stage. Reuse of the same image across many samples suggests the operator relies on repeatable components.
The researcher observed TELERADIO_IB_OBYEKTLRIN_BURAXILIS_FORMASI.xIs containing the Equation Editor exploit. The chain fetches an HTA from a malicious IP, which executes PowerShell to download a second payload hosted on another IP. The final stage is a .NET binary embedded in the JPEG carrier and recovered via the BaseStart/-BaseEnd delimiters. Similar carrier images were found in dozens of VirusTotal submissions.
Patch CVE-2017-11882 and keep Office updated. Block or restrict HTA execution, enforce PowerShell script signing, and use URL/IP filtering to deny access to the hosting infrastructure.
Detect and quarantine the attachment and HTA stage, and alert on PowerShell download activity to the identified IPs. Isolate affected hosts and perform memory forensics to locate and remove the in-memory .NET payload.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary has exploited a client‑side vulnerability that serves a malicious HTA file. The HTA launches PowerShell with a command line that embeds a malicious payload (e.g., Invoke‑Expression to launch calc.exe ) encoded in Base64. The payload is wrapped between the strings BaseStart- and -BaseEnd so that the attacker can reliably extract it on‑the‑fly. The command executed on the compromised host is:
This command line satisfies both selection_base_start and selection_base_end conditions, causing the rule to fire.
Regression Test Script: The following self‑contained PowerShell script reproduces the malicious behavior and can be run on any Windows host with the telemetry enabled above.
Cleanup Commands: Remove any artefacts and terminate the spawned process if needed.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
