Successful Malware Incident Investigation for a Major Ukrainian Public Agency by FS Group

The Challenge

A malware-infected file was identified on an employee’s PC. Although the file was automatically deleted, the cybersecurity department should have ensured that the infected file was completely removed and that the file system was threat-free.

Tasks to be completed:

• Locate the remaining infected files
• Understand the causes of the incident
• Prevent further damage. 

However, the agency lacked the relevant expertise and tools needed to investigate the incident promptly.

With sensitive public data and critical system operations at risk, the stakes were high.

For this reason, the agency requested FS Group’s incident response services.

The Solution

1. FS group used the digital forensic platform Autopsy Digital Forensics to examine the provided SSD with the infected file system.
2. By searching with keywords from the infected document, the FS Group specialist found the folder where the infected file was likely located. Then, using keywords from this folder, FS Group found antivirus logs with information about the malware.
3. The antivirus scan results indicated that the Word files were infected through the file “vbaProject.bin”. “Microsoft Visual Basic for Applications (VBA)” is a binary file that contains code for VBA programs, enabling process automation in Microsoft Office products such as Excel, Word, PowerPoint, and others. It may include macros that perform specific tasks within programs supporting VBA.

Using this information, the FS group assumed that the documents were infected via malicious Office macros. When a user downloads the Office document and is convinced by fake warnings to enable macros, the malicious code executes and infects the user’s system.

Result

As a result, FS Group

• Located the source of infected files in the system. 
• Identified the vulnerability: the way malware infected the employees’s PC.
• Prepared a detailed 20-page report with screenshots, references, and links.
• Optimized investigation time and took less than 1 week to conduct a detailed incident investigation and prepare the report.
• Supported the agency’s cybersecurity team and took timely and appropriate steps to ensure the safety of the critical organization