Malware Analysis Possible Supply Chain on Ooma

[Sandbox Breaker]

One of my clients had an edr alerts from Ooma Office. After investigation we believe it's a part of an early Supply Chain attack. The process was Dormant until after 5pm business hours when it started spawning lolbins and doing discovery actions.

Vt says 2 engines. Their main installer is signed but the omma office.exe process isn't. Certificate chain issue with the file also. Very low file prevelance and defender flags it with two detections. I'm thinking there may be some hidden shell code in it. This reminds me of the 3cx VoIP hack. ea649ee7430b61db82c8f23470f27f956baf88a245f159af96ea49159c2656e6 | Triage

 

[Xeno1234]

I put this into a few sandboxes to see if there any any detections. All come out fully clean and dont appear to show the file doing anything at all. Sophos Intelix says the code execution cannot continue for "omma office.exe" as its missing ffmpeg.dll. Not saying its not malicious, just is possibly broken on some systems, sandbox evasive, or extremely evasive in general.

In Kaspersky Opentip, "omma office.exe", it shows strings that look like this. Seems encrypted or something of that matter to me.

 

[Sandbox Breaker]

I put this into a few sandboxes to see if there any any detections. All come out fully clean and dont appear to show the file doing anything at all. Sophos Intelix says the code execution cannot continue for "omma office.exe" as its missing ffmpeg.dll. Not saying its not malicious, just is possibly broken on some systems, sandbox evasive, or extremely evasive in general.

In Kaspersky Opentip, "omma office.exe", it shows strings that look like this. Seems encrypted or something of that matter to me.
View attachment 279968
View attachment 279967

Yeah I'll be speaking to the devs. To many suspicious indicators. There is circumstacial and technical evidence that this isn't normal.

 

[Xeno1234]

Yeah I'll be speaking to the devs. To many suspicious indicators. There is circumstacial and technical evidence that this isn't normal.

Yep. Those string’s definitely aren’t normal for a legitimate file. Defender also flagging it probably doesn’t help its case either. Kaspersky said this file has around 100 users and it’s trust level is unknown.

 

[Sandbox Breaker]

Yep. Those string’s definitely aren’t normal for a legitimate file. Defender also flagging it probably doesn’t help its case either. Kaspersky said this file has around 100 users and it’s trust level is unknown.

Correct. Anyone else want to take a look VirusTotal

 

[Sandbox Breaker]

Well if something makes it to the news... We saw it here first.