New Mockingjay Process Injection Technique Could Let Malware Evade Detection

Jun 27, 2023Ravie LakshmananMalware / Cyber Threat

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems.

“The injection is executed without space allocation, setting permissions or even starting a thread,” Security Joes researchers Thiago Peixoto, Felipe Duarte, and Ido Naor said in a report shared with The Hacker News. “The uniqueness of this technique is that it requires a vulnerable DLL and copying code to the right section.”

Process injection is an attack method that allows adversaries to inject code into processes in order to evade process-based defenses and elevate privileges. In doing so, it could allow for the execution of arbitrary code in the memory space of a separate live process.

Some of the well-known process injection techniques include dynamic link library (DLL) injection, portable executable injection, thread execution hijacking, process hollowing, and process doppelgänging, among others.

It’s worth pointing out that each of these methods requires a combination of specific system calls and Windows APIs to carry out the injection, thereby allowing defenders to craft appropriate detection and mitigation procedures.

What makes Mockingjay stands apart is that it subverts these security layers by eliminating the need to execute Windows APIs usually monitored by security solutions by leveraging pre-existing Windows portable executable files that already come with a memory block protected with Read-Write-Execute (RWX) permissions.

This, in turn, is accomplished using msys-2.0.dll, which comes with a “generous 16 KB of available RWX space,” making it an ideal candidate to load malicious code and fly under the radar. However, it’s worth noting that there could be other such susceptible DLLs with similar characteristics.

The Israeli company said it explored two different methods — self injection and remote process injection — to achieve code injection in a manner that not only improves the attack efficiency, but also circumvents detection.

In the first approach, a custom application is utilized to directly load the vulnerable DLL into its address space and ultimately execute the desired code using the RWX section. Remote process injection, on the other hand, entails using the RWX section in the vulnerable DLL to perform process injection in a remote process such as ssh.exe.

“The uniqueness of this technique lies in the fact that there is no need to allocate memory, set permissions or create a new thread within the target process to initiate the execution of our injected code,” the researchers said.

“This differentiation sets this strategy apart from other existing techniques and makes it challenging for Endpoint Detection and Response (EDR) systems to detect this method.”

The findings come weeks after cybersecurity firm SpecterOps detailed a new method that exploits a legitimate Visual Studio deployment technology called ClickOnce to achieve arbitrary code execution and obtain initial access.