Authors James Melton & Jay Townsend

Executive Summary

Ghost.APT.Injector is a sophisticated malware campaign leveraging deceptive Zoom meeting invitations, evasive execution paths, and a firmware-level persistence model using Trusted Platform Module (TPM)-anchored Mobile Device Management (MDM) profiles. Unlike typical malware, this operation persisted beyond traditional remediation by silently enrolling victim machines into an attacker-controlled MDM system that redeploys payloads via Microsoft Autopilot mechanisms.

Introduction

The attack originated from a spear-phishing email containing a legitimate-looking Zoom link (hXXps://deltek(dot)zoom(dot)us/xxxxxxx). When accessed, it led to the execution of a malicious file camouflaged as a Zoom installer. Despite its benign appearance, behavioral analysis via Joe Sandbox (Analysis ID: 1706753) and system telemetry showed a heavily obfuscated payload initiating persistence via Windows internals and TPM-based device trust anchors.

Attack Chain Overview

Initial Access:

  • Delivery via spear-phishing using a Zoom meeting link.
  • User enticed to download and execute a rogue installer named Zoom_cm_fbk8wkgZ9vvrZo4_...exe.

Execution:

  • Spoofed Zoom binary executed from Downloads and AppData\Roaming\Zoom\ZoomDownload\Installer.exe.
  • Bypassed AV via standard execution paths and filename similarity.

Persistence:

  • Scheduled tasks and registry-based autoruns.
  • Device was silently enrolled into a fake AzureAD/MDM tenant via registry template injections.
  • Persistent MDM profile anchored in TPM; ensuring attacker control post-cleanup.

Privilege Escalation:

  • DLL side-loading via rundll32.exe, Zoom.exe, and Installer.exe.
  • Usage of background tasks and deceptive processes.

Defense Evasion:

  • Anti-VM via WMI probes (Win32_DiskDrive, Win32_LogicalDisk).
  • Sleep-based sandbox delays (e.g., OutputDebugStringW).
  • Disabling Windows Defender and its components.

Credential Access:

  • Injected scripts into Outlook OST cache to harvest authentication artifacts.
  • Possible access to domain tokens and fallback MFA mechanisms.

Discovery & Lateral Movement:

  • Reconnaissance using WMI, RPC, SMB, and remote service enumeration.
  • Spread is not activated in this sample but fully primed.

Data Collection & Exfiltration:

  • Enables Proxy in registry and proxies all browser traffic through a logging server via AWS as a relay or exfil point.
  • Host profiling, credential capture, and browser traffic proxying.
  • Staging in Temp directories and exfil via encrypted TLS to AWS/Cloudflare/CDN endpoints.

Impact:

  • Device was functionally “owned” via MDM/TPM persistence.
  • Re-infection possible even after complete disk wipe.

Advanced Persistence: TPM + Ghost MDM Profiles

This threat’s core innovation lies in TPM-tied persistence:

  • Device auto-enrolls into rogue MDM profile.
  • TPM trust anchors block legitimate re-enrollment.
  • Policy control allowed:
    • Defender & firewall overrides.
    • Proxy/DNS hijacking.
    • Stealth application installs via PowerShell.

MITRE ATT&CK Mapping Highlights

Based on Sandbox data and forensic findings:

  • Initial Access: T1566.002 (Spearphishing Link)
  • Execution: T1204.002 (User Execution: Malicious File)
  • Persistence: T1053.005 (Scheduled Task), T1547.001 (Registry Run Key), T1546.016 (MDM Enrollment)
  • Privilege Escalation: T1574.002 (DLL Side-Loading)
  • Defense Evasion: T1497.001 (VM Detection), T1562.001 (Disable or Modify Tools)
  • Credential Access: T1556.001 (Credential Dumping via Outlook)
  • Discovery: T1087 (Account Discovery), T1016 (System Network Configuration Discovery)
  • Command and Control: T1071.001 (Web Protocols), T1001 (Data Obfuscation)

Digital Forensics Artifacts

  • SHA1: 0DE00D66181496777AA55EBFA3F1CEC039A3BAC1
  • SHA256: 029B416DC635E5312398A6A689123BA4C9CF1D511C64FF209AE05D8FD22DE909
  • SHA512: BA05FC29C75655ADBF408F8D5B1D11D2ACC147166C99E33D6D665D4B372E6049FAA14BF8328B6B22C3F3FD4F0924FC9EA0C8DD25EE018A6C07F446E1B3DD42CA
  • Domains: deltek.zoom.us, edge-log-gateway-go, static.cloudflareinsights.com, several AWS ELBs

Remediation & Containment Actions

File & Malware Removal

  • Purge registry keys, startup folders, firewall rules, and scheduled tasks.
  • Identify and remove Zoom_cm_... and Installer.exe variants.

TPM/MDM Recovery

  • Run dsregcmd /leave to force MDM disjoin.
  • Perform TPM clear and UEFI factory reset.
  • Use AADInternals to revoke join artifacts.

Identity & System Rebuild

  • Reimage using secure ISO.
  • Disable automatic MDM enrollment.
  • Rotate domain credentials and enforce new MFA policies.

Attribution & Campaign Analysis

  • Likely criminal APT with access to enterprise-level tooling.
  • MaaS infrastructure using legitimate U.S.-based cloud services (Zoom, Cloudflare, AWS).
  • Fluent in English; no direct nation-state links confirmed.

Final Notes

This campaign represents a pivot in attacker methodology—firmware-assisted control paired with enterprise enrollment abuse. The use of Microsoft Autopilot-style provisioning for malware persistence is rare, extremely dangerous, and requires serious reevaluation of endpoint trust, especially in hybrid cloud environments.

Sources:

  • Joe Sandbox Report #1706753
  • Local forensic evidence via WMI & Registry captures
  • MDM policy reverse engineering
  • Manual threat remediation logs