Text Template Abuse for Code Execution

General
,
1

This one was new to me!

Text template files can contain C# or Visual Basic code that could be compiled and executed at build time. Threat actors can create or modify .tt files to execute code in the context of a trusted process in workstations of developers. Furthermore, threat actors could tamper .tt files and merge them into an organization pipeline to achieve code execution in supply chain compromise scenarios. Execution of text template files is conducting by invoking one of these four binaries:

  • TextTransform.exe
  • TextTransformCore.exe
  • t4.exe
  • MSBuild.exe
2

Important friction to note, blocking/hunting on .tt files, EDR or SEG, would impact/find True Type fonts.

UPDATE: .tt is a much older True Type font, .ttf being the current standard. So file extension blocks may still work for many orgs.

You may also run into a Dell driver file named ServiceNotifications.tt

So I’d target the executables in this case, but warning, the hash appears to change very, very often.

Here’s a small sampling of hashes. And not all are in VT.

TextTransform.exe
v15.0.28307.539
MD5: d6af3758c1a61055f2eb8cd3f5fffcb3
SHA-256: 6eb1c97adff608030ea63827d00a380b86aff0dcbdf11af3cd4db3f7050f6f39
https://www.virustotal.com/gui/file/6eb1c97adff608030ea63827d00a380b86aff0dcbdf11af3cd4db3f7050f6f39

TextTransform.exe
v10.0.30319.1
MD5: 43e4d44e36035d0cfcad0f19c4103254
SHA-256: 96e1039bbfd775ff7db5c993a16e263f3905afb4f6935fe390a04336dc5ed5f5
https://www.virustotal.com/gui/file/96e1039bbfd775ff7db5c993a16e263f3905afb4f6935fe390a04336dc5ed5f5

TextTransform.exe
v18.0.11828.198
MD5: 2188f4d77c1483c6c542e995733c7b71
SHA-256: 8899a6c5f711d91f36ec8a886afaeebd995cc33bf9f5586f2bfcd2120ef92190
https://www.virustotal.com/gui/file/8899a6c5f711d91f36ec8a886afaeebd995cc33bf9f5586f2bfcd2120ef92190

TextTransform.exe
v16.0.32407.333
MD5: 50122f6e7332fcdb1999177b740b0f3e
SHA-256: 92592334a820ea8b8e37db4d8e35496cf9a11e84b738beeac560aad0bad2bf3d
https://www.virustotal.com/gui/file/92592334a820ea8b8e37db4d8e35496cf9a11e84b738beeac560aad0bad2bf3d

TextTransform.exe
v16.0.36530.21
MD5: 55fbf94e56142c194321ce7dd368c3a9
SHA-256: 4c46677fec835c940bd5c7f3d75831f7fb16aa4834cc11b71d5ccf00d4cadb0f
https://www.virustotal.com/gui/file/4c46677fec835c940bd5c7f3d75831f7fb16aa4834cc11b71d5ccf00d4cadb0f

TextTransform.exe
v16.0.35931.194
MD5: 7d675a819ad1427657c87ebc0b312c70
SHA-256: 5c0ad4adecdbc20d3038b7b159d14328c0b4dd775b2ae54f4b600ae15624ce42
https://www.virustotal.com/gui/file/5c0ad4adecdbc20d3038b7b159d14328c0b4dd775b2ae54f4b600ae15624ce42

TextTransform.exe
v18.0.11602.191
MD5: 51511721c324fff4367553e3c8bf4ffb
SHA-256: 1b35e902b2ba3ab4473969ebf2ec6aad585dfb437cdd02dc007b04aff90120d7
https://www.virustotal.com/gui/file/1b35e902b2ba3ab4473969ebf2ec6aad585dfb437cdd02dc007b04aff90120d7

TextTransform.exe
v18.0.11715.348
MD5: ba9ad339cd848c0e17f1a78733da3562
SHA-256: 63dbf28b6aac0badd7d514bbf1fb4e23d12ca20fc8854d1a319b7617188b66cb
https://www.virustotal.com/gui/file/63dbf28b6aac0badd7d514bbf1fb4e23d12ca20fc8854d1a319b7617188b66cb

TextTransformCore.exe
v18.7.1212.40225
MD5: 8da9ffb5b0f03a0ea53dffec0439f5c5
SHA-256: 5e8706a25298c6d3f2d9c86c95f45c65cc6c5f5c419327076e3412a881ed81c2
https://www.virustotal.com/gui/file/5e8706a25298c6d3f2d9c86c95f45c65cc6c5f5c419327076e3412a881ed81c2

There’s only 30 code results in GitHub for TextTransformCore.exe, mostly security related in the last month.

Truely an undocumented marvel.