deeplook into apt and how to detect and defend v1.0
TRANSCRIPT
A deep look into a Chinese advanced attack. Understand it, learn from it
and how to detect and defend against attacks like this.
Michael Gough – Founder
MalwareArchaeology.com
MalwareArchaeology.com
Who am I• Blue Team Defender Ninja, Malware Archaeologist, Logoholic
• I love “properly” configured logs – they tell us Who, What, Where, When and hopefully How
Creator of
“Windows Logging Cheat Sheet”
“Windows PowerShell Logging Cheat Sheet”
“Windows Splunk Logging Cheat Sheet”
“Malware Management Framework”
• Co-Creator of “Log-MD” – Log Malicious Discovery Tool
– With @Boettcherpwned – Brakeing Down Security PodCast
• @HackerHurricane also my Blog
MalwareArchaeology.com
Goal
• Interaction – Don’t be a Ding Dong, ask a question… you WILL be rewarded for positive synergy!
• Learn how us Ninja’s do it so you can too
• New Tool for YOU to use!!!
MalwareArchaeology.com
• We discovered this May 2012
• Met with the Feds ;-)
Why you should listen to me?
MalwareArchaeology.com
2014 - We gave an infected VM to one of the Big IR Firms… They came back “Yup.. It’s clean” #Fail
WINNTI 2014
• Much more “sophisticated” than before
– They updated their approach
– MUCH more complex
– This is NOT your typical P0wnage
• Boy did we catch them in the act
• I am sharing so you can learn how!
MalwareArchaeology.com
History
• WINNTI has been around for 5+ years attacking the gaming industry
• It is known the Chinese hackers are behind it– Kaspersky and the Feds
• Not quite State Sponsored, but pretty darned good
• I would consider this your “typical” APT
• We saw new things each time they attacked
• Maybe it is State Sponsored practicing?
MalwareArchaeology.com
WINNTI 2012 Summary
• Pretty typical• DLL Injection
– \WBEM– \Windows– \System32 – Files stored– \ProgramData – Files stored
• Sysprep Cryptbase.dll exploit• Boot up back door, deletes on load, writes on shutdown
– Killed by pulling the power ;-)
• New Services installed• Multiple infections per machine hoping you miss one
MalwareArchaeology.com
WINNTI 2014
• New stuff
• Dude !
• What triggered it?
• What changed?
• Avoided the methods they used before
• Fortunately we were doing REALLY good logging. We are Ninja’s after all
MalwareArchaeology.com
WINNTI 2014
• Summary of improvements for WINNTI 2014– PlugX used as a base, modules added– Dll injection on SQL Server (5 dirs. Deep)
• Allowed for SQL Mgmt utilities to enable XP Command Shell and run .NET commands
– Binary infector – altered existing management binaries to call main payload – and STILL worked!
– Driver infector – Added driver to look like existing management software
– Hid scripts in the Registry– Hid payload in the Registry!
• The Registry is a Huuuuuuuuuuuuuuuuge Database
MalwareArchaeology.com
WINNTI 2014
• Popped a user, not an Admin, they know Who we are and What we do… Yay LinkedIn
• Patient 0 – User phished (not an admin) and I believe they exploited Office to gain admin access
• Dropped their initial malware payload
• Used Backup software creds to then PoP a Domain Controller
• Spread from there all over ;-(– Same MO as 2012
MalwareArchaeology.com
Files Dropped and gone
• Used public accessible locations• C:\Users\Public
• C:\Windows\Web
• C:\Perflogs
• Deleted Infector files fast… almost all
• Left some on disk
MalwareArchaeology.com
Files Dropped
• SQL Server bin directory (5 deep) – Only on SQL Servers
– Cscapi.dll (Dll injection)
• \SysWOW64
– Qwave.dll - Normal on Workstations, NOT on servers
• Splunk and Altiris Directories - Dropped a driver named like the app
– Splunk.sys
– Altiris.sys
MalwareArchaeology.com
Initial Infectors
• \Users\Public– C.exe– Infect.exe– Infectsys.exe– 64.dll– CompanyName.exe – Specific to us!
• C:\Perflogs – Command binary• C:\Windows\Web - .INI files for permission changes• C:\Windows\Temp – VB Scripts
– Netfxupdate.ax
• C:\Windows\SysWOW64– Qwave.dll (Servers only)– SysWow64.sys– AxScriptHost70.dll
MalwareArchaeology.com
Initial Infectors
• Perflogs– C.exe – Communication to infected system
• Thanks for the Port and Password
• For once WE compromised THEM! – Now who is “sophisticated” ;-)
MalwareArchaeology.com
Persistence• C:\Program Files\Common Files
– WLXSys64.sys – NOT ON DISK ANYWHERE ????
• Modified existing service
– WERCplSupport (Who needs WER Support)
– Changed ServiceDll to:
• Program Files\Common Files\WLXSys64.sys
MalwareArchaeology.com
• So how did it load if it was NOT on disk???
Persistence
• WERCplSupport Service failed to start ?
• YAY Windows !!!! THANK YOU Microsoft!!!!
• For allowing a service to retry over and over and over and… well… forever until the file shows up, or the malware places it there
• Once the file existed, “WERCplSupport” started and the system was infected calling other malicious binaries
MalwareArchaeology.com
Persistence
• Avoided leaving key files behind like they did before, well one anyways… the persistence piece
MalwareArchaeology.com
So what led us there?• Command Line Logging !!!!
• At the time ONLY Win 8.1 and Win 2012 R2
• Which we had, We then saw this in our alerts of suspicious commands (Cscript & cmd.exe & cacls & net & takeown & pushd & attrib)
• Scripts too
MalwareArchaeology.com
Hidden in the Registry• Command Line execution led us to the Keys.
Main payload and scripts to infect were stored in the registry – Classes and Client Keys
MalwareArchaeology.com
Hidden in the Registry• HEX in some cases where infection not
complete or when we recreated in the lab because we were missing something (the infected persistence binary)
• Binary when complete, encrypted in some way
MalwareArchaeology.com
Hiding in the Registry
• This was new for WINNTI 2014
• They added three values to the Keys
• HKLM\Software\Clients or \Classes
– putfile
– file
– read
• This found on only a few systems to hide another backdoor– HKLM\Software\Wow6432Node\BINARY\Acrobat.dxe
MalwareArchaeology.com
HKLM\Software\Clients• putfile
• file
• read
MalwareArchaeology.com
4D5A = MZ in HEX
Persistence
• Infector… One for the DLL (infect.exe) and one for the Driver (InfectSys.exe)
• Altered system management binaries
– McAfeeFrameworkService
– BESClientHelper
– Attempted a few others, some failed
MalwareArchaeology.com
• We tried the infector on several other system files and it worked
Persistence
• Infected management binary read key, decrypted payload and dropped into:– \Program Files\Common Files
• NOW WERCplSupport ServiceDll exists!
• As soon as it was loaded… it was deleted making it hard for us to find it
MalwareArchaeology.com
But we were better than that ;-)
So what led us there?
• Malware Discovery Baseline
• Compared infected system hashes (Suspect) to a known good system hashes (MFR)
• Showed some single hashes in directories that were odd to us (our own management software)?
• So we looked for these binaries across all systems
• ONLY the infected system had these odd hashes
MalwareArchaeology.com
Persistence
• BAM! Got ya – PROCMon on bootup
MalwareArchaeology.com
FINALLY !
• Now we had all the pieces
• Recreated in the lab so we knew we had it all
• High confidence remediation was now able to start
• And it did NOT take 210 days for MTTD ;-)
MalwareArchaeology.com
FINALLY !
• Malware Management allowed us to setup alerts on artifacts from other malware analysis
• Of course our own experience too
• Malware Discovery allowed us to find odd file hashes
• Malware Analysis gave us the details
MalwareArchaeology.com
How YOU can
Detect thisNinja Tips
MalwareArchaeology.com
How we harvested malware
• Some infections hung
• Ran process check for any “parentless” processes
• Found a couple systems hung and harvested the malware from these systems
• Command line logging showed us where to look
• Ninja Tip:
– Parse through processes that do NOT have a parent!!!
MalwareArchaeology.com
How we harvested malware
• File Copy loop in Directories discovered– @echo off
– cls
– md captured
– :Redo
– robocopy . WooHooo /E /B /r:0 /w:1 /np /xo /xd WooHoo
– Goto Redo
– :End
• Ninja Tip:– Great to do in Labs for User space \AppData
MalwareArchaeology.com
Top Priority
• Enable and Configure Process Command Line– KB3004375 - https://support.microsoft.com/en-us/kb/3004375
• Enable Advanced Audit Policy in Windows– The “Windows Logging Cheat Sheet”– Audit Process Creation = Success 4688– Audit Logon = Success & Failure 4624– Audit File Share = Success 5140– Audit File System = Success 4663– Audit Registry = Success 4663 & 4657– Audit Filtering Platform Connection = Success 5156
(Any/Any min)– Services already captured by System Log 7045 & 7040– PowerShell Logging (needs profile.ps1) 500
MalwareArchaeology.com
Alert for Suspicious Commands
• #1 trigger for a compromise• (EventCode=4688) (at.exe OR bcdedit.exe OR calcls.exe OR
chcp.exe OR cmd.exe OR cscript.exe OR ipconfig.exe OR mimikatz.exe OR nbtstat.exe OR nc.exe OR netcat.exe OR netstat.exe OR nmap OR nslookup.exe OR bcp.exe OR sqlcmd.exe OR OSQL.exe OR ping.exe OR powershell.exe OR powercat.ps1 OR psexec.exe OR psexecsvc.exe OR psLoggedOn.exe OR procdump.exe OR rar.exe OR reg.exe OR route.exe OR runas.exe OR sc.exe OR schtasks.exe OR sethc.exe OR ssh.exe OR sysprep.exe OR systeminfo.exe OR system32\\net.exe OR takeown.exe OR tracert.exe OR vssadmin.exe OR whoami.exe OR winrar.exe OR wscript.exe OR winrm.* OR winrs.* OR wmic.exe OR wsmprovhost.exe)
MalwareArchaeology.com
Size Matters!!!
• Bigger IS better…
– For Size of Registry Keys
– Very few over 20k
– WINNTI was 296k
• RegScanner – NirSoft
• Reglister - @dnlongen – python script
– https://github.com/dnlongen/RegLister
MalwareArchaeology.com
Enhanced Logging• Sysmon
– Gives you images loaded (.DLL) look for unsigned!
– Gives you Drivers loaded (.SYS)
– Gives you Hashes – Upload to VirusTotal
• Windows Logging Service (WLS)
– Alternative logging agent
– More than Sysmon provides– http://energy.gov/sites/prod/files/cioprod/documents/Splunkified_-
_the_Next_Evolution_of_Log_Analysis_-_Green_and_McCord.pdf
– http://digirati82.com/wls-information/
MalwareArchaeology.com
Malware Discovery
• Once a system was labeled “suspect”
• Compare known good hashes to suspect system
• Odd files will show up
• What????
• You don’t have a Log Management solution
– SIEM
MalwareArchaeology.com
INTERMISSION
MalwareArchaeology.com
Introducing
• Use in a Malware Analysis Lab
• Investigate a suspect system
• For Incident Response
• Produce IT/InfoSec/Audit/Compliance report comparing actual Audit Log system settings to CIS and “Windows Logging Cheat Sheet” recommendations
• Assist in tweaking File and Registry auditing
MalwareArchaeology.com
Introducing
• Log Malicious Discovery tool
• When you run the tool, it tells you what auditing and settings to configure that it requires
• Once the system and/or GPO is configured1. Clear the logs
2. Infect the system
3. Run Log-MD
4. Review “Report.csv” in Excel
MalwareArchaeology.com
Functions
• Audit Report of log settings compared to:
– The “Windows Logging Cheat Sheet”
– Center for Internet Security (CIS) Benchmarks
• 3 White lists to filter out the known good
– By IP Address
– By Process Command Line and/or Process Name
– By File and Registry locations (requires File and Registry auditing to be set)
• Report.csv of data from logs specific to security
MalwareArchaeology.com
Crypto Event
• C:\Users\Bob\AppData\Roaming\vcwixk.exe
• C:\Users\Bob\AppData\Roaming\vcwpir.exe
• C:\WINDOWS\system32\cmd.exe /c del C:\Users\Bob\AppData\Roaming\vcwixk.exe >> NUL
• C:\Windows\System32\vssadmin.exe delete shadows /all /Quiet
MalwareArchaeology.com
Malicious Word Doc
MalwareArchaeology.com
Malicious Word Doc con’t
MalwareArchaeology.com
So what do we get?
• WHAT Processes executed
• WHERE it executed from
• IP’s to enter into Log Management to see WHO else opened the malware
• Details needed to remediate infection
• Details to improve your Active Defense!
• I did this in…
MalwareArchaeology.com
15 Minutes!
In Summary• Malware is noisy• We CAN detect it• Logs can hold all types of information
– It’s NOT just for Forensics anymore
• All we have to do is:– Enable the Logs– Configure the Logs– Gather the Logs– Harvest the Logs
• Look for Top Security related events• Use the “Windows Logging Cheat
Sheet”• GET Log-MD – It’s FREE!
MalwareArchaeology.com
Resources• Websites
– MalwareArchaeology.com
– Log-MD.com The tool
• The “Windows Logging Cheat Sheet”– MalwareArchaeology.com
• Malware Analysis Report links too– To start your Malware Management program
MalwareArchaeology.com
Questions?
• You can find us at:
• @HackerHurricane• @Boettcherpwned• Log-MD.com
• MalwareArchaeology.com• HackerHurricane.com (blog)
• http://www.slideshare.net
MalwareArchaeology.com