Deeplook into apt and how to detect and defend v1.0

A deep look into a Chinese advanced
attack. Understand it, learn from it
and how to detect and defend
against attacks like this.
Michael Gough – Founder
MalwareArchaeology.com

Who am I
• Blue Team Defender Ninja, Malware Archaeologist, Logoholic
• I love “properly” configured logs – they tell us Who, What, Where,
When and hopefully How
Creator of
“Windows Logging Cheat Sheet”
“Windows PowerShell Logging Cheat Sheet”
“Windows Splunk Logging Cheat Sheet”
“Malware Management Framework”
• Co-Creator of “Log-MD” – Log Malicious Discovery Tool
– With @Boettcherpwned – Brakeing Down Security PodCast

Goal
• Interaction – Don’t be a Ding Dong, ask a
question… you WILL be rewarded for positive
synergy!
• Learn how us Ninja’s do it so you can too
• New Tool for YOU to use!!!

• We discovered this
May 2012
• Met with the Feds ;-)
Why you should listen to me?
2014 - We gave an infected VM to one of the Big
IR Firms… They came back “Yup.. It’s clean” #Fail

WINNTI 2014
• Much more “sophisticated” than before
– They updated their approach
– MUCH more complex
– This is NOT your typical P0wnage
• Boy did we catch them in the act
• I am sharing so you can learn how!

History
• WINNTI has been around for 5+ years attacking
the gaming industry
• It is known the Chinese hackers are behind it
– Kaspersky and the Feds
• Not quite State Sponsored, but pretty darned
good
• I would consider this your “typical” APT
• We saw new things each time they attacked
• Maybe it is State Sponsored practicing?

WINNTI 2012 Summary
• Pretty typical
• DLL Injection
– WBEM
– Windows
– System32 – Files stored
– ProgramData – Files stored
• Sysprep Cryptbase.dll exploit
• Boot up back door, deletes on load, writes on shutdown
– Killed by pulling the power ;-)
• New Services installed
• Multiple infections per machine hoping you miss one

WINNTI 2014
• New stuff
• Dude !
• What triggered it?
• What changed?
• Avoided the methods they used before
• Fortunately we were doing REALLY good
logging. We are Ninja’s after all

WINNTI 2014
• Summary of improvements for WINNTI 2014
– PlugX used as a base, modules added
– Dll injection on SQL Server (5 dirs. Deep)
• Allowed for SQL Mgmt utilities to enable XP Command Shell
and run .NET commands
– Binary infector – altered existing management
binaries to call main payload – and STILL worked!
– Driver infector – Added driver to look like existing
management software
– Hid scripts in the Registry
– Hid payload in the Registry!
• The Registry is a Huuuuuuuuuuuuuuuuge Database

WINNTI 2014
• Popped a user, not an Admin, they know Who we
are and What we do… Yay LinkedIn
• Patient 0 – User phished (not an admin) and I
believe they exploited Office to gain admin access
• Dropped their initial malware payload
• Used Backup software creds to then PoP a
Domain Controller
• Spread from there all over ;-(
– Same MO as 2012

Files Dropped and gone
• Used public accessible locations
• C:UsersPublic
• C:WindowsWeb
• C:Perflogs
• Deleted Infector files fast… almost all
• Left some on disk

Files Dropped
• SQL Server bin directory (5 deep) – Only on SQL
Servers
– Cscapi.dll (Dll injection)
• SysWOW64
– Qwave.dll - Normal on Workstations, NOT on servers
• Splunk and Altiris Directories - Dropped a driver
named like the app
– Splunk.sys
– Altiris.sys

Initial Infectors
• UsersPublic
– C.exe
– Infect.exe
– Infectsys.exe
– 64.dll
– CompanyName.exe – Specific to us!
• C:Perflogs – Command binary
• C:WindowsWeb - .INI files for permission changes
• C:WindowsTemp – VB Scripts
– Netfxupdate.ax
• C:WindowsSysWOW64
– Qwave.dll (Servers only)
– SysWow64.sys
– AxScriptHost70.dll

Initial Infectors
• Perflogs
– C.exe – Communication to infected system
• Thanks for the Port and Password
• For once WE compromised THEM!
– Now who is “sophisticated” ;-)

Persistence
• C:Program FilesCommon Files
– WLXSys64.sys – NOT ON DISK ANYWHERE ????
• Modified existing service
– WERCplSupport (Who needs WER Support)
– Changed ServiceDll to:
• Program FilesCommon FilesWLXSys64.sys
• So how did it load if it was NOT
on disk???

Persistence
• WERCplSupport Service failed to start ?
• YAY Windows !!!! THANK YOU Microsoft!!!!
• For allowing a service to retry over and over
and over and… well… forever until the file
shows up, or the malware places it there
• Once the file existed, “WERCplSupport”
started and the system was infected calling
other malicious binaries

Persistence
• Avoided leaving key files behind like they did
before, well one anyways… the persistence
piece

So what led us there?
• Command Line Logging !!!!
• At the time ONLY Win 8.1 and Win 2012 R2
• Which we had, We then saw this in our alerts
of suspicious commands (Cscript & cmd.exe &
cacls & net & takeown & pushd & attrib)
• Scripts too

Hidden in the Registry
• Command Line execution led us to the Keys.
Main payload and scripts to infect were stored
in the registry – Classes and Client Keys

Hidden in the Registry
• HEX in some cases where infection not
complete or when we recreated in the lab
because we were missing something (the
infected persistence binary)
• Binary when complete, encrypted in some
way

Hiding in the Registry
• This was new for WINNTI 2014
• They added three values to the Keys
• HKLMSoftwareClients or Classes
– putfile
– file
– read
• This found on only a few systems to hide another backdoor
– HKLMSoftwareWow6432NodeBINARYAcrobat.dxe

HKLMSoftwareClients
• putfile
• file
• read
4D5A = MZ in HEX

Persistence
• Infector… One for the DLL (infect.exe) and
one for the Driver (InfectSys.exe)
• Altered system management binaries
– McAfeeFrameworkService
– BESClientHelper
– Attempted a few others, some failed
• We tried the infector on several
other system files and it worked

Persistence
• Infected management binary read key, decrypted
payload and dropped into:
– Program FilesCommon Files
• NOW WERCplSupport ServiceDll exists!
• As soon as it was loaded… it was deleted making
it hard for us to find it
But we were better
than that ;-)

So what led us there?
• Malware Discovery Baseline
• Compared infected system hashes (Suspect) to a
known good system hashes (MFR)
• Showed some single hashes in directories that
were odd to us (our own management software)?
• So we looked for these binaries across all systems
• ONLY the infected system had these odd hashes

Persistence
• BAM! Got ya – PROCMon on bootup

FINALLY !
• Now we had all the pieces
• Recreated in the lab so we knew we had it all
• High confidence remediation was now able to
start
• And it did NOT take 210 days for MTTD ;-)

FINALLY !
• Malware Management allowed us to setup
alerts on artifacts from other malware analysis
• Of course our own experience too
• Malware Discovery allowed us to find odd file
hashes
• Malware Analysis gave us the details

How YOU can
Detect this
Ninja Tips

How we harvested malware
• Some infections hung
• Ran process check for any “parentless” processes
• Found a couple systems hung and harvested the
malware from these systems
• Command line logging showed us where to look
• Ninja Tip:
– Parse through processes that do NOT have a
parent!!!

How we harvested malware
• File Copy loop in Directories discovered
– @echo off
– cls
– md captured
– :Redo
– robocopy . WooHooo /E /B /r:0 /w:1 /np /xo /xd WooHoo
– Goto Redo
– :End
• Ninja Tip:
– Great to do in Labs for User space AppData

Top Priority
• Enable and Configure Process Command Line
– KB3004375 - https://support.microsoft.com/en-us/kb/3004375
• Enable Advanced Audit Policy in Windows
– The “Windows Logging Cheat Sheet”
– Audit Process Creation = Success 4688
– Audit Logon = Success & Failure 4624
– Audit File Share = Success 5140
– Audit File System = Success 4663
– Audit Registry = Success 4663 & 4657
– Audit Filtering Platform Connection = Success 5156
(Any/Any min)
– Services already captured by System Log 7045 & 7040
– PowerShell Logging (needs profile.ps1) 500

Alert for Suspicious Commands
• #1 trigger for a compromise
• (EventCode=4688) (at.exe OR bcdedit.exe OR calcls.exe OR
chcp.exe OR cmd.exe OR cscript.exe OR ipconfig.exe OR
mimikatz.exe OR nbtstat.exe OR nc.exe OR netcat.exe OR
netstat.exe OR nmap OR nslookup.exe OR bcp.exe OR
sqlcmd.exe OR OSQL.exe OR ping.exe OR powershell.exe
OR powercat.ps1 OR psexec.exe OR psexecsvc.exe OR
psLoggedOn.exe OR procdump.exe OR rar.exe OR reg.exe
OR route.exe OR runas.exe OR sc.exe OR schtasks.exe OR
sethc.exe OR ssh.exe OR sysprep.exe OR systeminfo.exe OR
system32net.exe OR takeown.exe OR tracert.exe OR
vssadmin.exe OR whoami.exe OR winrar.exe OR wscript.exe
OR winrm.* OR winrs.* OR wmic.exe OR wsmprovhost.exe)

Size Matters!!!
• Bigger IS better…
– For Size of Registry Keys
– Very few over 20k
– WINNTI was 296k
• RegScanner – NirSoft
• Reglister - @dnlongen – python script
– https://github.com/dnlongen/RegLister

Enhanced Logging
• Sysmon
– Gives you images loaded (.DLL) look for unsigned!
– Gives you Drivers loaded (.SYS)
– Gives you Hashes – Upload to VirusTotal
• Windows Logging Service (WLS)
– Alternative logging agent
– More than Sysmon provides
– http://energy.gov/sites/prod/files/cioprod/documents/Splunkified_-
_the_Next_Evolution_of_Log_Analysis_-_Green_and_McCord.pdf
– http://digirati82.com/wls-information/

Malware Discovery
• Once a system was labeled “suspect”
• Compare known good hashes to suspect
system
• Odd files will show up
• What????
• You don’t have a Log Management solution
– SIEM

INTERMISSION

Introducing
• Use in a Malware Analysis Lab
• Investigate a suspect system
• For Incident Response
• Produce IT/InfoSec/Audit/Compliance report
comparing actual Audit Log system settings to
CIS and “Windows Logging Cheat Sheet”
recommendations
• Assist in tweaking File and Registry auditing

Introducing
• Log Malicious Discovery tool
• When you run the tool, it tells you what
auditing and settings to configure that it
requires
• Once the system and/or GPO is configured
1. Clear the logs
2. Infect the system
3. Run Log-MD
4. Review “Report.csv” in Excel

Functions
• Audit Report of log settings compared to:
– The “Windows Logging Cheat Sheet”
– Center for Internet Security (CIS) Benchmarks
• 3 White lists to filter out the known good
– By IP Address
– By Process Command Line and/or Process Name
– By File and Registry locations (requires File and
Registry auditing to be set)
• Report.csv of data from logs specific to security

Crypto Event
• C:UsersBobAppDataRoamingvcwixk.exe
• C:UsersBobAppDataRoamingvcwpir.exe
• C:WINDOWSsystem32cmd.exe /c del
C:UsersBobAppDataRoamingvcwixk.exe >> NUL
• C:WindowsSystem32vssadmin.exe delete shadows /all /Quiet

Malicious Word Doc

Malicious Word Doc con’t

So what do we get?
• WHAT Processes executed
• WHERE it executed from
• IP’s to enter into Log Management to see
WHO else opened the malware
• Details needed to remediate infection
• Details to improve your Active Defense!
• I did this in…
15 Minutes!

In Summary
• Malware is noisy
• We CAN detect it
• Logs can hold all types of information
– It’s NOT just for Forensics anymore
• All we have to do is:
– Enable the Logs
– Configure the Logs
– Gather the Logs
– Harvest the Logs
• Look for Top Security related events
• Use the “Windows Logging Cheat
Sheet”
• GET Log-MD – It’s FREE!

Resources
• Websites
– MalwareArchaeology.com
– Log-MD.com The tool
• The “Windows Logging Cheat Sheet”
– MalwareArchaeology.com
• Malware Analysis Report links too
– To start your Malware Management program

Questions?
• You can find us at:
• @HackerHurricane
• @Boettcherpwned
• Log-MD.com
• MalwareArchaeology.com
• HackerHurricane.com (blog)
• http://www.slideshare.net

Deeplook into apt and how to detect and defend v1.0

More Related Content

What's hot

Viewers also liked

Similar to Deeplook into apt and how to detect and defend v1.0

More from Michael Gough

Recently uploaded

Deeplook into apt and how to detect and defend v1.0