deeplook into apt and how to detect and defend v1.0

A deep look into a Chinese advanced attack. Understand it, learn from it

and how to detect and defend against attacks like this.

Michael Gough – Founder

MalwareArchaeology.com


Who am I• Blue Team Defender Ninja, Malware Archaeologist, Logoholic

• I love “properly” configured logs – they tell us Who, What, Where, When and hopefully How

Creator of

“Windows Logging Cheat Sheet”

“Windows PowerShell Logging Cheat Sheet”

“Windows Splunk Logging Cheat Sheet”

“Malware Management Framework”

• Co-Creator of “Log-MD” – Log Malicious Discovery Tool

– With @Boettcherpwned – Brakeing Down Security PodCast

• @HackerHurricane also my Blog


Goal

• Interaction – Don’t be a Ding Dong, ask a question… you WILL be rewarded for positive synergy!

• Learn how us Ninja’s do it so you can too

• New Tool for YOU to use!!!


• We discovered this May 2012

• Met with the Feds ;-)

Why you should listen to me?


2014 - We gave an infected VM to one of the Big IR Firms… They came back “Yup.. It’s clean” #Fail

WINNTI 2014

• Much more “sophisticated” than before

– They updated their approach

– MUCH more complex

– This is NOT your typical P0wnage

• Boy did we catch them in the act

• I am sharing so you can learn how!


History

• WINNTI has been around for 5+ years attacking the gaming industry

• It is known the Chinese hackers are behind it– Kaspersky and the Feds

• Not quite State Sponsored, but pretty darned good

• I would consider this your “typical” APT

• We saw new things each time they attacked

• Maybe it is State Sponsored practicing?


WINNTI 2012 Summary

• Pretty typical• DLL Injection

– \WBEM– \Windows– \System32 – Files stored– \ProgramData – Files stored

• Sysprep Cryptbase.dll exploit• Boot up back door, deletes on load, writes on shutdown

– Killed by pulling the power ;-)

• New Services installed• Multiple infections per machine hoping you miss one


WINNTI 2014

• New stuff

• Dude !

• What triggered it?

• What changed?

• Avoided the methods they used before

• Fortunately we were doing REALLY good logging. We are Ninja’s after all


WINNTI 2014

• Summary of improvements for WINNTI 2014– PlugX used as a base, modules added– Dll injection on SQL Server (5 dirs. Deep)

• Allowed for SQL Mgmt utilities to enable XP Command Shell and run .NET commands

– Binary infector – altered existing management binaries to call main payload – and STILL worked!

– Driver infector – Added driver to look like existing management software

– Hid scripts in the Registry– Hid payload in the Registry!

• The Registry is a Huuuuuuuuuuuuuuuuge Database


WINNTI 2014

• Popped a user, not an Admin, they know Who we are and What we do… Yay LinkedIn

• Patient 0 – User phished (not an admin) and I believe they exploited Office to gain admin access

• Dropped their initial malware payload

• Used Backup software creds to then PoP a Domain Controller

• Spread from there all over ;-(– Same MO as 2012


Files Dropped and gone

• Used public accessible locations• C:\Users\Public

• C:\Windows\Web

• C:\Perflogs

• Deleted Infector files fast… almost all

• Left some on disk


Files Dropped

• SQL Server bin directory (5 deep) – Only on SQL Servers

– Cscapi.dll (Dll injection)

• \SysWOW64

– Qwave.dll - Normal on Workstations, NOT on servers

• Splunk and Altiris Directories - Dropped a driver named like the app

– Splunk.sys

– Altiris.sys


Initial Infectors

• \Users\Public– C.exe– Infect.exe– Infectsys.exe– 64.dll– CompanyName.exe – Specific to us!

• C:\Perflogs – Command binary• C:\Windows\Web - .INI files for permission changes• C:\Windows\Temp – VB Scripts

– Netfxupdate.ax

• C:\Windows\SysWOW64– Qwave.dll (Servers only)– SysWow64.sys– AxScriptHost70.dll


Initial Infectors

• Perflogs– C.exe – Communication to infected system

• Thanks for the Port and Password

• For once WE compromised THEM! – Now who is “sophisticated” ;-)


Persistence• C:\Program Files\Common Files

– WLXSys64.sys – NOT ON DISK ANYWHERE ????

• Modified existing service

– WERCplSupport (Who needs WER Support)

– Changed ServiceDll to:

• Program Files\Common Files\WLXSys64.sys


• So how did it load if it was NOT on disk???

Persistence

• WERCplSupport Service failed to start ?

• YAY Windows !!!! THANK YOU Microsoft!!!!

• For allowing a service to retry over and over and over and… well… forever until the file shows up, or the malware places it there

• Once the file existed, “WERCplSupport” started and the system was infected calling other malicious binaries


Persistence

• Avoided leaving key files behind like they did before, well one anyways… the persistence piece


So what led us there?• Command Line Logging !!!!

• At the time ONLY Win 8.1 and Win 2012 R2

• Which we had, We then saw this in our alerts of suspicious commands (Cscript & cmd.exe & cacls & net & takeown & pushd & attrib)

• Scripts too


Hidden in the Registry• Command Line execution led us to the Keys.

Main payload and scripts to infect were stored in the registry – Classes and Client Keys


Hidden in the Registry• HEX in some cases where infection not

complete or when we recreated in the lab because we were missing something (the infected persistence binary)

• Binary when complete, encrypted in some way


Hiding in the Registry

• This was new for WINNTI 2014

• They added three values to the Keys

• HKLM\Software\Clients or \Classes

– putfile

– file

– read

• This found on only a few systems to hide another backdoor– HKLM\Software\Wow6432Node\BINARY\Acrobat.dxe


HKLM\Software\Clients• putfile

• file

• read


4D5A = MZ in HEX

Persistence

• Infector… One for the DLL (infect.exe) and one for the Driver (InfectSys.exe)

• Altered system management binaries

– McAfeeFrameworkService

– BESClientHelper

– Attempted a few others, some failed


• We tried the infector on several other system files and it worked

Persistence

• Infected management binary read key, decrypted payload and dropped into:– \Program Files\Common Files

• NOW WERCplSupport ServiceDll exists!

• As soon as it was loaded… it was deleted making it hard for us to find it


But we were better than that ;-)

So what led us there?

• Malware Discovery Baseline

• Compared infected system hashes (Suspect) to a known good system hashes (MFR)

• Showed some single hashes in directories that were odd to us (our own management software)?

• So we looked for these binaries across all systems

• ONLY the infected system had these odd hashes


Persistence

• BAM! Got ya – PROCMon on bootup


FINALLY !

• Now we had all the pieces

• Recreated in the lab so we knew we had it all

• High confidence remediation was now able to start

• And it did NOT take 210 days for MTTD ;-)


FINALLY !

• Malware Management allowed us to setup alerts on artifacts from other malware analysis

• Of course our own experience too

• Malware Discovery allowed us to find odd file hashes

• Malware Analysis gave us the details


How YOU can

Detect thisNinja Tips


How we harvested malware

• Some infections hung

• Ran process check for any “parentless” processes

• Found a couple systems hung and harvested the malware from these systems

• Command line logging showed us where to look

• Ninja Tip:

– Parse through processes that do NOT have a parent!!!


How we harvested malware

• File Copy loop in Directories discovered– @echo off

– cls

– md captured

– :Redo

– robocopy . WooHooo /E /B /r:0 /w:1 /np /xo /xd WooHoo

– Goto Redo

– :End

• Ninja Tip:– Great to do in Labs for User space \AppData


Top Priority

• Enable and Configure Process Command Line– KB3004375 - https://support.microsoft.com/en-us/kb/3004375

• Enable Advanced Audit Policy in Windows– The “Windows Logging Cheat Sheet”– Audit Process Creation = Success 4688– Audit Logon = Success & Failure 4624– Audit File Share = Success 5140– Audit File System = Success 4663– Audit Registry = Success 4663 & 4657– Audit Filtering Platform Connection = Success 5156

(Any/Any min)– Services already captured by System Log 7045 & 7040– PowerShell Logging (needs profile.ps1) 500


Alert for Suspicious Commands

• #1 trigger for a compromise• (EventCode=4688) (at.exe OR bcdedit.exe OR calcls.exe OR

chcp.exe OR cmd.exe OR cscript.exe OR ipconfig.exe OR mimikatz.exe OR nbtstat.exe OR nc.exe OR netcat.exe OR netstat.exe OR nmap OR nslookup.exe OR bcp.exe OR sqlcmd.exe OR OSQL.exe OR ping.exe OR powershell.exe OR powercat.ps1 OR psexec.exe OR psexecsvc.exe OR psLoggedOn.exe OR procdump.exe OR rar.exe OR reg.exe OR route.exe OR runas.exe OR sc.exe OR schtasks.exe OR sethc.exe OR ssh.exe OR sysprep.exe OR systeminfo.exe OR system32\\net.exe OR takeown.exe OR tracert.exe OR vssadmin.exe OR whoami.exe OR winrar.exe OR wscript.exe OR winrm.* OR winrs.* OR wmic.exe OR wsmprovhost.exe)


Size Matters!!!

• Bigger IS better…

– For Size of Registry Keys

– Very few over 20k

– WINNTI was 296k

• RegScanner – NirSoft

• Reglister - @dnlongen – python script

– https://github.com/dnlongen/RegLister


Enhanced Logging• Sysmon

– Gives you images loaded (.DLL) look for unsigned!

– Gives you Drivers loaded (.SYS)

– Gives you Hashes – Upload to VirusTotal

• Windows Logging Service (WLS)

– Alternative logging agent

– More than Sysmon provides– http://energy.gov/sites/prod/files/cioprod/documents/Splunkified_-

_the_Next_Evolution_of_Log_Analysis_-_Green_and_McCord.pdf

– http://digirati82.com/wls-information/


Malware Discovery

• Once a system was labeled “suspect”

• Compare known good hashes to suspect system

• Odd files will show up

• What????

• You don’t have a Log Management solution

– SIEM


INTERMISSION


Introducing

• Use in a Malware Analysis Lab

• Investigate a suspect system

• For Incident Response

• Produce IT/InfoSec/Audit/Compliance report comparing actual Audit Log system settings to CIS and “Windows Logging Cheat Sheet” recommendations

• Assist in tweaking File and Registry auditing


Introducing

• Log Malicious Discovery tool

• When you run the tool, it tells you what auditing and settings to configure that it requires

• Once the system and/or GPO is configured1. Clear the logs

2. Infect the system

3. Run Log-MD

4. Review “Report.csv” in Excel


Functions

• Audit Report of log settings compared to:

– The “Windows Logging Cheat Sheet”

– Center for Internet Security (CIS) Benchmarks

• 3 White lists to filter out the known good

– By IP Address

– By Process Command Line and/or Process Name

– By File and Registry locations (requires File and Registry auditing to be set)

• Report.csv of data from logs specific to security


Crypto Event

• C:\Users\Bob\AppData\Roaming\vcwixk.exe

• C:\Users\Bob\AppData\Roaming\vcwpir.exe

• C:\WINDOWS\system32\cmd.exe /c del C:\Users\Bob\AppData\Roaming\vcwixk.exe >> NUL

• C:\Windows\System32\vssadmin.exe delete shadows /all /Quiet


Malicious Word Doc


Malicious Word Doc con’t


So what do we get?

• WHAT Processes executed

• WHERE it executed from

• IP’s to enter into Log Management to see WHO else opened the malware

• Details needed to remediate infection

• Details to improve your Active Defense!

• I did this in…


15 Minutes!

In Summary• Malware is noisy• We CAN detect it• Logs can hold all types of information

– It’s NOT just for Forensics anymore

• All we have to do is:– Enable the Logs– Configure the Logs– Gather the Logs– Harvest the Logs

• Look for Top Security related events• Use the “Windows Logging Cheat

Sheet”• GET Log-MD – It’s FREE!


Resources• Websites

– MalwareArchaeology.com

– Log-MD.com The tool

• The “Windows Logging Cheat Sheet”– MalwareArchaeology.com

• Malware Analysis Report links too– To start your Malware Management program


Questions?

• You can find us at:

• @HackerHurricane• @Boettcherpwned• Log-MD.com

• MalwareArchaeology.com• HackerHurricane.com (blog)

• http://www.slideshare.net


deeplook into apt and how to detect and defend v1.0

Technology