As a cybersecurity analyst on SecureTech's Incident Response Team, you're tackling an urgent case involving a high-profile corporation that suspects a sophisticated cyber attack on its network. The corporation, which manages critical data across various industries, has experienced a ransomware attack, leading to the encryption of files and an immediate need for expert assistance to mitigate the damages and investigate the breach.
Your role in the team is to conduct a detailed analysis of the evidence to determine the extent and nature of the attack. Your objective is to identify the tactics, techniques, and procedures (TTPs) used by the threat actor to help your client contain the threat and restore the integrity of their network
Walkthrough of the incident
First, we need to determine how the attack gained entry into our system. Let's focus on detecting the attacker's active reconnaissance activities.
We can observe that the IP 87.96.21.84 is performing a port scan, as indicated by the rapid frequency and volume of requests
How many open ports did the attacker discover?
Since the attacker is using a normal SYN scan, we can determine this information by checking the SYN-ACK responses from our server 87.96.21.81 to 87.96.21.84.
I used the following query to capture the relevant packets:
tcp.flags.syn == 1 and tcp.flags.ack == 1 and (ip.dst == 87.96.21.84) && (ip.src == 87.96.21.81)
He discovered 5 open TCP ports:
445: SMB
139: NetBIOS
135: Microsoft RPC
5357: WS-Discovery
1433: Microsoft SQL Server
After the reconnaissance phase, the attacker will choose which service to exploit for the attack. We will track the IP address 87.96.21.84 to determine which port he would start enumerating.
The attacker began enumerating the Microsoft SQL Server and gained access using the sa (system administrator) account.
Then performed some changes
We can notice the following:
1- .show.advanced.options changed from 0 to 1: This suggests that some configuration setting related to showing advanced options was altered
2- .xp_cmdshell Changed from 0 to 1: xp_cmdshell is a feature in Microsoft SQL Server that allows users to execute system-level commands directly from the SQL Server
3- Reconfigure Command: The RECONFIGURE command typically applies changes to SQL Server configurations
Summary
The attacker changed several configurations and enabled xp_cmdshell, likely to facilitate initial access. Following this, they used xp_cmdshell to upload an executable file.
The attacker then added the executable file to the temp directory, renaming it Gjmwb.vbs, which is likely a reverse shell.
This is how the attacker gained initial access.
Following that, the attacker escalated privileges by injecting winlogon.exe using msfconsole. Event ID 400 indicates when a new PowerShell host process has started.
After obtaining administrative privileges, the attacker began downloading various files.
The attacker opened a Python server to upload several PowerShell modules. The previous image shows that he is transferring a file named checking.ps1.
The code includes several functions, with the most important ones summarized below:
Test-URL: Checks if a given URL is reachable by using Invoke-WebRequest to send a request. It returns true if the response status code is 200 (OK).
Test-ScriptURL: Functions similarly to Test-URL, returning true if the script URL is accessible.
StopAV: Disables Windows Defender and other antivirus services if the script is running with administrative privileges.
It first checks the OS version, and if it is Windows 10, it disables real-time monitoring for Windows Defender.
It modifies Windows Defender registry keys to disable various protections and stops the Windows Defender service.
It also stops and disables other security services matching specified names (e.g., "MBAMService," "MBAMProtection," and services with "Sophos" in their display name).
CleanerEtc: This function can be used for persistence.
Downloads del.ps1 from a specified URL and saves it to C:\ProgramData\.
Uses schtasks.exe to create a scheduled task that runs del.ps1 hourly under the SYSTEM account, named LPupdate.
Downloads and executes another script (ichigo-lite.ps1) from the same server.
Invoke-PowerDump.ps1: Used to dump hashes from the local machine.
Invoke-SMBExec.ps1: Facilitates command execution for any user using their hash, supporting SMB1 and SMB2.1, with or without SMB signing.
Retrieve Hostnames:
Downloads a text file containing hostnames (or IP addresses) from a remote server, which could be used for lateral movement. The -ErrorAction Stop parameter ensures the script halts if an error occurs.
Base64 Decoding and Command Execution:
Decodes some commands to execute the downloaded remote scripts.
Extract Usernames and Password Hashes:
Reads the file generated by PowerDump and stores the usernames and password hashes in an array for later use.
Authenticate Against Remote Hosts:
If valid usernames and password hashes are found, it attempts to authenticate to the hosts listed in hostsContent using Invoke-SMBExec.
Download a File from a URL:
Downloads an executable file named javaw.exe, which is suspected to be ransomware.
After scanning the hash of javaw.exe (3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb) using VirusTotal, we can confirm that it is the ransomware used by the attacker, associated with the Conti and Bluesky families.
