Tempest | jebidiah

Last updated 1 year ago

CONTEXT

I. Background

In this incident, you will act as an Incident Responder from an alert triaged by one of your Security Operations Center analysts. The analyst has confirmed that the alert has a CRITICAL severity that needs further investigation.

Challenge Link:

II. Tools and Artifacts

Conversion of Log Files

Conversion of EVTX files to JSON using :

Protocol Heirarchy (pcap)

ANALYSIS

I. Initial Access

MALICIOUS DOCUMENT

As reported by the SOC analyst, the intrusion started from a malicious document. In addition, the analyst compiled the essential information generated by the alert as listed below:
The malicious document has a .doc extension.
The user downloaded the malicious document via chrome.exe.
The malicious document then executed a chain of commands to attain code execution.

A maldoc was found to be downloaded into the workstation via browser. This was confirmed via logs pertaining to file creation (Sysmon Event ID 11) with its source coming from chrome.exe.

The file was downloaded from phishteam.xyz (167.71.199.191):

The file, free_magicules.doc, was then opened via Microsoft Word (WINWORD.EXE):

Spawning from the Microsoft Word process was an execution of msdt.exe which is highly indicative of the Follina 0-day exploit (CVE-2022-30190).

Exploring the CommandLine parameter for the possible Follina Exploit, the payload contains a base64 encoded bit:

Which when decoded, becomes the following (beautified):

The decoded payload downloads and adds a file, update.zip, to the Startup folder which is then extracted to the same directory. The execution being done in PowerShell as well as having sdiagnhost.exe writing the file to the Startup folder confirms the abuse of the Follina exploit.

STAGE 2 EXECUTION

Based on the initial findings, we discovered that there is a stage 2 execution:
The document has successfully executed an encoded base64 command.
Decoding this string reveals the exact command chain executed by the malicious document.

As the file, update.zip, was written in the Startup folder, login activities of the compromised user (benimaru) were monitored and processes spawned by winlogon.exe were traced.

Upon tracing the logs, a PowerShell execution was spawned which leads to the download of a stage 2 payload (first.exe).

Looking at the command executed, the payload was downloaded to the Public Downloads folder.

The logs shown below proves the successful download and execution of first.exe:

Network logs included in Sysmon shows that the execution of first.exe creates a callback to resolvecyber.xyz (167.71.222.162) at port 80:

MALICIOUS DOCUMENT TRAFFIC

Based on the collected findings, we discovered that the attacker fetched the stage 2 payload remotely:
We discovered the Domain and IP invoked by the malicious document on Sysmon logs.
There is another domain and IP used by the stage 2 payload logged from the same data source.

Network traffic related to the execution of first.exe shows requests to the URI path /9ab62b5:

Requests with the GET parameter, ?q=, are also seen with base64 encoded payloads.

II. Discovery

Based on the collected findings, we have discovered that the malicious binary continuously uses the C2 traffic:
We can easily decode the encoded string in the network traffic.
The traffic contains the command and output executed by the attacker.

HTTP requests with base64 encoded payloads were parsed and decoded using the following command:

The threat actor was then seen to have achieved Remote Code Execution (RCE) with a non-interactive webshell. Initial enumeration included their current user context, existing user directories, as well as local users and administrators:

Next, they began exploring the current user context's home directory:

A file, automation.ps1, was discovered which includes the user, benimaru's, credentials in plaintext:

Following the user enumeration, network-related information were then gathered:

Finally, the threat actor downloaded chisel (a socks proxy application) into the workstation:

A reverse socks proxy to 167.71.199.191:8080 was started:

The user, benimaru, belonging to the Remote Management Users group as well as having TCP port 5985 open in his workstation may have given the threat actor remote access via WinRM. The logs below show all Network logons (LogonType 3) of the compromised user:

III. Privilege Escalation

Based on the collected findings, the attacker gained a stable shell through a reverse socks proxy.

Executions were seen in the Sysmon logs but not in the captured network traffic. This leads to the assumption that the threat actor was able to establish a stable shell via WinRM.

The first execution was enumeration of privileges for the current user context (benimaru):

Afterwhich, the files, spf.exe and final.exe, were downloaded into the workstation:

spf.exe was executed (to run final.exe after the fact) and based on the executable's hash was found to be a printspoofer exploit which abuses impersonation privileges (SeImpersonatePrivilege). The threat actor must have been tipped off after enumerating user privileges.

After the execution of final.exe, network connections were checked on sysmon for possible callbacks and true enough:

IV. Post-Exploitation

Now, the attacker has gained administrative privileges inside the machine. Find all persistence techniques used by the attacker.
In addition, the unusual executions are related to the malicious C2 binary used during privilege escalation.

Callbacks to 167.71.222.162:8080 were parsed and decoded using the following command:

Now, the current user context of the threat actor is NT AUTHORITY\SYSTEM which is the local superadmin of the workstation:

They attempted to add two new users, shuna and shion, but failed without adding the option, /add, to the net user command:

This time around, with the correct command, the two users were successfully created:

Another thing the threat actor did for persistence was to change the local administrator's password as well as add the new user, shion, to the localadministrators group:

The logs below confirms the creation of two new users (Event ID 4720) as well the addition of shion to the localadministrators group (Event ID 4732):

Another persistence method performed was by creating a service (TempestUpdate2) that will run final.exe:

TIMELINE OF EVENTS

Last updated 1 year ago