Tempest
You are tasked to conduct an investigation from a workstation affected by a full attack chain.
CONTEXT
I. Background
In this incident, you will act as an Incident Responder from an alert triaged by one of your Security Operations Center analysts. The analyst has confirmed that the alert has a CRITICAL severity that needs further investigation.
Challenge Link: TryHackMe - Tempest
II. Tools and Artifacts
Conversion of Log Files
Conversion of EVTX files to JSON using EvtxECmd:
PS> .\EvtxECmd\EvtxECmd.exe -f sysmon.evtx --json .\ --jsonf sysmon.json
Metrics (including dropped events)
Event ID Count
1 238
2 2
3 92
5 3
8 3
11 1,024
12 186
13 869
15 6
22 136
PS> .\EvtxECmd\EvtxECmd.exe -f windows.evtx --json .\ --jsonf windows.json
Metrics (including dropped events)
Event ID Count
1102 1
4624 43
4625 4
4648 9
4720 2
4722 2
4724 3
4728 2
4732 3
4738 3
4797 34
4798 27
4799 12
5379 51
5382 2Protocol Heirarchy (pcap)
ANALYSIS
I. Initial Access
MALICIOUS DOCUMENT
As reported by the SOC analyst, the intrusion started from a malicious document. In addition, the analyst compiled the essential information generated by the alert as listed below:
The malicious document has a .doc extension.
The user downloaded the malicious document via chrome.exe.
The malicious document then executed a chain of commands to attain code execution.
A maldoc was found to be downloaded into the workstation via browser. This was confirmed via logs pertaining to file creation (Sysmon Event ID 11) with its source coming from chrome.exe.
The file was downloaded from phishteam.xyz (167.71.199.191):
The file, free_magicules.doc, was then opened via Microsoft Word (WINWORD.EXE):
Spawning from the Microsoft Word process was an execution of msdt.exe which is highly indicative of the Follina 0-day exploit (CVE-2022-30190).
Exploring the CommandLine parameter for the possible Follina Exploit, the payload contains a base64 encoded bit:
Which when decoded, becomes the following (beautified):
The decoded payload downloads and adds a file, update.zip, to the Startup folder which is then extracted to the same directory. The execution being done in PowerShell as well as having sdiagnhost.exe writing the file to the Startup folder confirms the abuse of the Follina exploit.
STAGE 2 EXECUTION
Based on the initial findings, we discovered that there is a stage 2 execution:
The document has successfully executed an encoded base64 command.
Decoding this string reveals the exact command chain executed by the malicious document.
As the file, update.zip, was written in the Startup folder, login activities of the compromised user (benimaru) were monitored and processes spawned by winlogon.exe were traced.
Upon tracing the logs, a PowerShell execution was spawned which leads to the download of a stage 2 payload (first.exe).
Looking at the command executed, the payload was downloaded to the Public Downloads folder.
The logs shown below proves the successful download and execution of first.exe:
Network logs included in Sysmon shows that the execution of first.exe creates a callback to resolvecyber.xyz (167.71.222.162) at port 80:
MALICIOUS DOCUMENT TRAFFIC
Based on the collected findings, we discovered that the attacker fetched the stage 2 payload remotely:
We discovered the Domain and IP invoked by the malicious document on Sysmon logs.
There is another domain and IP used by the stage 2 payload logged from the same data source.
Network traffic related to the execution of first.exe shows requests to the URI path /9ab62b5:
Requests with the GET parameter, ?q=, are also seen with base64 encoded payloads.
II. Discovery
Based on the collected findings, we have discovered that the malicious binary continuously uses the C2 traffic:
We can easily decode the encoded string in the network traffic.
The traffic contains the command and output executed by the attacker.
HTTP requests with base64 encoded payloads were parsed and decoded using the following command:
The threat actor was then seen to have achieved Remote Code Execution (RCE) with a non-interactive webshell. Initial enumeration included their current user context, existing user directories, as well as local users and administrators:
Next, they began exploring the current user context's home directory:
A file, automation.ps1, was discovered which includes the user, benimaru's, credentials in plaintext:
Following the user enumeration, network-related information were then gathered:
Finally, the threat actor downloaded chisel (a socks proxy application) into the workstation:
A reverse socks proxy to 167.71.199.191:8080 was started:
The user, benimaru, belonging to the Remote Management Users group as well as having TCP port 5985 open in his workstation may have given the threat actor remote access via WinRM. The logs below show all Network logons (LogonType 3) of the compromised user:
III. Privilege Escalation
Based on the collected findings, the attacker gained a stable shell through a reverse socks proxy.
Executions were seen in the Sysmon logs but not in the captured network traffic. This leads to the assumption that the threat actor was able to establish a stable shell via WinRM.
The first execution was enumeration of privileges for the current user context (benimaru):
Afterwhich, the files, spf.exe and final.exe, were downloaded into the workstation:
spf.exe was executed (to run final.exe after the fact) and based on the executable's hash was found to be a printspoofer exploit which abuses impersonation privileges (SeImpersonatePrivilege). The threat actor must have been tipped off after enumerating user privileges.
After the execution of final.exe, network connections were checked on sysmon for possible callbacks and true enough:
IV. Post-Exploitation
Now, the attacker has gained administrative privileges inside the machine. Find all persistence techniques used by the attacker.
In addition, the unusual executions are related to the malicious C2 binary used during privilege escalation.
Callbacks to 167.71.222.162:8080 were parsed and decoded using the following command:
Now, the current user context of the threat actor is NT AUTHORITY\SYSTEM which is the local superadmin of the workstation:
They attempted to add two new users, shuna and shion, but failed without adding the option, /add, to the net user command:
This time around, with the correct command, the two users were successfully created:
Another thing the threat actor did for persistence was to change the local administrator's password as well as add the new user, shion, to the localadministrators group:
The logs below confirms the creation of two new users (Event ID 4720) as well the addition of shion to the localadministrators group (Event ID 4732):
Another persistence method performed was by creating a service (TempestUpdate2) that will run final.exe:
TIMELINE OF EVENTS
2022-06-20 17:12:56
The file, free_magicules.doc , was downloaded into the workstation.
2022-06-20 17:13:12
The file, free_magicules.doc, was opened in Microsoft Word.
2022-06-20 17:13:35
CVE-2022-30190 (Follina) Execution
2022-06-20 17:13:37
The file, update.zip, was downloaded into the workstation.
2022-06-20 17:15:10
Stage 2 payload (first.exe) was downloaded into the workstation.
2022-06-20 17:15:14
First seen execution of first.exe.
2022-06-20 17:18:48
Download and execution of chisel (ch.exe).
2022-06-20 17:19:05
First seen (assumed) unauthorized login to TEMPEST\benimaru via WinRM.
2022-06-20 17:20:06
PrintSpoofer exploit (spf.exe) was downloaded into the workstation.
2022-06-20 17:21:05
The file, final.exe, was downloaded into the workstation.
2022-06-20 17:21:34
Execution of spf.exe and final.exe.
2022-06-20 17:26:29
Creation of the TempestUpdate2 service for persistence.
2022-06-20 17:27:19
Creation of two users (shuna and shion) as well as addition of shion to the local administrators group.
Last updated