Digital Forensics, Incident Response Lab

Description

In this lab, I conducted an investigation on a suspected intrusion using Sysmon logs and a packet capture. I started by processing the logs with Eric Zimmerman's tools, converting them into a .csv file for analysis in Timeline Explorer. The first step was to find the .doc file outlined in the scenario. Once the file was located, I traced back through the log and found the user "benimaru" and that the PID was 496. Using these details revealved it made an outbound DNS request to the IP address 167[.]71[.]199[.]191, signaling potential further malware downloads. Further analysis revealed that the document initiated the execution of msdt.exe, followed by a script containing base64 encoded text. Decoding this text in CyberChef uncovered a command that connected to the domain phishteam[.]xyz, downloaded the file update.zip, unzipped, executed it, and removed it. Open Source research indicated that this attack exploited a known vulnerability, likely using the .doc file as a dropper for additional malware. I followed the trail of what processes spawned from update.zip, explorer.exe and startup as detailed in the vulnerability. This revealed a Powershell command executed that contacted the same malicious domain, phishteam[.]xyz, to download first.exe. Although OSINT did not identify first.exe as a known malicious file, the context in which it was downloaded lead me to consider it malicious. Further investigation showed that first.exe contacted another domain, resolvecyber[.]xyz, and downloaded ch.exe, which established a connection to the same IP address found earlier over port 8080. Obtaining the hash of the binary confirmed that ch.exe was the malware chisel, used for tunneling traffic. Switching to the packet capture, I used Brim to filter for HTTP traffic to resolvecyber[.]xyz. I found numerous encoded GET requests, which when decoded, revealed the attacker executing commands on the host, confirming that this was a C2 server. The attacker executed commands still focusing on the user "benimaru", locating a Powershell script with a password, and conducting a port scan. Upon reviewing the Sysmon logs again, I identified wsmprovhost.exe, likely as part of the attack's privilge escalation, likely using WinRM. This process downloaded additional binaries, spf.exe and final.exe, from phishteam[.]xyz. OSINT identified these binaries as malicious, with final.exe linked to "printspoofer", a tool for privilege escalation. I also discovered that final.exe was communicating with resolvecyber[.]xyz over a different port, indicating the establishment of a second C2 server. Lastly in the logs, the attacker added persistence mechanisms which included creating new users, "shuna" and "shion", giving them elevated privliges and modifying registry keys to ensure final.exe would start on boot.

Utilities Used

• Brim
• Sysmon
• Timeline Explorer
• EvtxEcmd
• VirusTotal
• CyberChef

Environments Used

• Windows 10 VM

Lab Overview:

Scenario for the lab.


In the lab, I was provided a packet capture and Windows Event Viewer Sysmon logs. I decided to start the investigation examining the Sysmon logs. Useing EZ Tools (Eric Zimmerman tools) I used EvtxEcmd to convert the event logs into a .csv file for processing in Timeline explorer. This was done through Powershell.


The scenario for the lab, gave us a hint or a place to start the investigation in which it mentioned that the malicious document has a .doc extension, so within Timeline Explorer in the executable info I searched for an file that has a .doc extension and found one file which I wanted to investigate further.


With examing the log of that contained the .doc file, I discovered the user logged in as benimaru and the PID of the file as 496. I then changed the filter to include the username, the PID and Event Code 22, to determine if the file made any DNS requests outside the network found that it did contact an IP address of 167[.]71[.]199[.]191.


That alone is cause for concern as outbound connections can allow for further malware to be downloaded. I continued investigating events by changing the filter to include 496 being the Parent PID and Event Code 1 to see if the document spawned any new processes and found that it started the process C:\Windows\SysWOW64\msdt.exe followed by script with base64 encoded text and what appears to be directory traversal. I used cyberchef to decode the the base64 string and found it to be a command that is launched from ...\Start Menu\Programs\Startup which contacts the domain phishteam[.]xyz/02dcf07, downloaded a file named update.zip, unzips it, runs, it and removes it.


After conducting some OSINT on this attack vector I discovered a post explaining that it was a discovered vulnerbility that is exploited using the start menu. This was seen in the decoded command, and likely the purpose of the .doc file as a dropper for further malware.


Now that part of the intital access has been discovered I moved on to part two of the lab where another hint was given that said, "The Autostart execution reflects explorer.exe as its parent process ID. Child processes of explorer.exe within the event timeframe could be significant. Process Creation (Event ID 1) and File Creation (Event ID 11) succeeding the document execution are worth checking". With this, I changed the Event Code to 11 and Payload 4 to include "startup" from what we know about the vulnerability. This revealed the update.zip that we saw in the decoded base-64 string.


Also, knowing that "The Autostart execution reflects explorer.exe as its parent process ID.", I changed Payload 4 to contain "explorer" and Event Code to 1 to discover any processes created by explorer and came accross Poweshell being executed as "-w hidden -noni certutil..." a common attack method for Powershell to be ran without user being aware. The Powershell command contacted the malicious domain earlier phishtem[.]xyz and downloaded first.exe. Uptaining the hash of first.exe, I did not find any OSINT data signifying that is a known malicious file or executable, however, due to the circumstances under which it is downloaded, I will treat it as malicious.


Continuing down the attack, I changed first.exe to the parent process and Event Code back to 1 to see if it created any processes and I discovered further malicious actions. Particularly, that first.exe contacted a new domain resolvecyber[.]xyz and downloaded and ran ch.exe which ran and connected to the IP address 167.71.199.191 over port 8080 which is used for HTTP traffic in most cases. I obtained the hash of ch.exe and upon researching it, I can confirm that is malicious and particularly the malware chisel, used for tunneling C2 traffic through encypted tunnels such as HTTPS.


With what appears to be a potential Command and Control (c2) server being created by first.exe, I switched my focus to the packet capture to see what kind of traffic was made to the malicious domains and IP addresses. I used Brim/Zui for this task. Within Brim, I filtered for HTTP GET requests to the second malicious donmain/potential C2 server, resolvesyber[.]xyz and discovered numerous GET requests encoded over the port 8080 which we saw connection to.


I noticed that the GET requests to have the same struture in which they start with /9ab62b5?q= and then the string is vastly different which I found to be base64 encoded text. With this knowledge, I went through the the GET requests, decoded them in cyberchef and realized that the attacker is executing commands on the host, confirming that this is a C2 server. Some of the most intresting and troubling commands/actions the attacker did include: discovering the users on the machine, focusing on the user benimaru and discovering a powershell script, automation.ps1 which included a password, and a port scan which showed many HTTP and HTTPS connections.


At this point I knew there was more to uncover but I was stuck so I went back to Timeline Explorer, filterd for Event Code 1 and User benimaru to see what processes were created after the establishment of the C2 server. I found that the service C:\Windows\system32\wsmprovhost.exe was run with -Embedding, followed with what appeared to be discovery commands, so I conducted research on wsmprovhost and found it to be used as part of LOBINS (living off the land binaries), specfically with Winrm which was used to authenticate and connect to the endpoint.


Once again, I moved wsmprovhost.exe to the parent process to see if spawned any other process and found that it was used to downloaded two addtional binaries through powershell, from the inital malicious domain phishteam[.]xyz, spf.exe and final.exe. Obtaining the hashes of these binaries, I found clear evidence that the binary was malicious and specifically "printspoofer". I conducted further OSINT this and came across a GitHub repo which explained it allows: "From LOCAL/NETWORK SERVICE to SYSTEM by abusing SeImpersonatePrivilege on Windows 10 and Server 2016/2019." (https://github.com/itm4n/PrintSpoofer).


Intrestingly, when inputting final.exe into payload 3, it was making queries to the same C2 we saw earlier, resolvecyber[.]xyz. Going back to Brim, I had overlooked that the commands were coming from two different ports, 80 and 8080, which indicates that there is a second C2 sever that was established by final.exe.


I again moved final.exe into the parent process and Event ID to 1 to see if it spawned any other programs... and found that now it appeared the attack was establishing persistance through different means. These included, adding the users "shuna" and "shion" and adding them to the group "administrators". The other persistance mechanism appears to be a adding a registry key to allow final.exe to start on boot.

Thoughts

This lab was exceptionally well put together. It was definitely one of the longer ones I have done, but it did a phenomenal job of showcasing the investigation from start to finish, including how an attacker would gain initial access, conduct discovery, and then add persistence. It did not touch on extraction or attacks on objectives, but it was still a marathon of a lab. I gained experience with EZ tools, which were surprisingly straightforward. I had the impression that DFIR tools were extremely complex, but with Timeline Explorer, I am much more confident and comfortable using them. Moreover, I have had much practice and exposure with Brim and conducting threat intelligence/OSINT, so that was also good practice to keep my skills sharp. The lab provided a few hints to put us on the right track but left the heavy lifting to us as SOC Analysts, which was also great. Overall, I really enjoyed this lab and seeing how an attacker downloads/drops so many different malicious files and creates multiple C2 servers rather than just one. Seeing data being tunneled through HTTP GET requests, further obfuscated with Base64 encoding, was very interesting, which makes me consider examining any suspicious web traffic as it can be tunneling commands used to add persistence to your endpoints.