Vin Ransomware Blog02

A new virus is in circulation and this time it is again targeting the Middle-East countries. Interesting enough last month the Middle east was (still might be) plagued with Shamoon 2.0, the deadly virus that made its comeback from the dead.

This new campaign is dubbed as the “Magic.Hound” by the Palo-Alto Networks research. It is interesting to note that within such a short time span of time this is the second time the middle east is targeted. And this attack like the previous Shamoon 2.0 attack is not only limited to the Government sector but Private Corporations are in the cross-hairs as well. According to a report, Middle-east has spent 5.2 Billion AED (United Arab Emirates Dirham) alone last year to prevent and counter cyber crime but the statics tells us a different story:

  • 49% online users feel it is more difficult to stay safe online than physical world.
  • 59% users are hesitant to use their credit cards when connected to public wifi-hotspots
  • 55% users feel that unauthorized access from home network is more likely than a physical breach in their homes.

Now one such reason why users feel the above is because of the unsecure habits that the people follow, Corporate and Non-corporate users alike follow some the mentioned habits that make them a very desirable target for an attacker to attack:

  • Three in ten (30 percent) UAE consumers cannot detect a phishing attack, and another nine percent have to guess between a real message and a phishing email, meaning nearly four in 10 UAE users are vulnerable.
  • Nearly one-third UAE users (31 percent) share their passwords with others, (31 percent) fail to see the danger of using the same passwords across multiple accounts.
  • Almost 23 percent of UAE consumers are willing to access public Wi-Fi rather than go without.
  • One in five (21 percent) of people have at least one unprotected device, leaving their other devices vulnerable to ransomware, malicious websites, zero days and phishing attacks.

The new virus which is spreading in the Middle-East takes advantages of the above mentioned facts.

  1. We analyzed nearly a dozen of samples which were such “traps” to UAE consumers.
  2. Upon analysis we found that for the malicious sample spread through office documents, using the macros feature.
  3. The following analysis is obtained from the Office files such as Word Documents and Excel Sheets.
  4. Now the images below are some samples of classic phishing attacks which are used to target users.

how in disguise of a shopping offer in an XML file

Image above shows how in disguise of a shopping offer in an XML file, the user is tempted to click on the “Click to see more” button which will enable the macros of the file.

how in pretext of “job opportunity” the users are tempted to click

While this image above us shows how in pretext of “job opportunity” the users are tempted to click. According to reports for the year 2015, the unemployment was about 11.5 % which is a pretty large of population which can be affected by such fake ads.

Figure shows how fake documents in name of Ministry of Health Portals are being circulated.

Figure shows how fake documents in name of Ministry of Health Portals are being circulatedAs we mentioned earlier, government sectors have always been a favourite target for attackers. The samples that we have target the Ministry of Health. Following image show how the macros are tailored so that the common UAE users are mislead:
image show how the macros are tailored so that the common UAE users are mislead:

The metadata information on investigation of the file showed that the author of the file was listed as :
gerry.knight

Now, upon analysing the macros which were embedded inside the documents, we found the following :

code snippet, we can clearly see that upon execution of the macros

For the above code snippet, we can clearly see that upon execution of the macros,
There is a function called “DownloadFile” which will be executed. A directory is made in “c:\temp” and a powershell is executed. The function DownloadFile also makes the the connections to the following addresses:
“http://analytics-google.org :69/checkFile.aspx” now clearly this is a unsecure website since it uses http instead of https.

One more connection that is established is with the website “http://104.218.120.128/pro.bat”
Upon reverse-lookup for the above mentioned address we got the following:

 Country: Netherlands (NL) Continent: Europe (EU)  ISP: 247RACK.com 
   Time Zone:Europe/Amsterdam  City: Rotterdam

Some of the code snippet was also found in other various documents which we analysed,

powershell.exe is being executed with “Y”

As shown in the above snippet, powershell.exe is being executed with “Y”

This very much confirms that the powershell is spawned to gain access on the victim's machine.

One insight on the macros code is that, we can see in the code snippet is of the structure:

Private                   Sub                      Document_Open()
         Malicious Code
End Sub

Above structure can be translated as:
“If the event procedure is stored in a template, the procedure will run when a new document based on that template is opened and when the template itself is opened as a document.” This shows that the macros code will run whenever the document is opened.

Another insight on the code snippet is that we see the class module ThisDocument in the document.
This class module is necessary since it consists all the objects for the Visual Basic Application (VBA). The structure of the code as shown below:

Upon decoding the code snippet which was encoded in Base64. We obtained the following code given below :

code snippet which was encoded in Base64

These code snippets have been taken from an existing open source project called the “unicorn.py” this project is written by: Dave Kennedy (@HackingDave) Website: https://www.trustedsec.com.

The description of the project is as follows:
                     “Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
Usage is simple, just run Magic Unicorn (ensure Metasploit is installed and in the right path) and magic unicorn will automatically generate a powershell command that you need to simply cut and paste the PowerShell code into a command line window or through a payload delivery system.”

Following below is the code snippet of the unicorn.py code:

code snippet of the unicorn.py code

As we can see clearly that this is the exact same code that the malware writers have used with very few modification. It is clear now that the attackers are not focused on tailoring the code, they are more focused on using the open source tools so that they can utilize and focus more on the phishing aspect of the the campaign.
We also acquired the the following DownloadString having the addresses:

'http://89.107.62.39:13569/eiloShaegae1')
'http://69.87.223.26:8080/eiloShaegae1')

We say that the code tries to communicate with the above listed addresses. The above images shows two different snippets which were acquired from a xml file and docx file respectively which were subjected to phishing campaign.

During the analysis one interesting code snippet that caught our attention was that the Macros which was found in the XLS Excel file had an embedded value of the following:

            - 0{00020820-0000-0000-C000-000000000046}
            - 0{00020819-0000-0000-C000-000000000046}

What makes these numbers interesting to observe are because the *Microsoft Windows Registry* contains a set of Globally Unique Identifier keys.The following Unique Identifier keys are used as Class Identifiers within the Microsoft Windows registry, and are stored as a subclass of the HKEY_CLASSES_ROOT\CLSID registry subset entry:

            - 00020820-0000-0000-C000-000000000046 - Microsoft Excel Object (Unknown)

This supports the fact that the attack wants to create persistent remote connection.
One more technique that the campaign is using to spread the malware other than office documents and excel sheets is using executable to deliver the payload.

We analysed the executable with the SHA256 value
2f7f3582504fbce349a6991fbb3b5f9577c5c014b6ce889b80d51977fa6fb31a. A VirusTotal lookup of the SHA256 confirmed it as a malicious Trojan

VirusTotal lookup of the SHA256 confirmed it as a malicious Trojan

We also found that the executable was compiled using Microsoft Visual C++ and we also get to understand from the screenshot below where the entry point of the executable starts from.

executable was compiled using Microsoft Visual C++

Further analysis tells us (as shown in the picture below) the the program is obfuscated using 2 hash functions:

program is obfuscated using 2 hash functions

Base64 and Rijndael S-Box are the two crypto signatures functions. Rijndael S-Box uses matrix technique to encrypt and S-Box stands for the Substitution method. This is a AES type cryptographic algorithm.

The Import Functions that the executable used are listed as :

                                             KERNEL32.dll

DeleteCriticalSection
InitializeCriticalSection
SetLastError
lstrcmpiA
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
lstrcpyA
LoadLibraryA
GetProcAddress
DeleteFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
GetLastError
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetComputerNameA
Sleep
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ExitProcess
CloseHandle

IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
FileTimeToSystemTime
GetVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
lstrcatA
GetFileTime
GetFileSize
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection

GetCurrentThreadId
lstrcmpA
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeLibrary
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
RaiseException
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
GetCommandLineA
FileTimeToLocalFileTime
HeapAlloc
HeapFree
GetACP
HeapSize
HeapReAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAllocv

 

urlmon.dll NETAPI32.dll COMCTL32.dll SHELL32.dll:
ShellExecuteA None Netbios URLDownloadToFileA

                            USER32.dll

RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
UnhookWindowsHookEx
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SendMessageA
CharUpperA
GetSystemMetrics
LoadStringA
MessageBoxA
EnableWindow

CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA


                 WINSPOOL.DRV

ClosePrinter OpenPrinterA DocumentPropertiesA


GDI32.dll

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap

GetClipBox
SetTextColor
SetBkColor
GetObjectA
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps

 

GetFileTitleA comdlg32.dll

The following files were :

Read:
- \\?\PIPE\ROUTER

Written:
- c:\temp\re
- c:\temp\dc
- c:\temp\t
- c:\temp\rr.exe
- \\?\PIPE\ROUTER

Opened:
- c:\temp\t
- c:\temp\rr.exe
- c:\temp\re
- \Device\Netbios
- \\?\PIPE\ROUTER
- c:\temp\dc
- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
- C:\WINDOWS\system32\credssp.dll

Directory-Created
- c:\temp\

Directory-Enumerated
- C:\WINDOWS\system32\ras\*.pbk
- C:\Documents and Settings\M0rt\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\Documents and Settings
- C:\Documents and Settings\M0rt\Local Settings\Temp
- C:\Documents and Settings\M0rt\Local Settings
- C:\Documents and Settings\M0rt
- C:\Documents and Settings
- C:\Documents and Settings\M0rt\Local Settings
- C:\WINDOWS\system32\attrib.exe
- C:\Documents and Settings\M0rt\Local Settings\Temp\attrib
- C:\Documents and Settings\M0rt\Local Settings\Temp
- C:\Documents and Settings\M0rt\Local Settings\Temp\attrib.*
- C:\WINDOWS\system32\attrib.*
- C:\WINDOWS\system32\attrib.COM
- C:\Documents and Settings\M0rt
- C:\temp

Registry Keys Open:
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DnsCache\Parameters
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DnsClient
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SaslProfiles
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\2f7f3582504fbce349a6991fbb3b5f9577c5c014b6ce889b80d51977fa6fb31a.bin
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32\Performance
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSClient
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\SecurityService
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor
- HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor
- HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor

Registry Key-Read
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UseDomainNameDevolution
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\Capabilities
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationRefreshInterval
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\EnableConsoleTracing
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\WinSock_Registry_Version
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationRefreshInterval
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\FileTracingMask
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SecurityProviders
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\TokenSize
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastListenLevel
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\Comment
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\10
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryAdapterName
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheTtl
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationEnabled
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\RpcId
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UpdateSecurityLevel
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoProxyDetectType
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AllowUnqualifiedQuery
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateZoneExcludeFile
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationTtl
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseHostsFile
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\Name
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseDomainNameDevolution
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\ConsoleTracingMask
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenBadTlds
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\RpcId
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ldap\LdapClientIntegrity
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\Type
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\Version
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterReverseLookup
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\Type
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\FilterClusterIp
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsTest
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxNegativeCacheTtl
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableReverseAddressRegistrations
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\Capabilities
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateSecurityLevel
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\Version
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\Comment
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\RpcId
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\PrioritizeRecordData
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\Type
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\Capabilities
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsNbtLookupOrder
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\TokenSize
- HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ServerPriorityTimeLimit
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll\TokenSize
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\WaitForNameErrorOnAll
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQuickQueryTimeouts
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterWanAdapters
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DomainNameDevolutionLevel
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateTopLevelDomainZones
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\PrioritizeRecordData
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsMulticastQueryTimeouts
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AdapterTimeoutLimit
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationMaxAddressCount
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationTTL
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableDynamicUpdate
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\AllowUnqualifiedQuery
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQueryTimeouts
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\Comment
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheSize
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\Name
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseEdns
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastSendLevel
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\EnableFileTracing
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AppendToMultiLabelName
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableAdapterDomainName
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterPrimaryName
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\EnableAdapterDomainNameRegistration
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\MaxNumberOfAddressesToRegister
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenUnreachableServers
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll\Version
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCachedSockets
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterAdapterName
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\MaxFileSize
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32\FileDirectory
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\AutodialDLL
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll\Name
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryIpMatching
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DomainNameDevolutionLevel
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableWanDynamicUpdate
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DelayedExpansion
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\PathCompletionChar
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DefaultColor
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\CompletionChar
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\DisableUNCCheck
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\EnableExtensions
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
- HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Registry Key-Written
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings

Furthermore upon Memory forensics on the Portable executable we found that it had hooked a lot of different API some of them as mentioned below:

!RegQueryInfoKeyW
!RegQueryValueExA
!RegQueryValueExW
!RegSetValueExA
!RegSetValueExW
!StartServiceA
!StartServiceCtrlDispatcherW
!StartServiceW
!ReadCabinetState
!SHGetFolderPathW
!SHGetSpecialFolderLocation
!ShellExecuteExW
!CopyFileA
!CopyFileExW
!CopyFileW
!CreateActCtxW
!CreateDirectoryExW
!CreateDirectoryW
!CreateProcessInternalW
!CreateRemoteThread
!CreateThread
!CreateToolhelp32Snapshot
!DeleteFileW
!DeviceIoControl
!FindFirstFileExA
!FindFirstFileExW
!FindResourceA
!FindResourceExA
!FindResourceExW
!FindResourceW
!GetComputerNameA
!GetComputerNameW
!GetDiskFreeSpaceExW
!GetDiskFreeSpaceW
!GetFileAttributesExW
!GetFileAttributesW
!GetFileInformationByHandle
!GetFileSize
!GetFileSizeEx
!GetFileType
!GetLocalTime
!GetNativeSystemInfo
!GetShortPathNameW
!GetSystemDirectoryA
!GetSystemDirectoryW
!GetSystemInfo
!GetSystemTime
!GetSystemTimeAsFileTime
!GetSystemWindowsDirectoryA
!GetSystemWindowsDirectoryW
!GetTempPathW
!GetTickCount
!GetTimeZoneInformation
!GetVolumeNameForVolumeMountPointW
!GetVolumePathNameW
!GetVolumePathNamesForVolumeNameW
!GlobalMemoryStatus
!GlobalMemoryStatusEx
!IsDebuggerPresent
!LoadResource
!Module32FirstW
!Module32NextW
!MoveFileWithProgressW
!OutputDebugStringA
!Process32FirstW
!Process32NextW
!ReadProcessMemory
!RemoveDirectoryA
!RemoveDirectoryW
!SearchPathW
!SetEndOfFile
!SetErrorMode
!SetFileAttributesW
!SetFilePointer
!SetFilePointerEx
!SetFileTime
!SetUnhandledExceptionFilter
!SizeofResource
!Thread32First
!Thread32Next
!WriteConsoleA
!WriteConsoleW
!WriteProcessMemory

!GetInterfaceInfo
!DnsQuery_A
!DnsQuery_UTF8
!DnsQuery_W
!ObtainUserAgentString
!URLDownloadToFileW
!NetGetJoinInformation
!NetShareEnum
!NetUserGetInfo
!NetUserGetLocalGroups
msvcrt.dll!system
!DrawTextExA
!DrawTextExW
!EnumWindows
!ExitWindowsEx
!FindWindowA
!FindWindowExA
!FindWindowExW
!FindWindowW
!GetAsyncKeyState
!GetCursorPos
!GetForegroundWindow
!GetKeyState
!GetKeyboardState
!GetSystemMetrics
!LoadStringA
!LoadStringW
!MessageBoxTimeoutA
!MessageBoxTimeoutW
!RegisterHotKey
!SendNotifyMessageA
!SendNotifyMessageW
!SetWindowsHookExA
!SetWindowsHookExW
!UnhookWindowsHookEx
!DecryptMessage
!EncryptMessage
!GetUserNameExA
!GetUserNameExW
!SealMessage
!UnsealMessage
RPCRT4.dll!UuidCreate
!ControlService
!CreateServiceA
!CreateServiceW
!CryptAcquireContextA
!CryptAcquireContextW
!CryptCreateHash
!CryptDecrypt
!CryptEncrypt
!CryptExportKey
!CryptGenKey
!CryptHashData
!DeleteService
!EnumServicesStatusA
!EnumServicesStatusW
!GetUserNameA
!GetUserNameW
!LookupAccountSidW
!LookupPrivilegeValueW
!NotifyBootConfigStatus
!OpenSCManagerA
!OpenSCManagerW
!OpenServiceA
!OpenServiceW
!RegCloseKey
!RegCreateKeyExA
!RegCreateKeyExW
!RegDeleteKeyA
!RegDeleteKeyW
!RegDeleteValueA
!RegDeleteValueW
!RegEnumKeyExA
!RegEnumKeyExW
!RegEnumKeyW
!RegEnumValueA
!RegEnumValueW
!RegOpenKeyExA
!RegOpenKeyExW
!RegQueryInfoKeyA

 

!CoCreeInstance
!CoCreeInstanceEx
!CoGetClassObject
!CoInitializeEx
!CoInitializeSecurity
!CoUninitialize
!OleConvertOLESTREAMTo
!OleInitialize
!IStorage
!GetFileVersionInfoSizeW
!GetFileVersionInfoW
!DeleteUrlCacheEntry
!DeleteUrlCacheEntryA
!DeleteUrlCacheEntryW
!HttpOpenRequestA
!HttpOpenRequestW
!HttpQueryInfoA
!HttpSendRequestA
!HttpSendRequestW
!InternetCloseHandle
!InternetConnectA
!InternetConnectW
!InternetCrackUrlA
!InternetCrackUrlW
!InternetGetConnectedSte
!InternetGetConnectedSteEx
!InternetGetConnectedSteEx
!InternetGetConnectedSteEx
!InternetOpenA
!InternetOpenUrlA
!InternetOpenUrlW
!InternetOpenW
!InternetQueryOptionA
!InternetReadFile
!InternetSetOptionA
!InternetSetStusCallback
!InternetSetStusCallbackA
!InternetWriteFile
!GetAddrInfoW
!WSAAccept
!WSAConnect
!WSARecv
!WSARecvFrom
!WSASend
!WSASendTo
!WSASocketA
!WSASocketW
!WSAStartup
!accept
!bind
!closesocket
!connect
!getaddrinfo
!gethostbyname
!getsockname
!ioctlsocket
!listen
!recv
!recvfrom
!select
!send
!sendto
!setsockopt
!shutdown
!socket
!CertControlStore
!CertCreeCertificeContext
!CertOpenStore
!CertOpenSystemStoreA
!CertOpenSystemStoreW
!CryptDecodeMessage
!CryptDecodeObjectEx
!CryptDecryptMessage
!CryptEncryptMessage
!CryptHashMessage
!CryptProtectDa
!CryptUnprotectDa
!GetAdaptersAddresses
!GetAdaptersInfo
!GetBestInterfaceEx

 

This shows that the portable executable will do all that is possible to connect with the network and establish so that the attacker can have a remote access.

One more element that the Campaign has is the dropper element:

During our analysis it showed that the dropper component made connection with the following address:

http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=gz

During our analysis the there were many file operations performed however one file operation, File read for one query stands out among the rest of the other which is listed below:

- C:\Documents and Settings\M0rt\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms

- C:\Documents and Settings\M0rt\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat

And the reason they stand out is because they are hosted by the http://server.pakdevs.com
This is a web-hosting site which upon further analysis prompts the user to download a file which looks exactly with the one which had performed a File Read operation, the following image shows the real-time site prompt which was acquired when visited:

Web Slice Gallery~.feed-ms from the browser prompt

As shown in the above figure, Web Slice Gallery~.feed-ms from the browser prompt is exactly same to which was discovered on the analysis machine.

There is another component in the campaign called the Dropper Component. This component spread if the campaign does not uses the word/xml type document to infect, then in such cases the malware spreads through this way.

During our analysis of the Dropper component we came across some of the more concerning facts which are mentioned:

  •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\sloo.exe
  •  C:\Documents and Settings\M0rt\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms
  •  C:\Documents and Settings\M0rt\Favorites\Links\Web Slice Gallery.url

Now it should be noted that the Web Slice Gallery is actually a feature in Internet Explorer 8.0 which checks, which all websites you have visited and updates if there is any update in that website. This is a very convenient way to gain access of the history of websites that you have visited. Sometimes the user might have auto-logged-in feature enables, in such cases it is very harmful for that user since this feature will gain direct access to the user’s profile.

Another interesting fact is the ShellCompatibility\Applications\sloo.exe and the reason that this is very important is because researchers from Arbor Networks’ Security Engineering and Response Team have found this same exact file in the Shamoon 2.0 attack, that took place last month in the Middle-east.
This shows that the previous attack on the Middle-east and the Recent attack that we are discussing are connected with one another.

However this attack is more focused on gaining the shell access of the victim’s computer, and this is because once a shell access is gained an attacker can practically own that victim’s computer.

We also found the the sample which had the SHA256 as ea139a73f8ec75ea60dfa87027c7c3ef4ed61b45e1acb5d1650cc54e658984ba
Was a backdoor malware which is still in the wild. Some of the interesting commands that the file made changes are as follows:
       ●   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE

Now what does it means that When disabled, the FEATURE_HTTP_USERNAME_PASSWORD_DISABLE feature allows usernames and passwords to be included in HTTP or HTTPS URLs.
If we take a look at the following statics by statsmonkey.com we see that
statics by statsmonkey.com

As we see that 78.67 % of the UAE users use Windows and hence the scale of people affected by the malware is more and it should be also reminded that last month Shamoon 2.0 attack also took place which can help us draw a conclusion that UAE users have still not taken preventive measures.

The following keys were Deleted from the Registry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName

These are essential because they decide the access of the Internet Settings. By deleting these values we are opening the access for the outside attacker by exploiting these because by default these zones are locked so that they can improve the security of the machine.

Another element in the campaign known as the Retrieve:

The analysis showed that the strings inside our sample {1c550dc73b7a39b0cd21d3de7e6c26ece156253ac96f032efc0e7fcc6bc872ce}
{7cdbf5c035a64cb6c7ee8c204ad42b4a507b1fde5e6708ea2486942d0d358823} are the two files that were analysied.

A quick VirusTotal lookup confirmed and cleared any remaining doubts of the file being malicious or not. A screenshot of the VirusTotal result is shown below:

VirusTotal lookupAndVirusTotal lookup 2

These files are just responsible to establish connection to the web-servers which are hosting the malicious files and then downloading the malicious files on the victim's machine.

The traces of strings such as $7c5fd882-1160-4075-ad8a-3b4e86772aeb, and http://tempuri.org/GetNameAbById , now these strings are found in other malicious file, one such file listed as follows: 04c587965d070f936d82a0629a494b1213bba345c87e5f081fe4d028cb2b9bb7

Conclusion:
From the information that was collected during our analysis we conclude the following that:

  • The attack was intended towards the Middle-East. This is the second attack as the previous attack was from the Shamoon 2.0 campaign.
  • The attack was more sophisticated than the Shamoon 2.0. Which makes us believe that the attackers are learning from the previous campaigns and modifying their attacks with every new campaign.
  • This attack’s main motive appears to gain a backdoor access and hence from the analysis we could also observe that it tried to make use of windows powershell over and over.
  • The various components that we analysed from the campaign show us that the attackers did not take much efforts as to writing and customizing the malware all by themselves but focused more on how to spread and propagate to maximum users.
  • We strongly advise the users of Middle east to be very careful with emails from unknown senders since both the Shamoon 2.0 and this recent attack rely heavily on phishing attacks.

 

A new virus is in circulation and this time it is again targeting the Middle-East countries. Interesting enough last month the Middle east was (still might be) plagued with Shamoon 2.0, the deadly virus that made its comeback from the dead.