17 KiB
17 KiB
Malware analysis about unknown Israel APT campaign
Table of Contents
- Malware analysis
- Cyber Threat Intel
- Indicators Of Compromise (IOC)
- References MITRE ATT&CK Matrix
- Links
Malware analysis
Initial vector
The initial vector use an SFX executable, who drop a lnk file for the persistence, a vbs file and the docx file for decoys the victim.
We can also note the multiples possiblities for push the persisitence and options.
This execute the vbs file for push the persistence in the startup menu, hide it in changing these atributes and launch the persistence (lnk file)
This download the VB script and execute it by mshta call.
On the VB code, we can observed that use BITS fonctionality for download by a job the JS script to execute on the victim. Secondly, this check the architecture of the system and execute the correct path of wscript and push the windows out the screen.
Loader
We can see that use function for decode the commands with a array of bytes.
For decode the string , we use the next function used by the backdoor for decode the commands.
You can now change the encoded commands.
Once the encoded strings removed, we have the following code :
As anti-forensic method, a method which can know if determiner if a debugger is present.
Finally, we can observe a Wscript execution with a function splter which split for get a array of byte, convert to ASCII and after execute the script with execute call.
By the following PowerShell script, we can get the second layer that is the JS Backdoor.
JS Backdoor
Firstly, the script get the system informations about the system of the victim and send to one the list of C2 in the logical sense (not random call on the list of C2) with the suffix "/is-ready". The backdoor use a while loop for rest in communication with C2 by send pulse with the system information of the victim.
This send the data with the following structure to the C2 (Here from the Anyrun sandbox) :
C4BA3647<|>USER-PC<|>admin<|>Microsoft Windows 7 Professional <|>plus<|>nan-av<|>
We can note that the USB spread option isn't used on this sample. The structure of the reply to the C2 is the next :
[volumeserialnumber]<|>[computername]<|>[username]<|>plus<|>[AV product (yes -> name or no ->nan-av)]<|>[usbspreading option (= "")]<|>
In a second time, when a response of the C2 was given and use a swith structure for execute the command.
Now, we analyse all functions used by this switch. As first function, we can see a function used by others functions of the script and used for send the data to the C2.
We can observe after a group of functions who use the wql queries by the WMI for get the system informations, this is used by the attacker as profiling the victim.
After, a function is used by the attacker for download an executable file.
In the same idea for the attacker, a fonction which give the possiblity to read the bytes of files in a buffer and send it to the C2 is present.
The next function give to the attacker to have the list drives on the computer.
Another function can emumerate the paths of folders, files and to give in more the attributes of them.
And third function is used for get the list of the process running in the computer.
The last function exit the process with a kill signal by taskkill call.
We can resume the list of commands of the backdoor :
| Command | Description |
|---|---|
| execute | execute a command DOS/Powershell |
| send | Download a file to execute |
| site-send | Function don't exist but have the same arg that send command, seems be edited function of site-send and not deleted ? |
| recv | Read a file, put in a buffer and send to the C2 |
| enum-driver | Send the list of drives to the C2 |
| enum-faf | Get list of the folders, files and attributes and send it to the C2 |
| enum-process | Get list of the process (name, id, path of the executable) and send it on the C2 |
| delete | Function don't exist but by the params seems give to the attacker to delete folders or files |
| exit-process | Kill the backdoor process but can't remove the persistence, an "execute" command must be performed before for delete it in the registry |
All the IP are hosted on differents cloud provider.
| IP | Route | ASN | Organization | Country | City | Region | Coordinates |
|---|---|---|---|---|---|---|---|
| 66.154.103.156 | 66.154.102.0/23 | AS8100 | QuadraNet Enterprises LLC | United States | Secaucus | New Jersey | 40.7895,-74.0565 |
| 37.48.111.5 | 37.48.64.0/18 | AS60781 | LeaseWeb Netherlands B.V. | Netherlands | Noord-Holland | Amsterdam | 52.3824,4.8995 |
| 85.17.26.65 | 85.17.0.0/16 | AS60781 | LeaseWeb Netherlands B.V. | Netherlands | Noord-Holland | Amsterdam | 52.3824,4.8995 |
Cyber kill chain
The process graph resume the cyber kill chain used by the attacker.
Cyber Threat Intel
Origin of the method for the JS Backdoor
Firstly, the method for load the JS Backdoor is edited from a post published in 2015 on a forum for show a method for the both architecture for the developpment of a worm.
We can see that the name of the instance is changed and the html tags are removed.If we add the notes from the malware analysis, we can conclude that the malware has been edited in emergency.
A army in perdition, an difficult situation
Since the last decade, the inexperience of the army on military issues, rigid doctrine, misunderstanding of the adversary, over-reliance on air and all-technological operations, loss of skills in the IDF, hesitations of unit commanders, the belief - erroneous - that the Israeli population would not accept the possible losses, a reorganized but deficient logistics, the non-mastery of communication. If we add the syria situation and result of the confrontation in 2006 who have add new emmenies against Israel, this create a difficult situation for these leaders.
Actually in election period, each valuable action or opportunities can be used for this or for expend doctrine like the creation of housing in the colonies.
A war of misinformation
Like all recents conflits, the networks of communications are used for send wrong news and propaganda or create it due to the people can't understand the situation. For exemple, recently we can heard that a false evacuation of wounded have been do for decoy the Hezbollah for push to stop shooting but this isn't know guerilla and the result of the latest conficts whre this isn't the rockets which dettroyed the military equipement but the Israel's forces who have sabotage their own equipment by the fear of the new rescuits and their inexperiences. In same reflexion, the fear of rockets launch on a city can't be realitic by the fact that the priority is the border army garrisons, infrastructure are better choice due to this the means used Hezbollah against the priority , this argument is apply in Israel for prepare the people to possibilities to claim the war.
In this way, some pictures have be send in the both side for used this factor as propaganda vector.By example, a picture taken with a drone of the feneter of netanyahou have been released in the social medias for show the capacities of reprisals. If we see the picture with the naked eye, we can see that the shadow of drone isn't report in the wall inside the room, the facade is an decor, fake coordonnates and blur is applied to all photo.
With the ELA algorithm, we can see the last modifications on the pictures. In using this it, we can see all the precedants elements are added at the original picture (probably a meeting with members of government).
In same time, other pictures are released about decoy targets, with the ELA algoritm, we can see that the multiple compressions by the algorithms, the picture is very dark and the pictures are only modify for write the indicators of interest.
Recently, in the same way for develop the feeling of fear, Israel gouverment have claimed that Iran build precision missiles , this rest to prove it but the scheme of reflexion is the same, a war of fear and misinformation.
The drone attack, a result of the information campaign ?
References MITRE ATT&CK Matrix
List of all the references with MITRE ATT&CK Matrix
| Enterprise tactics | Technics used | Ref URL |
|---|---|---|
| Execution | T1170 - Mshta T1064 - Scripting |
https://attack.mitre.org/techniques/T1170 https://attack.mitre.org/techniques/T1064 |
| Persistence | T1197 - BITS Jobs T1060 - Registry Run Keys / Startup Folder |
https://attack.mitre.org/techniques/T1197 https://attack.mitre.org/techniques/T1060 |
| Defense Evasion | T1197 - BITS Jobs T1170 - Mshta T1064 - Scripting |
https://attack.mitre.org/techniques/T1197 https://attack.mitre.org/techniques/T1170 https://attack.mitre.org/techniques/T1064 |
| Discovery | T1012 - Query Registry | https://attack.mitre.org/techniques/T1012 |
| Lateral Movement | T1105 - Remote File Copy | https://attack.mitre.org/techniques/T1105 |
| C2 | T1105 - Remote File Copy | https://attack.mitre.org/techniques/T1105 |
Indicators Of Compromise (IOC)
List of all the Indicators Of Compromise (IOC)
| Indicator | Description |
|---|---|
| فضيحة جديدة لأحد قيادات حماس.exe | 03d82852bbb28d1740e50206e7726c006b9b984a8309e2f203e65a67d7d3bcad |
| History.lnk | 3853e0bf00d6dbfc574bc0564f0c90b93a66d644dd4dc8b8c00564f0b6edf581 |
| ss.vbs | 2e5f9bb1cef985eab15ad8d9072e51c71be2810fea789836b401b96bc898943b |
| news.docx | 08fa35e25f4c7a6279a84b337d541989498d74f2c5e84cc4039d667fedc725c7 |
| xyx.jse | 32e216942f995f285947c7e7ee8cf438440c8a1e033bb27517f5e5361dafa8e8 |
| adamnews.for.ug | Domain requested |
| israanews.zz.com.ve | Domain requested |
| mmksba.dyndns.org | Domain C2 |
| webhoptest.webhop.info | Domain C2 |
| mmksba.simple-url.com | Domain C2 |
| 85.17.26.65 | IP requested |
| 66.154.103.156 | IP C2 |
| 37.48.111.5 | IP C2 |
| http[:]//israanews.zz.com.ve/hw.zip.zip | HTTP/HTTPS requests |
| http[:]//adamnews.for.ug/hwdownhww | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-ready | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-ready | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-ready | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-sending | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-sending | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-sending | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-recving | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-recving | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-recving | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-enum-driver | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-enum-driver | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-enum-driver | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-enum-faf | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-enum-faf | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-enum-faf | HTTP/HTTPS requests |
| http[:]//webhoptest.webhop.info:4433/is-enum-process | HTTP/HTTPS requests |
| http[:]//mmksba.simple-url.com:4422/is-enum-process | HTTP/HTTPS requests |
| http[:]//mmksba.dyndns.org:4455/is-enum-process | HTTP/HTTPS requests |