{"id":839,"date":"2017-05-22T21:27:54","date_gmt":"2017-05-22T20:27:54","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=839"},"modified":"2017-05-22T21:27:54","modified_gmt":"2017-05-22T20:27:54","slug":"2017-05-22-blankslateglobalimposter-malspam","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=839","title":{"rendered":"2017-05-22 Blankslate\/GlobalImposter Malspam"},"content":{"rendered":"

As promised from my last post<\/a>, here is the write up from running the malicious Javascript in my VM. Initially a couple of us on Twitter<\/a> thought that this may be GEO IP specific since they could not get it to run in the US, and nor could I. I could only seem to get it to work when using European endpoints. Turns out that I forgot to delete the *.tmp file that got created when running the Javascript script when I started bouncing around different VPN locations. As of this write-up, I was able to get the malware to run from California and Japan without any issues. <\/p>\n

I was also able to find where Brad had seen the same email address in the ransomware note too, which he stated was a BlankSlate malspam campaign using GlobalImposter ransomware. For more information about this check out his blog post here<\/a>. I also came across another Tweet from @JamesWT<\/a> (you should follow him on Twitter) where he came across the malicious domain back on the 19th<\/a> which links over to the Virustotal results here<\/a>.<\/p>\n

Below is a snapshot of what my install of Security Onion saw as well while I was running the malspam on my VM. As noted in the results from Squil, the Javascript script is related to Nemucod as well. Security Onion was using the paid version of the Snort VRT rules. <\/p>\n

\"\"<\/a><\/p>\n

With that being said…<\/p>\n

Indicators of Compromise:
\n=========================
\n47.91.93.208 \/ pichdollard[.]top (HTTP)<\/p>\n

Artifacts
\n=========
\nFile name: 4090.js
\nFile size: 13 KB
\nMD5: 263726d5c60868300549a9b9682e738b
\nVirustotal: NA
\nMalwr: NA
\nPayload Analysis: NA <\/p>\n

File name: 92927.exe
\nFile size: 233KB
\nFile path: C:\\Users\\%username%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\
\nMD5: 1bbd2dc9746292c60121865663b287f2
\nVirustotal: http:\/\/virustotal.com\/en\/file\/2815c8cdb02003298f7959fd1cf6eed893de6652f3861a6a2e3e5744b8ac9234\/analysis\/<\/a>
\nFirst detection: 2017-05-21 16:12:16 UTC
\nDetection ratio: 25 \/ 61
\nMalwr: NA
\nPayload Analysis: NA<\/p>\n

File name: qfjgmfgmkj.tmp
\nFile size: 20B
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp\\
\nMD5: 19bf319ca5b94c8d2ef352c49bbae50e
\nVirustotal: http:\/\/virustotal.com\/en\/file\/b384f104c0134a0c0e7887e2a312cdabd774d0cf5794288b30b547af38f2dc3f\/analysis\/<\/a>
\nFirst detection: 2017-05-16 11:20:12 UTC
\nDetection ratio: 0 \/ 56
\nMalwr: NA
\nPayload Analysis: NA<\/p>\n

File name: hjkhkHUhhjp.bat
\nFile size: 259B
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp\\
\nMD5: 6e26f75126c4ccc964d027ab76146482
\nVirustotal: NA
\nMalwr: NA
\nPayload Analysis: NA<\/p>\n

Analysis of Malware:
\n====================
\nThis is a pretty simple infection chain to say the least. The user received the following email which had a Javascript file in a zip file attached to it. <\/p>\n

\"\"<\/a><\/p>\n

Once the Javascript had been executed, there was a single GET request to the site ‘pichdollard[.]top\/admin[.]php?f=404’ to download the malicious binary. The file that got downloaded was called “404” as seen below:<\/p>\n

\"\"<\/a><\/p>\n

It was then saved to the “SpecialFolders” directory called “Templates” as [random_number].exe (in this case it was called “92927.exe”). For more information about SpecialFolders in Windows, check out the Microsoft MSDN article here<\/a>. Once the file had been written to the file-system, the Javascript script proceeded to execute “92927.exe.”<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Once it was up and running, it then created a child process of itself. This process then created the “qfjgmfgmkj.tmp” file to show that the malware had run on the system. This is the file that I forgot to delete when I was bouncing between VPN endpoints. This file contained just a simple string – D1478B8A8D18D838C5AC. If I deleted that file, I was able to re-run the malware without any issues. If the file was left, the binary would not run and would exit out. This child process also kicked off the VSSADMIN.exe process to start deleting the system’s shadow copies:<\/p>\n

\"\"<\/a><\/p>\n

Once this was done, the 92927.exe process started to encrypt files as seen below:<\/p>\n

\"\"<\/a><\/p>\n

and also created a batch file called “hjkhkHUhhjp.bat” that did some cleaning up\/housekeeping on the VM.<\/p>\n

\r\n:Repeat\r\ndel "C:\\Users\\Bill\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\986444.exe"\r\nif exist "C:\\Users\\Bill\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\986444.exe" goto Repeat\r\nrmdir "C:\\Users\\Bill\\AppData\\Roaming\\Microsoft\\Windows\\Templates"\r\ndel "C:\\Users\\Bill\\AppData\\Local\\Temp\\hjkhkHUhhjp.bat"<\/pre>\n
The odd thing with this one is that I never got the pop-up alerting me to the fact that the system had been infected and that the files were encrypted. There was no change of my desktop, or anything of the sort. It wasn’t until I noticed the file extension “.crypt” on files when I was browsing around directories and also when I saw the HTML instructions file called “how_to_back_files.html” in one of the directories.<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
You can find the artifacts, PCAP, and ProcMon logs from this investigation over on my Github account here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
As promised from my last post, here is the write up from running the malicious Javascript in my VM. Initially a couple of us on Twitter thought that this may be GEO IP specific since they could not get it to run in the US, and nor could I. I could only seem to get it to work when using European endpoints. Turns out that I forgot to delete the *.tmp file that got created when running the Javascript script when I started bouncing around different VPN locations. As of this write-up, I was able to get the malware to…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-839","post","type-post","status-publish","format-standard","hentry","category-packet-analysis"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/839","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=839"}],"version-history":[{"count":4,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/839\/revisions"}],"predecessor-version":[{"id":852,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/839\/revisions\/852"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=839"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=839"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}