THREAT REPORT – FTCODE

CYNET DETECTION AND PREVENTION

Cynet 360 is protecting your assets against this type of exploit. This type of attack was detected by Cynet’s Advanced Detection Mechanism. The alert that was triggered was the PowerShell Malicious Command Alert:

Investigation overview

1. First Stage: Initiation of the attack

The first stage of the attack starts with a malicious Word file.

The file requests the user to press the “Enable Macros” button, apparently to show the “real” document.

Pressing this button will be the initiation of the attack, as it will launch the malicious macros hidden in this file.

After the Macros have been launched, the next stage consists of “winword.exe” launching PowerShell with the following command line:

This downloaded string will initiate the second stage of the attack.

The backdoor will usually be downloaded like this:

C:\Users\Public\Libraries\WindowsIndexingService.vbs or
C:\Users\Public\Libraries\WindowsIndexingService.js

2. Second Stage: Malware Prerequisites and Settings Variables

The command first checks what is the geographic location of the machine and if it is running through a Virtual Machine. If the infected host has localization setting of China, Romania, Russia, Ukraine or Belarus and/or if it is running from Virtual Machine, the command will terminate itself (“{ exit;};).

Figure 1 – the command that the malware uses to get the computer location:

Figure 2 – the command that the malware uses to get the computer name:

The rest of the command sets variables and paths for the rest of the code.

3. Third Stage: Create Temp File

This function is used to collect the following content and write it to a new file: “X0FX921.1.tmp“:

• $pid – the PID of the PowerShell process that executed the code.
• [string](Get-Date) – the current date and time.
• $vhgbtbsat – 921.1
• $myurlpost = $false.
• $jvxhiwv = will eventually finds out as the SSID of the machine.

Figure 3 – the command that the malware uses in order to check the PowerShell PID and the current date:

4. Forth Stage: Check Memory Usage

If the variable “$fwjacxg” matches the ‘OutOfMemoryException’ (An exception that is thrown when there is not enough memory to continue the execution of a program), it performs the following actions:

• Delete the “X0FX921.1.tmp” file. (to delete evidence)
• Stop the “PowerShell” process that executed the code.
• Perform exit.

5. Fifth Stage: Creating and Sending a Network Packet with Stolen Information

This function is used to build a network packet that will be sent back to the attacker in order to send stolen information of the victim.

This is the “try” action: the attacker is uploading the stolen information back to the C&C server, using “UploadString”. It converts the data to Base64, sends the data, and then converts back from Base64.
If there is an error, the data is converted back to Base64 with an error message.

This function is used to generate five different auto-generated domains based on the time of machine converted to base64 and ends with “. top”, all split by “,”. In addition, there is one static domain which is included in the domain lists (home[.]mmaut.com).

Figure 4 – the command that the malware uses to generate the domains using the machine time converted by base64: Then, the command uses the function “sendpost” in order to send the network packet with the stolen information to the six domains which reaches the malicious actors.

6. Sixth Stage: Kill Switch and configuring the “thumbcache_33.db”

The malware checks if the file “X0FX921.1.tmp” was created more than 15 minutes ago, if yes –

• Delete the “X0FX921.1.tmp” file. (to delete evidence)
• Stop the “PowerShell” process that executed the code.
• Or perform exit.

This command is set the PowerShell Build Version and the PowerShell Major Version as the $bivtvfg variable.
This is evidence to more information that the attacker steals and uses.

Figure 5 – the commands that the malware uses to check the PowerShell Build and Major Versions:

The rest of the command is checking that the file “thumbcache_33.db” is configured properly, if not it –

• Deletes the files “X0FX921.1.tmp” and “thumbcache_33.db”. (in order to delete evidence)
• Stops the “PowerShell” process that executed the code.
• Perform exit command.

These commands are set new variables and insert them into the file “thumbcache_33.db”.
The file contains the computer name, the first 16 digits of the GUID without hyphens (“-“), and the SSID of the computer.

Figure 6 – the command that the malware uses to get the computer name and the GUID first 16 digits 

7. Seventh Stage: Persistency

These commands silently delete the scheduled tasks “WindowsIndexingService” and “Windows Indexing Service”, if existed. Thereafter, it creates a task named “WindowsIndexingService”, that will execute the JavaScript file: “\Libraries\WindowsIndexingService.js” using “wscript.exe”. The execution is set to run silently daily, at 00:00. The task will repeat itself every 20 minutes, and for a duration of 23 hours and 59 minutes.

This is how the malware gains persistency on the infected host and disguises itself as an “innocent” task so the user or other AV mechanisms would not notice.

The above commands create a “WindowsIndexingService.lnk” shortcut file in the Startup directory. This is another way to gain persistency on the infected host. It first checks if the file already exists in the startup directory, and if not:

• It opens a new windows shell to run commands.
• It uses the new shell to create the shortcut file “WindowsIndexingService.lnk” in the Startup folder.
• Attaching the shortcut file to the JavaScript file “WindowsIndexingService.js” using “wscript.exe”, silently.
• It sets the file description as: “Windows Indexing Service”, in order to disguise itself.

8. Eighth Stage: Final Communication to the C&C Server

The command sets the variable $myurlpost, which unified in one variable the following information:

1. The auto-generated domains;
2. The PowerShell versions; and
3. The first digits of the GUID, without “-“.

It checks if the variable $zxczcibut exists, if yes – it aborts (as this variable is set to “false”). The abortion is made through the check of the length of the variable. If the length is less than 30 (always true) – it aborts the command. Otherwise, it uses “sendpost” function with the new $myurlpost variable that contains all the stolen information.

The code ends by a sleep command for 3 minutes and then deletes the “X0FX921.1.tmp” file.

The Dumped files

1. C:\Users\cynet\AppData\Local\Temp\X0FX921.tmp:

Contains:

• The PID of the PowerShell process that executed the code.
• The current date and time.
• 1 – Value of variable that probably used by the attacker to verify the variant.
• False – A value of variable that probably indicates the attacker if the variables were set.
• The SSID of the computer.

2. C:\Users\Public\Libraries\thumbcache_33.db:

Contains:

• The computer name.
• The first 16 digits of the GUID (without “-“).
• The SSID of the computer.

3. C:\Users\Public\Libraries\js:

The above JavaScript file is the file executed by the Task Scheduler. This file is highly obfuscated, as seen below:

After one stage of decoding:

After decoding the Base64:

We get the same code as the PowerShell command, which means that the malware re-executing itself to gain persistency and keeps sending the stolen information to the attacker.

RECOMMENDATIONS

• Delete all malicious files indicated above (especially all JavaScript and/or VBS files that used by the malware to reach persistence).
• Block traffic to malicious Domain\IP.

INDICATORS OF COMPROMISE