Unit42
Description
In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.
Summary
Firefox resolved and downloaded a file from uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com which was saved to the user’s Downloads folder as Preventivo24.02.14.exe.exe. The binary was executed by the local user, performed outbound network activity to 93.184.216.34:80, created multiple artifacts under AppData\Roaming and C:\Games, and used legitimate processes (firefox.exe, svchost.exe, msiexec.exe, mmc.exe) to replicate / hide before terminating.
Concepts
Sysmon: Sysmon, or System Monitor, is a Windows system service and device driver that logs detailed system activity to the Windows event log to help detect malicious behavior. It monitors and logs events like process creations, network connections, and changes to the file system, providing deeper security insights than standard Windows logging. This allows administrators to analyze events to identify suspicious activity, understand how an attack unfolded, and investigate security incidents.
Events
Resources
Files & Artifacts
697b7939d59f117e5ca4c90ab730658f
Microsoft-Windows-Sysmon-Operational.evtx
Indicators of Compromise (IOCs)
Download domains:
uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.comDestination IP observed:
93.184.216.34(port 80)Filenames / paths:
C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exeC:\Users\CYBERJ~1\AppData\Local\Temp\skZdsnwf.exeC:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\*C:\Games\*Preventivo24.02.14.exe.exe:Zone.Identifier
Chronological Attack Timeline
During the analysis of Microsoft-Windows-Sysmon-Operational.evtx, it was discovered that the binary Preventivo24.02.14.exe.exe was downloaded at 03:41:25 using Firefox by the user CyberJunkie from http://uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com/.
At 03:41:56, CyberJunkie manually executed the binary, and at 03:41:57, a misconfiguration in msiexec.exe enabled achieved privilege escalation to NT Authority System via AlwaysInstallElevated.
After the execution, the following files were created:
The analysis also indicated that Preventivo24.02.14.exe.exe established a connection to 93.184.216.34 .
Finally, once the malicious file infected the system and replicated itself the process is terminated at 03:41:58
Timeline
22
2024-02-14 03:41:25
DNS Query to uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com
11
2024-02-14 03:41:26.4
The file Preventivo24.02.14.exe.exe was written on disk
1
2024-02-14 03:41:56.5
Preventivo24.02.14.exe.exe was executed for the user.
3
2024-02-14 03:41:57.1
A connection was established to 93.184.216.34
1
2024-02-14 03:41:57.9
Preventivo24.02.14.exe.exe was executed by msiexec.exe achieving the Privilege Escalation
5
2024-02-14 03:41:58.7
The process has finished
Recommendations
Isolate the host from the network immediately to stop C2 / data exfiltration.
Collect the malicious binary and compute hashes (SHA256/MD5).
Upload hashes / sample to VirusTotal or a malware analysis service (if allowed by policy).
Search for persistence:
Registry Run/RunOnce keys, Scheduled Tasks, Services, Winlogon/Browser helper objects.
Check
C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\andC:\Games\.Use Autoruns for a fast sweep.
Collect memory dumps of suspicious PIDs (
firefox.exe,svchost.exe,msiexec.exe, and the PID for the malware) for artifact and injection analysis (Volatility / Rekall).Block IOCs at the perimeter / EDR: the Dropbox CDN subdomain pattern, the IP
93.184.216.34, and file hashes once available.Perform host recovery (reimage) if persistence is confirmed or if in-memory compromise is significant. Rotate credentials used from the host.
Last updated