🔒
There are new articles available, click to refresh the page.
✇Research Blog by Security Research Labs

Hacking mobile networks has gotten a lot more interesting with 5G and Open RAN

Cloud security is often the weakest link in modern 5G networks according to our red team hacking assessments. Telcos have an opportunity now to embrace cloud security best practices and make 5G networks much more hacking resilient.

✇Blog - Signal Labs

Fuzzing WeChat’s Wxam Parser

By: christopher vella

Background

WeChat (if you haven’t heard of it) is a super popular chat app similar to the likes of WhatsApp, and runs on iOS, Android, Windows and MacOS.
Being a chat app, it handles various file formats like images and videos, and also propriety formats like “Wxam” (which honestly I haven’t researched before so you’ll see how I approached that).

You’ll also see below some of the challenges I had in my harnessing of the target and how my initial fuzzer framework I chose had to be replaced due to lack of support for certain functionality that WeChat used (and how I debugged this).

Researching the Target

Now that we know what WeChat is we can look at how I decided to write a fuzzer (in 1 day!) for this target!
It started by deciding I wanted to blog about fuzzing something, previously I’ve had blogs on Logic bugs and I wanted to balance that with some cool fuzzing target I haven’t looked at before, so I started by browsing ZDI to see if any displayed targets were interesting.

I noticed a few entries for WeChat like the below:

ZDI WeChat bug disclosures

Now at this point I know what WeChat is, but I have no idea what WXAM is (but its safe to guess its some format that gets parsed).

So my next step was to simply install WeChat in a VM! Note that here I’m targeting the Windows build of WeChat, for the following reasons:

  1. I want this to be quick, its primarily for this blog post and I know I can fuzz Windows targets faster than iOS/Android

  2. If this parser also exists on other platforms, it probably isn’t much different (potentially if I find the bug on Windows, it’ll exist on the other platforms)

Now its installed and I have a bunch of executables and DLL files in C:\Program Files (x86)\Tencent\WeChat, so how do I find the WXAM parsing functionality?

Finding the Target

A good starting point may be to dump all the imported & exported functions from all the executables and DLLs and search for anything with the name “wxam” in it, but I went a different route — I simply guessed and opened the DLL that sounded interesting in IDA!

For me, looking at the list of DLLs I spotted “WeChatWin.dll”, this sounds like a main DLL for WeChat that handles certain Windows specific APIs or something? Who knows, but it stood out more than some of the other DLLs, so I opened this in IDA.

This DLL took a while to load, its pretty large (~40mb), once done the first thing I did was search in functions, imports & exports for the name “wxam”, there I found:

wxam2pic imported function shown in WeChatWin.dll

We spot an imported function named “wxam2pic” that lives in “VoipEngine.dll” — nice! This is a great starting point, it even sounds like a parser.

Before I look at wxam2pic in VoipEngine, I first examine cross-references to this import within WeChatWin.dll and see how WeChatWin uses this, I spot two functions that call this, including this one:

Usage of wxam2pic in WeChatWin.dll

Scrolling to the top of this function we spot:

Don’t you love debug prints?
This string alone implies the function we’re looking at is a “WxAMDecoderHelper”, specifically this function handles the “DecodeWxam” functionality — Awesome! This is exactly the type of function that corresponds with the ZDI entries we saw.

There’s something else notable about this function, look at how IDA shows the prototype:

Its a custom calling convention!

This means if we were to target this function for fuzzing directly, we’d have to match this custom parameter passing convention instead of Visual Studio’s provided options (fastcall, cdecl, etc).

Instead, I took a look at the function that calls this function, and I got:

(Note: ignore the function name itself, I named it this from what I saw!)

Nice, this function uses a standard calling convention (fastcall), takes only two arguments and calls the DecodeWxam function (handling the custom calling convention for us!)

We also see from the debug print that this function appears to decode the Wxam and then re-encode it as a jpeg, this would be a great function to fuzz!

(Note: There’s another decoder that transforms the Wxam to a GIF! We’re not going to look at that one in this blog, but its essentially the same).

Reversing the Target Function

Alright so I want to fuzz this function as it appears to take a Wxam file and parse it, lets analyze the parameters.

Lets view cross-references to this function to see how its called:

(Note: I named the read_file function myself, if you open this function you see a simple CreateFile + ReadFile operation on the provided fName variable!)

From this, I see the following:

  • A filename is provided to the function I myself named “read_file” and a buffer is returned in v11

  • The buffer and a flag is passed to “isWxGF”, this function reads a header and the flag to determine if we should parse it further or not

  • If we pass the “isWxGF” check, we call the decoder function passing through:

    • The file buffer containing the bytes of our input

    • A pointer to a int containing the value 0

      • This pointer seems to be some output from the decoder, if its non-zero its assumed to be another valid pointer

This seems super easy to fuzz:

  • We can fuzz using shared-memory mode in a fuzzer like WinAFL

  • Our fuzz function will:

    • Call isWxGF; and if successful:

    • Calls the decoder

So I wrote a harness to do this in WinAFL, however:

This usually means our program is crashing before reaching the our fuzz function.

So I run WinAFL under WinDBG and see an invalid address dereference when trying to load the “WeChatWin.dll” file!

I analyze the DLL entry point and spot:

I see, this DLL uses CRT (also thread-local storage) — this causes issues with DynamoRIO (which I was using with WinAFL).

This can be confirmed by compiling my executable with CRT support and noting that WinAFL crashes before our process main executes at all!

So this means we can’t use DynamoRIO, our options include:

  • Using WinAFL in IntelPT mode (I’m using an AMD CPU, so no go here)

  • Use a different fuzzer

Well I chose a different fuzzer.

I could have gone the snapshot route with Nyx or what-the-fuzz, instead I decided to try Jackalope

This has a very similar command line to WinAFL, and uses TinyInst for instrumentation (no DynamoRIO!)

Upon trying this, it worked:

Its fuzzing, and we are getting new coverage!

At this point I stopped, I got the fuzzer working well enough I was happy for the day, next steps would include:

  • Analyzing coverage, ensuring we’re not hitting any roadblocks

  • Check stability / determinism, ensure there’s no globals we need to reset

    • Or just throw this into a snapshot fuzzer

  • Understand what all the flag values mean, and how we can leverage them in our fuzzing

  • Reverse the WXAM format and create better corpus, and a format-aware mutator

Also note that in the isWxGF function, I noted the header bytes it checks for and ensured my initial corpus had that header (so we start with an input that successfully passes that check).

There are other things I did in the harness, which are general fuzzing things like obtaining the non-exported function pointers to our target functions we wanted to fuzz.

I’ve included the harness I used below, along with the Jackalope command line I used to kick off fuzzing, feel free to take this and expand on it or view coverage to see how far it gets!

Overall this was a fun half a day exercise at quickly writing a basic fuzzing harness based on some ZDI entry.

Files

I put all the files on my Github: https://github.com/Kharos102/BasicWXAMFuzzer

Want to Learn Fuzzing?

We offer Vulnerability Research & Fuzzing trainings live or self-paced (For our self-paced trainings, see: https://signal-labs.thinkific.com/collections)

For any questions, feel free to contact us!

✇Cisco Talos

Threat Roundup for July 29 to August 5

By: William Largent

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 29 and Aug. 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.

The most prevalent threats highlighted in this roundup are:

Threat Name Type Description
Win.Dropper.TrickBot-9958804-0 Dropper TrickBot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Win.Ransomware.Cerber-9958814-0 Ransomware Cerber is ransomware that encrypts documents, photos, databases and other important files. Historically, this malware would replace files with encrypted versions and add the file extension ".cerber," although in more recent campaigns other file extensions are used.
Win.Virus.Xpiro-9958895-1 Virus Expiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.
Win.Dropper.Remcos-9960040-0 Dropper Remcos is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam and capture screenshots. This malware is commonly delivered through Microsoft Office documents with macros sent as attachments on malicious emails.
Win.Dropper.Shiz-9958984-0 Dropper Shiz is a remote access trojan that allows an attacker to access an infected machine to harvest sensitive information. It is commonly spread via droppers or by visiting a malicious site.
Win.Dropper.HawkEye-9959777-0 Dropper HawkEye is an information-stealing malware that targets usernames and passwords stored by web browsers and mail clients on an infected machine. It is commonly spread via email and can also propagate through removable media.
Win.Worm.Kuluoz-9959792-0 Worm Kuluoz, sometimes known as "Asprox," is a modular remote access trojan that is also known to download and execute follow-on malware, such as fake antivirus software. Kuluoz is often delivered via spam emails pretending to be shipment delivery notifications or flight booking confirmations.
Win.Dropper.DarkComet-9959797-1 Dropper DarkComet and related variants are a family of remote access trojans that provide an attacker with control over an infected system. Capabilities of this malware include the ability to download files from a user's machine, mechanisms for persistence and hiding, and the ability to send back usernames and passwords from the infected system.
Win.Dropper.Ramnit-9960101-0 Dropper Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It can also steal browser cookies and attempts to hide from popular antivirus software.

Threat Breakdown

Win.Dropper.TrickBot-9958804-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 46 samples
Mutexes Occurrences
5502606391408671395 4
32899542343072484998 4
1124524871971925691 3
24112587554236391103 3
39744624822682236206 3
23819686304274202058 2
31572222973474305701 2
38648211142506533958 1
33656147683147949452 1
7918010151544240523 1
38748932962513239244 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
wequinc[.]pl 4
patardd[.]pl 4
rydedun[.]pl 3
boristh[.]pl 3
lionopp[.]pl 3
matesic[.]pl 2
zanouns[.]pl 2
beryofn[.]pl 1
cabolth[.]pl 1
risiert[.]pl 1
githyet[.]pl 1

File Hashes

01a4f86457a252ffc23117ba653a2093902d0160140a3fda03e3cb9595f6d652 04a8a18b801bf158717c49444c3148f56fb1c23b6781b589106b848fad13557f 04d4ecf05a7bcc6ca0f318bacaa6087ea1e5badc14ca9eebec52aaff791718bc 08a004e94ce71ee0d239e38242283544f530996f4785924f85616040b278bef4 094f5c76889cd9f3f9357d72eda49a962eedc8457a77d586459dbd5968f85aef 0c25f673e25e8c9bb066ae56c41a83e28ef40a9da8327c9f7cd09f663b9a4614 0ef6c2cc035d61abd0f221d2bb8d6c0f5fc1e2e87cd5001f47861435fded326b 12eb4eb5dd38c776ec50166596c5e4ffda47108ce709990ae84a33a3a91776ed 1f14d617fd53588a36cd26c19e6f306fad28bac24140e9083986bb0cac607bc5 2184130eb8a891000fee1e343a5634531d72e05a7893fbafd6d53e52350bae19 23d19c57bacf51421505125da6917c815a1aa0d5c7346cf42c47f6667df0599d 2549d2a70d146340d14d981ecd9c33ce384bc743d4ed258f1eb9740c30792429 26851fc35426f83e70d1542cc4f00a3dd16222de418d2e0727a4ab9d5218c22b 28d1f82ea2f237ae643e442adae17449dadb8ad93397bf2299b0b53abeee45cb 2d05858c463ea267870ff964d9f9779def1ca711586dcfea58745ebe6675ff1f 2d1e5cc0f414d6cc94ec251605c68c32c442740e129d7af97f8293844aecca6a 30636b11d051121251b2051971223e6e294dfaf917338239deb5b8edf5bce20b 39d4446bb6b1c8cbf319fe02f1316897f22a6b00633af1b7e6159dbd7b837556 3a0c89d07193ae260ced7a04873117af0213c43407248d2ff7edf95bd3b32421 3b5e722ae23b3656cfb17fcb9fd218b92c5e4f24c241c3f1c37bded99d92c035 3f32a6229d93292633dc3c9af4dcf7360463cd9fcc72bfc68bfc68afa666316d 4f47c12806778d27afa43905ebb5b2079a451da93237899167d6420333cfe9a8 50543f06717e0d022a4b58043861f0a38ab82e068f07414adc5be142a66c6cec 513125bc77c78f24fc6a29a125c0d5373d5b365f476ba496f90d8dc952fd4441 5584279c960a9a7aeb97ececdb90adc01da3dab0f1fe1cbf8c10e67f14d19c0d
*See JSON for more IOCs

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security N/A
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella N/A
WSA N/A

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Ransomware.Cerber-9958814-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 16 samples
Registry Keys Occurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
Value Name: Run
16
<HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
Value Name: AutoRun
16
<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D} 16
<HKCU>\PRINTERS\DEFAULTS 16
<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D}
Value Name: Component_01
16
<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D}
Value Name: Component_00
16
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: fc
2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: fc
2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: ntoskrnl
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: ntoskrnl
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: grpconv
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: grpconv
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: hh
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: hh
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: WerFaultSecure
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: WerFaultSecure
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: javaws
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: javaws
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: at
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: at
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Dism
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: Dism
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: sc
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: sc
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: expand
1
Mutexes Occurrences
shell.{381828AA-8B28-3374-1B67-35680555C5EF} 16
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
85[.]93[.]0[.]4 16
85[.]93[.]0[.]118 16
85[.]93[.]0[.]2/31 16
85[.]93[.]0[.]92/30 16
85[.]93[.]0[.]96/28 16
85[.]93[.]0[.]112/30 16
85[.]93[.]0[.]116/31 16
85[.]93[.]3[.]224/27 16
85[.]93[.]4[.]0/25 16
85[.]93[.]4[.]128/26 16
85[.]93[.]4[.]192/27 16
85[.]93[.]4[.]224/29 16
85[.]93[.]4[.]232/30 16
85[.]93[.]4[.]236/31 16
85[.]93[.]39[.]8/29 16
85[.]93[.]39[.]16/28 16
85[.]93[.]39[.]32/27 16
85[.]93[.]39[.]64/26 16
85[.]93[.]39[.]128/25 16
85[.]93[.]40[.]0/21 16
85[.]93[.]48[.]0/24 16
85[.]93[.]49[.]0/25 16
85[.]93[.]49[.]128/28 16
85[.]93[.]49[.]144/31 16
Files and or directories created Occurrences
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2} 16
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\fc.lnk 2
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\fc.exe 2
%System32%\Tasks\fc 2
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\ntoskrnl.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\ntoskrnl.exe 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\WerFaultSecure.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\WerFaultSecure.exe 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\ndadmin.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\ndadmin.exe 1
%System32%\Tasks\ndadmin 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\grpconv.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\grpconv.exe 1
%System32%\Tasks\grpconv 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\sdchange.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\sdchange.exe 1
%System32%\Tasks\sdchange 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\at.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\at.exe 1
%System32%\Tasks\at 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\hh.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\hh.exe 1
%System32%\Tasks\hh 1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\javaws.lnk 1
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\javaws.exe 1
*See JSON for more IOCs

File Hashes

13cb0416ecaedac2d05c117c68d7745d2f2ef8d2e41a5522ae28a9fdbe1cc464 18e9f9e0f0584b662165a2c78ca155ec06b59f48bfb09655929aaf6e4d3e04b6 273e649cfa2dba65d23094955a8901b2d8bcabd9d883eb53db97da09b2dc7257 37ce9b3d448b8d7ced3c71deebe8a826aa27095d155bbb08f5fe945edcaa665d 396c12c17e7de26873a87c37724b30ebeee8a246cb9f4dd8c81c4eb28e5a36ec 62e12d7f62c7c9826d8b20334d6bf5a9b9367cc92735c4c0ee0b9b04c68ebb30 636bb6784c21658f113ea4dcc00a82f0aa2c1e68927f3bb398d57ab5fcb6bc53 7017f1de73c8949efa7b04eb9973d73b712af738d2faf268cf32be7dea92b136 73fd26b7ee1d7939a55ee17a0ea15fc4a3aa85d417f9d19ec33230e71d21ac11 80574eb815087be8ead2c679474b8cf100a5a4db41cd3e012eff0c3e50ed900a 910aad5d8e14a47c2882531c587ceb7836af31e2c09296c43877a3ed2cc044e6 a340be1e9fe2140662c6bb04f1280eb91b1b1b1bd76c8e484ab4058ff25d5cf3 c41250c29a915060c509cb390c8dac68029067c1537707742ed211866ae2bff4 caba5cbc3931965b5f478934e02d20775413e15bcc559a684c632cfa9b151583 f6c4639bcabd34e8b2e9cf8323e07416a11bc4d579b910405880a8950128cfb1 fc73adec96749e88de8fb29777f1b4c27439c24690236857576076f545c8deb5

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security This has coverage
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella N/A
WSA N/A

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Virus.Xpiro-9958895-1

Indicators of Compromise

  • IOCs collected from dynamic analysis of 37 samples
Registry Keys Occurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
Value Name: HideSCAHealth
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_32
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_64
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_32
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_32
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\COMSYSAPP
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\COMSYSAPP
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IEETWCOLLECTORSERVICE
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IEETWCOLLECTORSERVICE
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MOZILLAMAINTENANCE
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MOZILLAMAINTENANCE
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MSISERVER
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MSISERVER
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OSE
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OSE
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\UI0DETECT
Value Name: Type
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\UI0DETECT
Value Name: Start
37
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM
Value Name: EnableSmartScreen
37
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC\S-1-5-21-2580483871-590521980-3826313501-500 37
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC\S-1-5-21-2580483871-590521980-3826313501-500
Value Name: EnableNotifications
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_32
Value Name: Start
37
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_64
Value Name: Start
37
<HKLM>\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V2.0.50727\NGENSERVICE\STATE
Value Name: AccumulatedWaitIdleTime
37
<HKLM>\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V2.0.50727\NGENSERVICE\LISTENEDSTATE
Value Name: RootstoreDirty
37
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK\V2.0.50727\NGENSERVICE\STATE
Value Name: AccumulatedWaitIdleTime
37
Mutexes Occurrences
kkq-vx_mtx61 37
kkq-vx_mtx62 37
kkq-vx_mtx63 37
kkq-vx_mtx64 37
kkq-vx_mtx65 37
kkq-vx_mtx66 37
kkq-vx_mtx67 37
kkq-vx_mtx68 37
kkq-vx_mtx69 37
kkq-vx_mtx70 37
kkq-vx_mtx71 37
kkq-vx_mtx72 37
kkq-vx_mtx73 37
kkq-vx_mtx74 37
kkq-vx_mtx75 37
kkq-vx_mtx76 37
kkq-vx_mtx77 37
kkq-vx_mtx78 37
kkq-vx_mtx79 37
kkq-vx_mtx80 37
kkq-vx_mtx81 37
kkq-vx_mtx82 37
kkq-vx_mtx83 37
kkq-vx_mtx84 37
kkq-vx_mtx85 37
*See JSON for more IOCs
Files and or directories created Occurrences
%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 37
%CommonProgramFiles(x86)%\microsoft shared\Source Engine\OSE.EXE 37
%ProgramFiles(x86)%\Microsoft Office\Office14\GROOVE.EXE 37
%ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe 37
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 37
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 37
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 37
%SystemRoot%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 37
%System32%\FXSSVC.exe 37
%System32%\UI0Detect.exe 37
%System32%\alg.exe 37
%System32%\dllhost.exe 37
%System32%\ieetwcollector.exe 37
%System32%\msdtc.exe 37
%System32%\msiexec.exe 37
%System32%\snmptrap.exe 37
%System32%\sppsvc.exe 37
%System32%\vds.exe 37
%SystemRoot%\ehome\ehrecvr.exe 37
%SystemRoot%\ehome\ehsched.exe 37
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\ngen_service.log 37
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log 37
%SystemRoot%\SysWOW64\dllhost.exe 37
%SystemRoot%\SysWOW64\msiexec.exe 37
%SystemRoot%\SysWOW64\svchost.exe 37
*See JSON for more IOCs

File Hashes

013aa31a250e2858846c6f078e12a5132abbc0fad271365d3b67527fa2c2f402 05c2e245c5f3a325472cf34f42093931e48d181c0f17caf9add2b35e7a3e828c 0aee33737e3213c74bb671a1ab7b9485e00ade57ade144e2be354f67506a7290 0af8855eff016554c3ddf0ce82bb61859ac3986ee4136ee06e7fe5d5a6d89788 0ca2f5ca6ce21bacf1b26601c214a36766a0c911320bec0c184b5a18923ece23 128d57cca2eae54f5754a5f1730a05df82d942a11764d0595e6c920498e9565f 1397eff74a13595ea3fcb206a76977d1447997680fdf81163c2b985a009b080c 13dd82a41add2789b1ea617cded11cf9bdbc143082372dcc2b26b2ae2616dbba 14e5e9016d589d815058b09845af3b2fc2781b9815a493499664f29e9832e9fa 16fcdd9f0950eda4799c80afd354767feefb725c58d82022c2d1385e25d48e96 1b0665bd149dd3b9ae9a3b19c7be06b5ddcd53da461f91cda65365b94b7a288b 1cf200ce049a09ea6f18ff56f65c651d519d6096d6eaf94331351c1217d2e002 1f98e6f12d028379751c4e5f6efe96e0fe8a286c7448513dda93c980e3d8acf6 26bd53dc56ec5c20627d67c8bdce2f67c3325bd6421a87319e3694abcf73867e 28664a444ff8d844816b801fcf92199100cad7375ebaedea96020b2f7e2c664b 290be865ff04b744f3f34e17cded589f11519cb10d5d186535cd5a21de8dd650 29e70dc26eb00d9ff16ed8864b2583dde97e70d6f7dc074c50f3665ad7f8b2dc 2c52d85ad0e41acf5112bccbbdde281950692c0e100e499a15b170d66d0154d0 30ed57cfe6626a3e05de88be3207d4524311c62a6a2b5647f9359a620ed22f11 3134096945a4cea5132ea9d0ad9b1a6925da40d2d4e86c8f8c8f4d3795b962ca 35f44b47ad1e072f2030291462cedd654234eb0575883ae8f8d5978c051d78e1 35fcd428c89e9586460cb2701ca4cb378824a32d497366a96fa234caf54d8048 3c8477fdcd2719855d6b38cf29849d36dca6bf90805f996286bf77fff7ba1fa3 3eb5cdb190ee1efbea012512c3ed6afd6215473bf208a1853f37701a3f7ba13a 3f53b25ccced470ef2b1eb2edb4b839099a0ca597f4dbcc3aa590b260d727ab0
*See JSON for more IOCs

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security N/A
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella N/A
WSA N/A

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Dropper.Remcos-9960040-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 21 samples
Registry Keys Occurrences
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: LanguageList
7
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
Value Name: FaviconPath
2
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
Value Name: Deleted
2
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES
Value Name: DefaultScope
2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} 2
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVED EXTENSIONS
Value Name: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
2
<HKCU>\SOFTWARE\REMCOS-SFLVDU
Value Name: licence
1
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: @C:\Windows\system32\DeviceCenter.dll,-2000
1
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: @explorer.exe,-7001
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: mea
1
<HKCU>\SOFTWARE\REMCOS-SFLVDU 1
<HKCU>\SOFTWARE\REMCOS-SFLVDU
Value Name: exepath
1
<HKCU>\SOFTWARE\REMCOS-1MSE40 1
<HKCU>\SOFTWARE\REMCOS-1MSE40
Value Name: exepath
1
<HKCU>\SOFTWARE\REMCOS-1MSE40
Value Name: licence
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: Un9
1
<HKCU>\SOFTWARE\REMCOS-A21G8J 1
<HKCU>\SOFTWARE\REMCOS-A21G8J
Value Name: exepath
1
<HKCU>\SOFTWARE\REMCOS-A21G8J
Value Name: licence
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: re
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: dr
1
Mutexes Occurrences
Remcos_Mutex_Inj 3
Local\55C37268-60E9-964A-3299-E2046F3CC613 2
Remcos-SFLVDU 1
Remcos-1MSE40 1
Remcos-A21G8J 1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
13[.]225[.]214[.]71 4
13[.]225[.]214[.]108 4
37[.]19[.]193[.]217 3
95[.]211[.]75[.]16 2
162[.]210[.]195[.]111 1
13[.]225[.]214[.]91 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
piloresi[.]top 7
dioneras[.]top 7
downloadmirror[.]intel[.]com 5
uniresio[.]top 4
emperimen[.]com 3
www[.]bing[.]com 2
busyboydesign[.]xyz 2
toptoptop2[.]site 1
toptoptop3[.]site 1
toptoptop3[.]online 1
toptoptop2[.]online 1
lutheatre[.]com 1
fallium[.]com 1
sheaffic[.]com 1
Files and or directories created Occurrences
%SystemRoot%\win.ini 21
%LOCALAPPDATA%\Administrator 8
%HOMEPATH%\kmm 1
%HOMEPATH%\kmm\Cam.exe 1
%HOMEPATH%\kmm\Cam.vbs 1
%HOMEPATH%\Dul\Slu6.exe 1
%HOMEPATH%\Dul\Slu6.vbs 1
%HOMEPATH%\Dul 1
%HOMEPATH%\Uds 1
%HOMEPATH%\Uds\sov.exe 1
%HOMEPATH%\Uds\sov.vbs 1
%HOMEPATH%\Sv9 1
%HOMEPATH%\Sv9\BUT.exe 1
%HOMEPATH%\Sv9\BUT.vbs 1
%HOMEPATH%\ref 1
%HOMEPATH%\ref\Bar.exe 1
%HOMEPATH%\ref\Bar.vbs 1
%HOMEPATH%\ma\No.exe 1
%HOMEPATH%\ma\No.vbs 1
%HOMEPATH%\ma 1
%HOMEPATH%\Oxy\Bru4.exe 1
%HOMEPATH%\Oxy\Bru4.vbs 1
%HOMEPATH%\tr\TEL.exe 1
%HOMEPATH%\tr\TEL.vbs 1
%HOMEPATH%\Oxy 1
*See JSON for more IOCs

File Hashes

1990701e4db9f573be94dbfd0e9edcb826c4a0ba858b42249812acb12cea572f 201ecff5a0b06b1401158972176bf3af310e1a25a9f603ea902b340f15262130 667fcc41313580c1c5dd3f74e84f13a4431a8b1daf4e1c60d5f3ab0c657e95ef 6754bcad108371e4192bc126187cf7ac07c39ea3f5ed7d975402a4c20d7fbcd4 68183c5baad715853bf2a38a2384288803a431ef4881be8c33b473f7e97d0186 6f70b508bcf39a1de4371f080c51bbf569ff5be7bf0f91793519c3c511710386 72d305998919d0c14d44659c0427e1130b9cf6539f386d328879c7d416ac085a 7cbbe9909fc023294a209ecf1b3882a02cb198d6841a129471201ce105c10d7f 905d2ba08aa3c839dfb815a373c5e2d0ae71badcbb1a70be1ef2683381dcb257 96eba5d5846bbcb803ffbac64ea5adf52fcb736ebda11abd466d509314dcc216 c2bfc250e5a0f8047d8eeb2bab36669e2d20becf57ddfa1e0ff5c33ff63864d5 cad62477913555b37902a162c9b437af27182fb219aa14647f257a0c48ddd556 d2a181619dc5bce7506d65bd893b411772de00c9ffdcbbcb9e3a78ab029a4997 d6e619e7f6f7578cef21ad4bea1ed94f397c0063aee69df329bc0aab3ea0b177 d9f6c0ffc135785c9c0355bad4cc4b8884f6f655c6e336c14b1b7a27568ddda9 dcd1f707b263fe1c37b94944b8399d92675d215d76aca304f0c7455250627d68 e9877a7c8d2daca6b15131b26a583695e4d5e2c05023b764f24a551666055b0a f22c91af53fd11dae4ebeeca1886c5a3355f68970cb554be7eb10affbb547341 f57f13ef3d153621588b9aa9a273e08a77069dd2b9b7d5ad08c579f24feedc41 f7ac5679a471bbc48cb5af2fd54ea2e4621f7e825c06fba59a1690fa6745e56f fd4de71e56062003053b8f93f6bb84188666361a07c415e56a4b015802237289

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security This has coverage
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella This has coverage
WSA This has coverage

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Dropper.Shiz-9958984-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 88 samples
Registry Keys Occurrences
<HKLM>\SOFTWARE\MICROSOFT
Value Name: 67497551a
33
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: 98b68e3c
33
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: userinit
33
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: System
33
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: load
33
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: run
33
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: userinit
33
Mutexes Occurrences
Global\674972E3a 33
Global\MicrosoftSysenterGate7 33
internal_wutex_0x000000e0 33
internal_wutex_0x0000038c 33
internal_wutex_0x00000448 33
internal_wutex_0x<random, matching [0-9a-f]{8}> 29
internal_wutex_0x000007d0 12
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
13[.]107[.]21[.]200 16
45[.]33[.]23[.]183 9
96[.]126[.]123[.]244 8
198[.]58[.]118[.]167 7
45[.]56[.]79[.]23 6
45[.]33[.]30[.]197 6
45[.]79[.]19[.]196 5
173[.]255[.]194[.]134 5
72[.]14[.]178[.]174 5
72[.]14[.]185[.]43 4
45[.]33[.]2[.]79 3
45[.]33[.]18[.]44 3
45[.]33[.]20[.]235 2
85[.]94[.]194[.]169 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
fodakyhijyv[.]eu 33
qekusagigyz[.]eu 33
maxyjofytyt[.]eu 33
xudylenyrob[.]eu 33
pufepepazyd[.]eu 33
vopibycywow[.]eu 33
fotoxysupyd[.]eu 33
gaqehysohec[.]eu 33
lyxaxududes[.]eu 33
rycovuvutiq[.]eu 33
kevimudyqec[.]eu 33
jewidonevin[.]eu 33
tulekuvigij[.]eu 33
vocupotusyz[.]eu 33
galavozaxog[.]eu 33
divufozutog[.]eu 33
kefidaxupif[.]eu 33
jejykaxymob[.]eu 33
xutevexecif[.]eu 33
puryxepenek[.]eu 33
lysowaxojib[.]eu 33
dimigesupew[.]eu 33
fobatesohek[.]eu 33
ryhadyvigis[.]eu 33
qekikyvutic[.]eu 33
*See JSON for more IOCs
Files and or directories created Occurrences
%TEMP%\<random, matching [A-F0-9]{1,4}>.tmp 33

File Hashes

0426a2801b985679944d7956d57df0c195e4871cb5fa9ae5d3cb864600883613 06748264e401a4fcf30a802df0f390a75a14a3ff6148b8f064ee3e2585c742d9 09bf6eb80568c5d370d52e77ca1eddea41f0eb7e458549c994620b3e6af3967c 0affbf8c7691eaaab70491418b6db92cced36ff4a0a482673a4ebdd5492ad6c8 0fbe21b7ff8392a707d0d871494c2298e88e723ebcd7a4495c6a037232d4899b 11b3839df1c31d6c2f15591a0fa013c8b41862dd522d106c85876b49e7d561c0 11b6cfd9b8f56c8107511151282335f7b5f5d555665bec7506908515dcb6acab 11c19ec5a341f6a6bfa86170ea383439466f008ff42ec6dc04bd0445a658ba63 1641e6a92c47304c11521b9c875029a387e49b511438b3ac4c122ee7b14519de 1cac14ca2ad5715132446d1bb0503a6f783577d15f8fb97611dac9b7177903cc 1f4e2901cf95c9ca682d9e5c24235c11da57a47153969203e58b5528bd37b411 1f83440aab9dc62a6c4726b35ee58355b1cf76d23d194250397069423b17d281 237bf6bd91b6301dd01456859507771ed5fc2eda62f67e207bea6928f69573b9 253dc24fa6384c2c2757acc74ecfb88a231ab434c718e5b044a47e3fec4515f7 25525b728590f243275c528727c4887c3521fc16c25f60e3b364fb21e8b64dab 2553d02ff7f59fc5e0830783a508b4a5e8daff585bb4e5411c49bb34217f1b3d 259d0e1eb7a6ab82cfef210054b7cedd069d331455d6c0effff450c514fef6b1 2796098904f867adffd735f528461e5fb8be9f33ebd22bc37fb58684c3476112 27de5dc0ae67097bc22a0bcb3381dcebc372c469c4b8effe2b83d87f85f01cc1 2a6f60367dc3d70d2db9926e28dba4d79f20e319ceaf839c094cf85c9850c99a 2c729b76866357b2fae9d51f4d5f69c1554b18b5be35f896300631b7409e49e7 319155806bbb3e74cc753ed768a13455965e1fa7a175155f5862c2e030c2e35a 34b2879998dfd238977cf19e5f4e3d4cbccfa61a9b0688e43a569e19a75a2844 3578be24b2fe30600747846c30c1e286622e1906fce1a801e10b87117bf37ef4 385ddefdb0c298b4cd194b165f82e9ddec8c8e6616160e432125e576dae5603c
*See JSON for more IOCs

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security This has coverage
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella This has coverage
WSA This has coverage

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Dropper.HawkEye-9959777-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 15 samples
Registry Keys Occurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
Value Name: Hidden
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Windows Update
10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: Shell
5
<HKCU>\SOFTWARE\[email protected] 3
<HKCU>\SOFTWARE\ROMO.PARTN[email protected]
Value Name: NewIdentification
3
<HKCU>\SOFTWARE\[email protected]
Value Name: NewGroup
3
<HKCU>\SOFTWARE\[email protected]
Value Name: FirstExecution
3
Mutexes Occurrences
<random, matching '[A-Z0-9]{14}'> 4
X43238C48CI4NY_SAIR 1
M21V21V8G7Q66R_SAIR 1
05V015TT37XDUJ_SAIR 1
Global\07657600-129e-11ed-9660-0015174b6151 1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
104[.]16[.]155[.]36 6
104[.]16[.]154[.]36 5
77[.]88[.]21[.]158 2
142[.]251[.]16[.]109 2
208[.]91[.]199[.]224 1
208[.]91[.]198[.]143 1
208[.]91[.]199[.]223 1
192[.]99[.]212[.]64 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
whatismyipaddress[.]com 11
kalashas[.]no-ip[.]biz 3
smtp[.]gmail[.]com 2
smtp[.]yandex[.]ru 2
mail[.]siliconsss[.]com 2
smtp[.]impexservicesindia[.]com 2
smtp[.]vsnl[.]net 1
smtp[.]thanawalagroup[.]net 1
Files and or directories created Occurrences
%APPDATA%\pid.txt 11
%APPDATA%\pidloc.txt 11
%TEMP%\holdermail.txt 10
%APPDATA%\WindowsUpdate.exe 10
\Sys.exe 3
\autorun.inf 3
E:\autorun.inf 3
%TEMP%\Administrator7 3
%TEMP%\Administrator8 3
%TEMP%\Administrator2.txt 3
\directory 3
\directory\CyberGate 3
\directory\CyberGate\install 3
\directory\CyberGate\install\server.exe 3
%APPDATA%\Administratorlog.dat 3
%TEMP%\SysInfo.txt 3
%APPDATA%\Windows Update.exe 3
E:\Sys.exe 3
%System32%\drivers\etc\hosts 1
%TEMP%\oUK6NMZIZls5Ku6i.exe 1
%APPDATA%\6tOsSNNvNp7JOgxS 1
%APPDATA%\g3h44Njnele2nJzi 1
%APPDATA%\g3h44Njnele2nJzi\ZOqlaWVQEXMz.exe 1
%APPDATA%\6tOsSNNvNp7JOgxS\ChSV1JzLaHOS.exe 1
%APPDATA%\hAtRUbl2c5ywfar3 1
*See JSON for more IOCs

File Hashes

04e516d05c22e5489ba47b5e1bd03f6cb8bcf2b084e2b3dae23acbe25d4b4591 21e52c431fce5ea651800127be440f447fafd20c3d74f34b0d712e140b0c138d 21e949c72bc90a7b4647b305dd306e343f732ad2b898dba5e9b920edc33fc9a0 220c6f3ffe28c8c7cd3f3b669b47bccdde30b200ab1de9bd0cca55c475ad62cb 2f656303daecf2322749ed2a4b69b7124433dfea94d658c9e1e18d415db16456 32a841f8eaf7fa85d3c78469a9890988c1c9b90c97cfba674ac8f9f991bd3a94 4000b5bce992bdbdd73174fbe1e8d9b0fd65ad6c88f282889a8604dfa9fe0f59 5291c5d0bd7eaee2402fb660be1b8501c3a712471e9d66062b6728794909263a 5393c5a558225a02a03ee8ea46968d53a72b57194261e17dc7e35f0bd9b630ea 628eb845ab8309303d0ebb7448063dbafd36954a66596977a272d5806cacaeca 656d25151b846944e11c7ba03ce4fae066f7a8c29cdce84d0b241d4305a4245c 6d155125192252b756c6af33bca25810ab9a19be347e5793b534802662eb00a4 9a8797b6c2753e70ce0888185473510f40d3c0ff45b81b639dc8c077cb3679ec ad52ce9456cb87f713ad43de89835e0c882fd3a77389bb41ab50396efd59088a c4bf7dbe799d71e8e16c1aa5ca3f3af04f174b91e1a357a02e38b0155a46a600

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security This has coverage
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella This has coverage
WSA This has coverage

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Worm.Kuluoz-9959792-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 26 samples
Registry Keys Occurrences
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'> 26
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: uecguckk
1
<HKCU>\SOFTWARE\AEAKVJGE
Value Name: ujaduqcw
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: cuhmadmx
1
<HKCU>\SOFTWARE\UDVFKDFC
Value Name: vdqcxwxs
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: lhelwsfg
1
<HKCU>\SOFTWARE\SFLQPFKG
Value Name: pvgxfqel
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: wrbmmivh
1
<HKCU>\SOFTWARE\SMXPKGUG
Value Name: cdjmiong
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: agokwqgv
1
<HKCU>\SOFTWARE\NGWWUMBN
Value Name: fpesjwgk
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: bomrkrmk
1
<HKCU>\SOFTWARE\LSCPUEQM
Value Name: lsekxadg
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: bxvvsgvr
1
<HKCU>\SOFTWARE\HIDBXWKK
Value Name: wudcreed
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: snwmmmvf
1
<HKCU>\SOFTWARE\TCUDAEVA
Value Name: dfvkflcs
1
<HKCU>\SOFTWARE\MNQGHNOP
Value Name: dlirvvqw
1
<HKCU>\SOFTWARE\MNFTGNBG
Value Name: csfqppjx
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: imcfhgpa
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: oqpeifcm
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: lhxptbjv
1
<HKCU>\SOFTWARE\HQMHIWJP
Value Name: durqeakc
1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: hsrhcrvj
1
<HKCU>\SOFTWARE\CGOEUIAE
Value Name: htpvdufk
1
Mutexes Occurrences
2GVWNQJz1 26
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
173[.]203[.]97[.]13 15
76[.]74[.]184[.]127 13
37[.]59[.]82[.]218 13
94[.]32[.]67[.]214 13
212[.]45[.]17[.]15 13
142[.]4[.]60[.]242 13
50[.]57[.]139[.]41 12
82[.]150[.]199[.]140 12
92[.]240[.]232[.]232 10
113[.]53[.]247[.]147 10
203[.]157[.]142[.]2 9
176[.]31[.]181[.]76 9
188[.]165[.]192[.]116 7
Files and or directories created Occurrences
%LOCALAPPDATA%\<random, matching '[a-z]{8}'>.exe 26

File Hashes

01d6c50b70eb28d693e74b7ad15158707b8f57a9711e35c07d3d1c4ee7f630ee 08c25287e368a2158b029684e74626ba867a606837cce07ea2837b6ed78857a4 09bb26d956e0eb8aba714e836c041d844ac01eb4ccb3e498382c07ae3e267ff4 0bf1e31c2a0fe232876deef8bad8cbe1e08a3ad377db920ffc27c4852ef1dc89 0c6ec5510575da4416321eb58b20d3e447746e0cea1ffd06241f8a1e6bbb2837 0dd0361ead8f0e962be7a115dd8a4fa9d1a12b88c11633f82cfeae655a59f809 0fb3d456de4717b29c3a332e29a10cc9c52c94c92f6438f32791f5a5785b603b 1052ac160c67084f7dae6af5d9ee545fb0df20b99b8e989177ffb795a32aa35c 192d087160aad1afdb5ed06eb4128d997e578af554a626887746d91e66bc688a 1f4a448e60174255ef3d7492e60464ef4cfd84f65acb8c9824493b71d6864b8f 1f7810a638c2f1825276f2784cf557d7610ca0eabb463d06e6b25597fd077043 230a54a47fed1921adb452b5e88f1467e021dd85aac8f0d60a5a41912b991d28 26cad8fc0603c849db06f59e46b452bb4c3fe5cadfd46e344ce9a7f10365ddb8 276bb12ea62aa7f7ffce0531b84bbe1f7f2e6a19f4150ca6a7b1c69f4662b595 286bc1cee4c188350c8bb50812e30f7bec0b794efca5a2eb0b12368b479211b3 2938109eee69fe708fa15752e0723d110a01ee4e3e1e804cc97bbde01267fdb8 2a850531aeb725e5f138b9b1158640fe41c05a25560e2550fa2b070d96490a8e 31266599481409d70b317821d5af1aea693e7c1c7cedd04fd5dec0008bd816a7 384b51772d288e63038e146446e6e84b1f737cd3d8d34c3871d875fda77ff29a 38e1edffa779f9e2dd16104c35fc7a6c4a21dff7f3ad9bc8233b5817e8666441 3949d166ce5f75648fcb66ea3f9aaf251aa9847d576aef7d10b2830a295e2096 3ffee22fa7f00e260b92385c8cda56eee17c133b7c47cb33cf701d0c9e2ae89e 419c33660b59de42d150f8c1163873db94fa59e8d684bb44d0ec866eaebd00a7 441c34ba7b9ee2d7b0506013a2fb9fd5c5b517d38a66e1228edf4d7e1e20b9e8 446d8276a7008c24317b101c5d7050da5f1a51301a47842cd35f5d8a362eee83
*See JSON for more IOCs

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security N/A
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella N/A
WSA N/A

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Dropper.DarkComet-9959797-1

Indicators of Compromise

  • IOCs collected from dynamic analysis of 11 samples
Registry Keys Occurrences
<HKCU>\SOFTWARE\DC3_FEXEC 11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLUA
11
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: AntiVirusDisableNotify
11
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: UserInit
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: MicroUpdate
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM 11
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: LanguageList
11
Mutexes Occurrences
DCPERSFWBP 11
DC_MUTEX-01SYFCM 11
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
zapto666[.]zapto[.]org 11
sildelanoe2[.]zapto[.]org 11
Files and or directories created Occurrences
%ProgramData%\Microsoft\Windows\Start Menu\Programs\MSDCSC 11
%ProgramData%\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe 11

File Hashes

236c360d988e5b28b1a4eee229d0f3b5baa203043fc5ae8f016519f753e6b6bf 27990599b2e3ae192d5a897ed30cb98a20eae1d3ed8506dac8d82fef9ed9442e 53cd48d7d092d55fdc35966cfbd01861bf7304f9dc694237d322ff189adb32a4 55754ae53d9555a67d25be9cd73b5d85141d4ef43cd55ae2cf237be1cfa0d965 5dcd64134e33496cdd5ad13012b35834164d59d470a17359710a335469fdf35a 6e0d5bd7c55c9ec287377f8cadd342768c887a8901d015253996112442ff5d6f a53ebd4f480bdf3cf2199692af1d27c2864fc5c038fefed214688416cc2a1066 acaf2d6a74e24b2ab85338fa62efc85d76f6ec9c1cd11657230d975fd0dcde42 c4c677ab5115a0a568d1817528005ad24d0dc06ddd9d738d5f1fb75a3074b3f0 d2e83abd3d779b825e4088f53b43aa8521131a9ebd0dad8006e70fcc0e249e8d eea1adee202040b2c06dfb226eacd4c662b57714f44ffcc0561ff8cb2ec2a6d6

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security N/A
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella N/A
WSA N/A

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





Win.Dropper.Ramnit-9960101-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 15 samples
Registry Keys Occurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLUA
15
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT
Value Name: AlternateShell
15
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: Userinit
15
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: WlkSgauv
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: Type
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: ErrorControl
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: ImagePath
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: DisplayName
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: WOW64
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: DeleteFlag
15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE 15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MICORSOFT WINDOWS SERVICE
Value Name: Start
15
Mutexes Occurrences
{79345B6A-421F-2958-EA08-07396ADB9E27} 15
{7934684F-421F-2958-EA08-07396ADB9E27} 15
{7934723B-421F-2958-EA08-07396ADB9E27} 15
{7934684E-421F-2958-EA08-07396ADB9E27} 15
{<random GUID>} 15
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
82[.]112[.]184[.]197 15
72[.]26[.]218[.]70 15
195[.]201[.]179[.]207 15
208[.]100[.]26[.]245 15
35[.]205[.]61[.]67 15
142[.]250[.]80[.]14 15
75[.]2[.]18[.]233 15
172[.]105[.]157[.]192 15
46[.]165[.]220[.]150 15
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
kbadlfpgtec[.]com 15
ymcwineqkj[.]com 15
tupexbvpmsc[.]com 15
mwsjitqbf[.]com 15
ccsnpnqxii[.]com 15
dpdadshi[.]com 15
eljmrnwualb[.]com 15
hjxrksvo[.]com 15
lfnjosunfd[.]com 15
paoxlrmbg[.]com 15
qekgxfrk[.]com 15
uhjwxipj[.]com 15
mkmngqxwk[.]com 15
ybmhumhymqj[.]com 15
qopdypfxhda[.]com 15
pfkilgedjhq[.]com 15
sgimiytkanu[.]com 15
leqnxekmi[.]com 15
ieugluxmlx[.]com 15
elieidkolpc[.]com 15
oluddrbaeb[.]com 15
skroackqs[.]com 15
pbfttfgw[.]com 15
ujypninrop[.]com 15
qpvvabbaqcn[.]com 15
*See JSON for more IOCs
Files and or directories created Occurrences
%LOCALAPPDATA%\wblmbpwi.log 15
%LOCALAPPDATA%\xrpatmbf.log 15
%LOCALAPPDATA%\ntqipnfr 15
%LOCALAPPDATA%\ntqipnfr\wlksgauv.exe 15
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wlksgauv.exe 15
%TEMP%\dljcankv.sys 15
%TEMP%\oqinictcdtumygeo.exe 15
%LOCALAPPDATA%\ntqipnfr\px1F71.tmp 1
%LOCALAPPDATA%\ntqipnfr\px26AF.tmp 1
%LOCALAPPDATA%\ntqipnfr\px203A.tmp 1
%LOCALAPPDATA%\ntqipnfr\px1CC1.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2B70.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2BFD.tmp 1
%LOCALAPPDATA%\ntqipnfr\px1EB4.tmp 1
%LOCALAPPDATA%\ntqipnfr\px1B98.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2365.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2307.tmp 1
%LOCALAPPDATA%\ntqipnfr\px28A3.tmp 1
%LOCALAPPDATA%\ntqipnfr\px25C5.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2DD1.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2BED.tmp 1
%LOCALAPPDATA%\ntqipnfr\px2529.tmp 1

File Hashes

10df6ef7114ab16c25690d0183960e51d80488690e4f52680be2cf38d4aeb85b 1b39ecf9dc61b7e01c410b02eb8cb5c01ccdb1346474c62d7b916a9fb136681e 25354347217865d4e0a18080a942021de378cdcdff3633edc32583d892639569 265febc90d4163d2d1f29c0f07c8b003002ec7ee9ca4a3f8607ca5364cf06dc3 370c3bdde1b51bf0b9d079e644871b79848ac588c37ea7f89c94a2e2c3103642 3b955ab71c4147497bb1aa0fd65ee9b94bb1cbc897a0be46427f0f66a829de5d 55835f514e7ab6da28a6c69a3ffbe2d356b8ca987a274bc7a190689a57cbfbf2 615c3bfaa531cda8c1ac55bf9d5d93598617cd208702a7ce4c26cd94b2f2d4fd 61657d27b739df7dd856194cc29354ebf9d4a9abe3cb37d8782b5e6bddcba23c 7227840a73bce222d285d89cb1f528a5f5caf230af943a78f85f5e07136f1c4f 91cec64e347f7355c3dabb30b6e70c73d8a16890aa698ef526476930b998dd78 b70d31148f0b79548b7a2fd3a16228b32b0c52432b19b9d651fc9d6f9458c845 b7841d3db93f9a48887fdb82d3492b43f33f36ee8959e4f26a74c77962793e65 e80bad25222ffce33d1fa8c5962b235fecdce744b6dcf9c35db869844802573c ee4d65ec638095b28ec9c1290bf3edac8c767fb2a094c00925fabcde83dfb205

Coverage

Product Protection
Secure Endpoint This has coverage
Cloudlock N/A
CWS This has coverage
Email Security This has coverage
Network Security This has coverage
Stealthwatch N/A
Stealthwatch Cloud N/A
Secure Malware Analytics This has coverage
Umbrella This has coverage
WSA This has coverage

Screenshots of Detection

Secure Endpoint



Secure Malware Analytics



MITRE ATT&CK





✇Include Security Research Blog

Reverse Engineering Windows Printer Drivers (Part 1)

By: Ayaz Mammadov & Nick Fox

Note: This is Part 1 in a series of posts discussing security analysis of printer drivers extracted and installed from public resources. This part explains how we located publicly available drivers distributed by WeWork and conducted initial analysis. Part 2 come shortly after and will cover our exploration with in-depth technical details about how Windows kernel drivers work and the techniques we used to discover bugs in these drivers.

Almost every large organization uses printers, and while the printer market is fairly distributed, it is still heavily dominated by only a few players. Printers need kernel mode drivers to work so that they can communicate through USB and other means, though this is not always the case as modern operating systems are pivoting to user-mode drivers to ensure safety. A vulnerability in a kernel mode printer driver could result in Local Privilege Escalation (LPE) if exploited successfully.

In this two-part series, we’ll discuss the steps we took to analyze these drivers. We’ll also discuss some helpful background information for beginning analysis of Windows kernel-mode drivers.

Step 1. Find Driver Documentation or Public Resources

Since most of the public uses a search engine to find drivers, we will emulate the way a WeWork user would find print drivers so that we can also discuss the implications of using unofficial sources to find installers. The first step we took was to search for documentation and driver downloads in the same way as a user. The drivers found will be used in our analysis. 

What printers does WeWork use?

A quick online search provides these links: 


According to the setup documents, WeWork uses HP, Kyocera and Konica printers. Though this instructional manual seems to be from a non-official source, an attempt to run these installers will be unsuccessful as they expect to be connected to a printer. A search through WeWork’s publicly available documentation shows that for Russian and Chinese WeWork spaces, only the WeWork_HP_installer.exe is documented. It seems that either the other printers are much rarer, or WeWork does not publish documentation publicly.

Step 2. Unpacking Resources

Unpacking Windows Resources

With a bit of web crawling for “WeWork_Installer_HP.exe”, the HP installer executable can be found at https://s3.amazonaws.com/it-assets/printing/wework_installer_HP.exe.

Since this executable contains no digital signature, its origin from WeWork cannot be verified. VirusTotal shows that it is not flagged by any antivirus engines, but they advise to continue on a virtual machine (VM).

The installer does not display a prompt to select where files are stored similar to most common software installers, but we used ProcMon to identify where files are placed on the local machine. Typically, you would first check C:\Program Files or C:\Program Files (x86) for changes. In this analysis, a folder named WeWork_printer_drivers was found in C:\Program Files (x86), which contained two executable files: HP_UPD.exe and win_39754.exe. The files have the following icons displayed in Windows Explorer:

These executables are self-extracting 7-Zip executables and can be opened with the 7-Zip application.

Opening win_39754.exe shows some references to a printer client software known as Papercut, but this does not contain any driver.

Opening HP_UPD.exe (which presumably stands for HP Universal Printer Driver), points to a file directory that contains .inf files for these printers and their properties. See the following documentation for more information on .inf files:

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/overview-of-inf-files


Exploring the files further, there are directories with the name drivers, with each directory containing a subdirectory named either WINXP, WIN2000, AMD64. These directories contain drivers. Out of the directory names, AMD64 is the one most modern architecture for modern day windows operating systems.

Extracting the drivers in this folder, there are 5 drivers:

  • HPZid412.sys
  • HPZisc12.sys
  • HPZipr12.sys
  • HPZius12.sys
  • HPZs2k12.sys

These files all have additional information about them in their properties. Their properties can be viewed by right-clicking on them and selecting Properties->Details, where their descriptions and their original file names are shown.

They seem to be used for implementing the DOT4 (IEEE 1284.4) multiplexing data channel protocol over USB. In fact, the original filenames are references to Microsoft default DOT4 protocol drivers, and the strings of the original Dot4 Microsoft drivers are extremely similar to the HP drivers, almost exact. For more confirmation, BinDiff could be used to check the similarity of the two binaries. 

Unpacking MacOS resources

After an attempt to find the package described in the public facing documents, we settled with the file in the MacOSPrinterSetup instructions, which provides a DMG file.

Opening the DMG file in 7-Zip presents the following directory structure:

Immediately, the most interesting place to find drivers would be the .pkg file that contains the packages which contain binaries. Opening in 7-Zip provides folders:

From the above list of files, the most relevant to kernel drivers would be a KEXT (Kernel Extension), and it seems there is only one relevant package with kext in its name: com.hp.print.ps.kext.pkg. Opening it in 7-Zip results in the files below:

The directory contains these files, the most important of which is the Payload file which contains the actual binaries. We can open this file in 7-Zip and it contains numerous empty path folders which just hold other folders. KEXTs are folders that contain plists (files that describe the KEXT) and the MACH-O binaries. The path to the KEXT in the Payload file is shown below:

Payload\System\Library\Extensions\hp_io_printerclassdriver_enabler.kext\Contents

This is the path inside the payload to the KEXT contents folder. It provides the directory structure below:

CodeSignature is a directory of signatures for verifying the file. The Info.plist file describes the properties of the KEXT and Version.plist contains version numbers, but where is the binary?

As it turns out, this KEXT is a Codeless Kernel Extension, which can be verified by looking in the Info.plist file containing properties in an XML format. Specifically, KEXTs with binaries contain the CFBundleExecutable property. Inspecting the Info.plist of this KEXT, we find no CFBundleExecutable property.

The purpose of this KEXT is to point the operating system to the subsystems which this hardware device (the printer) uses, and direct it to the NON-KERNEL driver responsible for handling the hardware (IOKit). The XML keys responsible for telling us which pkg is responsible for handling this printer is the USB Printing Class

<key>IOProviderClass</key>
    <string>IOUSBInterface</string>
<key>IOProviderMergeProperties</key>
    <dict>
        <key>ClassicMustNotSeize</key>
            <true/>
        <key>USB Printing Class</key>
            <string>/Library/Printers/hp/Frameworks/HPDeviceModel.framework/Runtime/HPIOPrinterClassDriver.plugin</string>

In the string above, we see a path to a user mode plugin. A word in this path provides a clue into which package contains this plugin. HPDeviceModel, the process used to inspect this plugin, can also be used for the IOKit user mode driver (com.hp.DeviceModel4.pkg / HPIOPrinterClassDriver.plugin). 

Note: Unpacking these macOS driver packages confirms that these drivers are user-mode drivers and not kernel-mode drivers. We did not pursue further analysis on the macOS drivers as the value from attacking them is far less than kernel-mode drivers.

Step 3. Confirmation 

Note: For this step, we will use Windows as it is the only one with Kernel Drivers.

With our research, we now know that the HP drivers are the Dot4 default drivers. This theory can be tested by connecting a printer that supports Dot4 to your computer via USB,and then using a tool like WinObjEx64, which can inspect loaded drivers. 

Browsing the loaded drivers shows:

From the image above, you can confirm that three drivers are loaded: dot4, Dot4Print and dot4usb. The loaded drivers indicate that the operating system is ready to interact with the printer. Despite the fact that there were 5 drivers, it seems (from analysis) that only three drivers are loaded on modern systems. The three files unpacked are: 

  • dot4.sys -> HPZid412.sys
  • dot4prt.sys -> HPZipr12.sys
  • dot4usb.sys -> HPZius12.sys

The binaries for these default dot4 drivers can be found at C:\Windows\System32\Drivers once they have been loaded for the first time.

Devices listed on the system are show in the image below:

While drivers show that the operating system is ready to interact with the printer, it is ultimately up to a user-mode application to initiate a printing sequence. The application can initiate a printing sequence if the drivers present an interactable device to the user-mode application. In the image above, a dot4 device that allows for interaction between user-mode and the driver exists on the system.

Step 4. Architecture and Research

The Windows operating system is massive. It hosts a variety of subsystems, so we focused our research on Windows during analysis. For this research, the goal was to study the different types of drivers and how they affect security. 

Types of Windows Drivers

It’s important to understand that there are several types of Windows drivers and frameworks: 

WDM – The first type of drivers that were created were WDM (Windows Driver Models). This driver is a raw driver and manages resources and devices. When it came to device drivers this seemed to be almost an impossible task due to the endless amount of state that had to be managed, this issue is discussed in depth in old Microsoft archives that can be found here.

https://channel9.msdn.com/Shows/Going+Deep/Doron-Holan-Kernel-Mode-Driver-Framework?term=kernel&lang-en=true

KMDF – The Kernel Mode Driver Framework (KMDF) was invented to relieve some of the difficulties developing device drivers, giving developers APIs that would handle edge cases. It implements state machines for PnP, I/O, and others.

UMDF – The User Mode Driver Framework (UMDF) is the user-mode equivalent of KMDF.

WDF – The Windows Driver Framework (WDF) is a term that encompasses KMDF and UMDF.

Conclusion

For this first post in our WeWork printer analysis series, we found resources online and unpacked them. The analysis covered in this post is the initial step in identifying WeWork printer drivers so that we can research further into their security. In the next post, we will look into reverse engineering and attempting to discover exploitable bugs in these drivers. 

The post Reverse Engineering Windows Printer Drivers (Part 1) appeared first on Include Security Research Blog.

✇NVISO Labs

Finding hooks with windbg

By: Oliver Bachtik

In this blogpost we are going to look into hooks, how to find them, and how to restore the original functions.

I’ve developed the methods discussed here by myself and they have been proven to be useful for me. I was assigned to evaluate the security and the inner working of a specific application control solution. I needed a practical and easy solution, without too much coding preferably using windbg. For that I wanted to be able to:

  1. Detect the DLL which performs hooking
  2. Detect all the hooks that it sets up
  3. Restore all the previous instructions (before the hook)

What are hooks?

As hooks is the thing we are looking for let’s briefly talk about what hooks actually are and how they look like.

Specifically we will cover MS Detours.

Basically hooking allows you to execute your own code when the target function is called. It was originally developed to extend the functionality of the functions of closed software. When your code is called by the hooked function it’s up to you what to you want to do next. You can for example inspect the arguments and based on that resume the execution of the original target function if you wish.

To better illustrate how a hook looks like, I’m going to use the picture from the “Detours: Binary Interception of Win32 Functions” document.

MS Detours hook
MS Detours hook

The picture above shows trampoline and target functions, before and after insertion of the detour (left and right).

Of course in order for this to be useful the trampoline function would normally end up calling your custom code, before resuming the target function. For us one important thing to notice is the jump instruction at the beginning of the target function. If it’s there this is a good indicator that a function is hooked.

As we can see, a jump instruction is used to hook a target function and replace the first 4 instructions of the original target function. This results in the target function jumping to a trampoline function and the trampoline function executing the original 4 instructions that were replaced. Then, a jump instruction is used again in the trampoline function to resume the execution of the target function after the jump instruction (TargetFunction+5).

If you’re interested in the official documentation you can find it here and here.

The setup

To better demonstrate the concept, I’ve created a few simple programs.

  • begin.exe – Calls CreateProcess API to start myapp.exe.
  • myapp.exe – Simple program that shows a message box.
  • AChook.dll – Application Control hooking DLL. Simple DLL that forbids any execution of CreateProcessA and CreateProcessW APIs.

Firs let’s show these programs in action. Let’s run begin.exe:

begin.exe starts and shows a dialogue that halts execution.
begin.exe starts and shows a dialogue that halts execution.

It shows a message box asking to inject a DLL. This halts execution until the “OK” button is clicked and allows us to take our time injecting a DLL if we want to.

myapp.exe is started by begin.exe.
myapp.exe is started by begin.exe.

Then it launches myapp.exe, which just shows another message box asking if you want to launch a virus. Of course myapp.exe is not a virus and just exits after showing the message box (no matter if the user clicks on “Yes” or “No”).

Now let’s run begin.exe again but this time let’s inject the AChook.dll into it while the message box is shown.

begin.exe waiting for user interaction.
begin.exe waiting for user interaction.

We use “Process Hacker” to inject AChook.dll.

Using Process hacker to inject our DLL into begin.exe.
Using Process hacker to inject our DLL into begin.exe.

AChook.dll also prints some additional messages to the console output:

AChook.dll is injected into begin.exe.
AChook.dll is injected into begin.exe.

When we click now on the OK button, myapp.exe does not run anymore and thus the virus message box is no longer shown. Instead additional messages are printed to the console by AChook.dll.

AChook.dll's hook prevented execution of myapp.exe.
AChook.dll‘s hook prevented execution of myapp.exe.

IDENTIFYING THE HOOKING DLL

First we need to identify which DLL is the one that sets the hooks.

To list the loaded DLLs of a running process we use “Process Explorer”.

We select the process begin.exe and press [Ctrl]+[D]:

DLLs loaded by begin.exe in Process Explorer.
DLLs loaded by begin.exe in Process Explorer.

Now we can look for any DLL that looks suspicious. In this case it’s easy because the DLL has the phrase “hook” in its name, which is something that certainly stands out!

A different way to identify the hooking DLL is to compare the list of loaded DLLs with and without the security solution active. To simulate this we run begin.exe twice – once with and once without the AChook.dll. To list the DLLs as a text we can use “listdlls”:

Output of listdlls against the begin.exe process.
Output of listdlls against the begin.exe process.

First we need to identify which DLL was injected into a process. We start by running listdlls against the just started begin.exe process and saving the output:

listdlls begin.exe > before

Then we inject AChook.dll using Process Hacker and save listdlls’s output again:

listdlls begin.exe > after

Next, we compare those two output files using “gvim” (of course any other text editor can be used).

Using gvim to compare both outputs.
Using gvim to compare both outputs.

As we can see below, a new DLL AChook.dll was added:

Diff of both lists of loaded DLLs in the begin.exe process.
Diff of both lists of loaded DLLs in the begin.exe process.

Alright. So far we determined that a DLL was injected to the process. At this point we could search the DLL on disk to see to if it belongs to your target security solution. In our case we created it ourselves though, so we’re not going to do that.

The DLL is suspicious because its name contains the phrase “hook”. However we want to gain more confidence that it really hooks anything.

When you are examining a security solution it’s always a good idea to read its documentation. The product that I was analysing had specifically mentioned that it uses MS Detours hooks to function. However, it did not mention anything regarding the application control implemented in kernel space and also did not mention which DLL it used for hooking.

Unfortunately there is no single (special) Windows API that would do the hooking. Instead it uses multiple APIs to do its job. I wanted to find a rare API or a sequence of APIs that I could use as some sort of signature. I found one API that is quite special and rarely used (unless you want to do hooking): “FlushInstructionCache”.

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-flushinstructioncache

As the documentation says:

“Applications should call FlushInstructionCache if they generate or modify code in memory. The CPU cannot detect the change, and may execute the old code it cached.”

So if the MS Detours code wants its new jump instruction to be executed it needs to call FlushInstructionCache API. In summary what MS Detours needs to do when installing the hook is to:

  • Allocate memory for the trampoline function;
  • Change the access of the code of the target function to make it writable;
  • Copy the instructions from the beginning of the target function (the ones that it’s going to replace) to previously allocated space; and make changes there so that the trampoline function ends up executing your code;
  • Replace the beginning of the target function with a jump instruction to trampoline function;
  • Change the access of the code of the target function back to the original access;
  • Flush the instruction cache.

You can find the FlushInstructionCache function in the imports of AChook.dll as can be seen in IDA:

IDA displaying the PE imports of begin.exe.
IDA displaying the PE imports of begin.exe.

Or you can use “dumpbin” to do the same:

Finding the FlushInstructionCache PE import in begin.exe using dumpbin.
Finding the FlushInstructionCache PE import in begin.exe using dumpbin.

At this point we have a very suspicious DLL and we want to determine which APIs it hooks and also restore them.

IDENTIFYING HOOKS AND RESTORING THEM

Since I was experimenting with dynamic binary instrumentation tools before, I knew that it is also possible to detect hooks by using Intel’s Pintools. It requires you to write a small program however. I won’t go into detail here, maybe this is a topic for another blogpost.

But in short Pintools enables you to split the code into blocks, something very similar to what IDA does. It also enables you to determine to which binary or DLL this code block belongs to.

Remember that MS detours installed a jmp instruction at the beginning of the target API which jumped to a newly allocated memory region. So if you see at the beginning of the API that a code block is executed that does not belong to the API’s DLL then this API is hooked. The drawback of this solution is that the hooked API needs to run in order to be detected. It also does not allow you to retrieve the original bytes of the hooked API for restoration.

More information about Pintools can be found here.

Let’s discuss something much simpler and more effective instead. Remember that MS Detours first changes the memory to be writable and then changes it back, let’s use that to our advantage.

We will use windbg for this. What we need to do is to:

  1. Start begin.exe
  2. Attach windbg to the begin.exe process.
  3. Set a breakpoint on loading of AChook.dll (sxe ld AChook.dll)
  4. Continue execution of begin.exe process (g)
  5. Inject AChook.dll into begin.exe process (Process Hacker)
  6. The breakpoint will hit.
  7. Set new breakpoint on VirtualProtect with a custom command to print first 5 instructions and continue execution. (bp KERNELBASE!VirtualProtect “u rcx L5;g” )
  8. Set output log file and continue execution (.logopen C:\BLOGPOST\OUTPUT.log ; g)
  9. The debugger will start hitting and continuing the breakpoints. After the output stops moving click the pause button on the debugger.
  10. Don’t click on the ok button of the message box. Close the log file. Collect and inspect the data in the log file. Remove a few – if any – false positives (.logclose).

The whole process might look like this:

Debugging the begin.exe process in windbg.
Debugging the begin.exe process in windbg.

The output above shows that when the breakpoint of the CreateProcessWStub and CreateProcessAStub are hit for the first time, they are not hooked yet: they don’t contain the jmp instruction at the beginning yet. However, the second time they are hit we can see a jmp instruction at the beginning, thus we can cunclude that they are hooked.

From this output we know that  CreateProcessW and  CreateProcessA were hooked. It also gives us the original bytes so we could restore the original functions if we wanted to.

RESTORING ORIGINAL FUNCTIONS:

Using the above output of windbg, we can restore the original functions with the following windbg commands:

eb KERNEL32!CreateProcessWStub 4c 8b dc 48 83 ec 58
eb KERNEL32!CreateProcessAStub 4c 8b dc 48 83 ec 58

The steps are easier this time:

  1. Run begin.exe
  2. Inject AChook.dll into it (using Process Hacker)
  3. Attach windbg to the begin.exe process
  4. Run the commands mentioned above and continue execution (eb … ; g)
  5. Click on the “OK” button of the message box to launch myapp.exe

And – voilà! – here is the result:

myapp.exe executed by begin.exe after restoring hooked functions.
myapp.exe executed by begin.exe after restoring hooked functions.

CONCLUSION

In this blogpost we have discussed what hooks are, how to identify a DLL that does the hooking, how to identify the hooks that it sets and also how to restore the original functions once the hooking DLL was loaded. Of course a proper security solution uses controls in kernel space to do application control, so it’s not possible for the application to just restore the original functions. Although there could be implementation mistakes in that as well, but that is a story for another time.

I hope you enjoyed.

About the author

Oliver, is a cyber security expert at NVISO. He has almost a decade and a half of IT experience of which half of it is in cyber security. Throughout his career he has obtained many useful skills and also certificates. He’s constantly exploring and looking for more knowledge. You can find Oliver on LinkedIn.

  • There are no more articles
❌