Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le mars 26, 2017, 13:01:00

Titre: [FireEye]FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region
Posté par: igor51 le mars 26, 2017, 13:01:00

FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region

In 2012, a suspected Iranian hacker group called the “Cutting Sword
  of Justice” used malware known as Shamoon – or Disttrack. In
  mid-November, Mandiant, a FireEye company, responded to the first
  Shamoon 2.0 incident against an organization located in the Gulf
  states. Since then, Mandiant has responded to multiple incidents at
  other organizations in the region.

 

Shamoon 2.0 is a reworked and updated version of the malware we saw
  in the 2012 incident. Analysis shows the malware contains embedded
  credentials, which suggests the attackers may have previously
  conducted targeted intrusions to harvest the necessary credentials
  before launching a subsequent attack.

 

  FireEye HX and FireEye NX both detect Shamoon 2.0, and our
    Multi-Vector Virtual Execution (MVX) engine is also able to
    proactively detect this malware.

 

The following is a summary of what we know about Shamoon 2.0 based
  on the samples we’ve analyzed:

 

• The malware scans the C-class subnet of the IP it has assigned
      to every interface on the system for target systems.
• The
      malware then tries to access the ADMIN$, C$\Windows, D$\Windows, and
      E$\Windows shares on the target systems with current
    privileges.
• If current privileges aren’t enough to access the
      aforementioned shares, it uses hard coded, domain specific
      credentials (privileged credentials, likely Domain Administrator or
      local Administrator) gained during an earlier phase of the attack to
      attempt the same.
• Once it has access, it enables the Remote
      Registry service on the target device and sets
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
      to 0 to enable share access.
• Once it has performed the
      earlier actions, it copies ntssrvr32.exe to the %WINDIR%\system32 of
      the target system and schedules an unnamed task (e.g. At1.job) to
      execute the malware.
• The identified malware had a hard
      coded date to launch the wiping. Systems infected with the malware
      scheduled the job to start the process shortly thereafter.

   
• The malware sets the system clock to a random date in August
      2012. Analysis suggests this might be for the purposes of ensuring
      the component (a legitimate driver used maliciously) that wipes the
      Master Boot Record (MBR) and Volume Boot Record (VBR) is within its
      test license validity period.
• While the original Shamoon
      malware attempted to overwrite operating system files with an image
      of a burning U.S. flag, the recently discovered variant attempts to
      overwrite Windows operating system files, although with a different
      image, a .JPG file depicting the death of Alan Kurdi, a Syrian child
      migrant who died while attempting to cross the Mediterranean
    Sea.

 

The following is guidance for detecting the malware, counteracting
  its activity, and attempting to prevent it from propagating in an
  environment. Please note that performing any of these actions could
  have a negative effect and should not be implemented without proper
  review and study of the impact of the environment.

 

• Monitor any events in the SIEM that show dates in August
    2012.
• Monitor for system time change events that set the
      clock back to and from August 2012.
• Monitor for Remote
      Registry service starts.
• Monitor for changes to the
      aforementioned registry key value, if the value is currently
    non-zero.
• Prevent and limit access to the aforementioned
      shares, which could have significant impact based on setup.

   
• Prevent client-to-client communication to slow down the spread
      of the malware, which could also have a significant impact based on
    setup.
• Monitor filesystems for the creation of any of the
      filenames provided in the Indicators of Compromise list at the
      bottom of the post.
• Change the credentials of all
      privileged accounts and ensure local Administrator passwords are
      unique per system.

 

Indicators of Compromise

 

The following is a set of the Indicators of Compromise for the
  identified Shamoon variant. We recommend that critical infrastructure
  organizations and government agencies (especially those in the Gulf
  Cooperation Council region) check immediately for the presence or
  execution of these files within their Windows Server and Workstation
  environments. Additionally, we recommend that all customers continue
  to regularly review and test disaster recovery plans for critical
  systems within their environment.

 

File name: ntssrvr64.exe
 Path: %SYSTEMROOT%\System32

  Compile Time: 2009/02/15 12:32:19
 File size:717,312

 

File name: ntssrvr32.exe
 Path: %SYSTEMROOT%\System32 NA
  NA
 File size: 1,349,632

 

File name: ntssrvr32.bat
 Path: %SYSTEMROOT%\System32 NA

  MD5: 10de241bb7028788a8f278e27a4e335f
 File size: 160

 

File name: gpget.exe
 Path: %SYSTEMROOT%\System32
 PE
  compile time: 2009/02/15 12:30:41
 MD5:
  c843046e54b755ec63ccb09d0a689674
 File Size: 327,680

 

File name: drdisk.sys
 Path:
  %SYSTEMROOT%\System32\Drivers
 Compile time: 2011/12/28
  16:51:29
 MD5: 76c643ab29d497317085e5db8c799960
 File Size: 31,632

 

File name: key8854321.pub
 Path: %SYSTEMROOT%\System32

  MD5: b5d2a4d8ba015f3e89ade820c5840639 782

 

File name: netinit.exe
 Path: %SYSTEMROOT%\System32
 MD5:
  ac4d91e919a3ef210a59acab0dbb9ab5
 File Size: 183,808

  Service Details
 Display name: "Microsoft Network Realtime
  Inspection Service"
 Service name: "NtsSrv"

 

Description: "Helps guard against time change attempts
  targeting known and newly discovered vulnerabilities in network time
  protocols"
 Files created:

 

• %WINDIR%\inf\usbvideo324.pnf

 
• %WINDIR%\system32\netinit.exe

 

Dynamic Analysis Observables

 

RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\NtsSrv\

 

RegistryItem HKLM\SYSTEM\ControlSet001\Services\NtsSrv\

 

RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\wow32\

 

RegistryItem HKLM\SYSTEM\ControlSet001\Services\wow32\

 

RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\drdisk\

 

RegistryItem HKLM\SYSTEM\ControlSet001\Services\drdisk\

 

FileItem C:\Windows\System32\caclsrv.exe

 

FileItem C:\Windows\System32\certutl.exe

 

FileItem C:\Windows\System32\clean.exe

 

FileItem C:\Windows\System32\ctrl.exe

 

FileItem C:\Windows\System32\dfrag.exe

 

FileItem C:\Windows\System32\dnslookup.exe

 

FileItem C:\Windows\System32\dvdquery.exe

 

FileItem C:\Windows\System32\event.exe

 

FileItem C:\Windows\System32\extract.exe

 

FileItem C:\Windows\System32\findfile.exe

 

FileItem C:\Windows\System32\fsutl.exe

 

FileItem C:\Windows\System32\gpget.exe

 

FileItem C:\Windows\System32\iissrv.exe

 

FileItem C:\Windows\System32\ipsecure.exe

 

FileItem C:\Windows\System32\msinit.exe

 

FileItem C:\Windows\System32\netx.exe

 

FileItem C:\Windows\System32\ntdsutl.exe

 

FileItem C:\Windows\System32\ntfrsutil.exe

 

FileItem C:\Windows\System32\ntnw.exe

 

FileItem C:\Windows\System32\power.exe

 

FileItem C:\Windows\System32\rdsadmin.exe

 

FileItem C:\Windows\System32\regsys.exe

 

FileItem C:\Windows\System32\routeman.exe

 

FileItem C:\Windows\System32\rrasrv.exe

 

FileItem C:\Windows\System32\sacses.exe

 

FileItem C:\Windows\System32\sfmsc.exe

 

FileItem C:\Windows\System32\sigver.exe

 

FileItem C:\Windows\System32\smbinit.exe

 

FileItem C:\Windows\System32\wcscript.exe

Source: FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region (http://)