FireEye Responds to Wave of Destructive Cyber Attacks in Gulf RegionIn 2012, a suspected Iranian hacker group called the “Cutting Sword
of Justice” used malware known as Shamoon – or Disttrack. In
mid-November, Mandiant, a FireEye company, responded to the first
Shamoon 2.0 incident against an organization located in the Gulf
states. Since then, Mandiant has responded to multiple incidents at
other organizations in the region.
Shamoon 2.0 is a reworked and updated version of the malware we saw
in the 2012 incident. Analysis shows the malware contains embedded
credentials, which suggests the attackers may have previously
conducted targeted intrusions to harvest the necessary credentials
before launching a subsequent attack.
FireEye HX and FireEye NX both detect Shamoon 2.0, and our
Multi-Vector Virtual Execution (MVX) engine is also able to
proactively detect this malware.
The following is a summary of what we know about Shamoon 2.0 based
on the samples we’ve analyzed:
- The malware scans the C-class subnet of the IP it has assigned
to every interface on the system for target systems. - The
malware then tries to access the ADMIN$, C$\Windows, D$\Windows, and
E$\Windows shares on the target systems with current
privileges. - If current privileges aren’t enough to access the
aforementioned shares, it uses hard coded, domain specific
credentials (privileged credentials, likely Domain Administrator or
local Administrator) gained during an earlier phase of the attack to
attempt the same. - Once it has access, it enables the Remote
Registry service on the target device and sets
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
to 0 to enable share access. - Once it has performed the
earlier actions, it copies ntssrvr32.exe to the %WINDIR%\system32 of
the target system and schedules an unnamed task (e.g. At1.job) to
execute the malware. - The identified malware had a hard
coded date to launch the wiping. Systems infected with the malware
scheduled the job to start the process shortly thereafter.
- The malware sets the system clock to a random date in August
2012. Analysis suggests this might be for the purposes of ensuring
the component (a legitimate driver used maliciously) that wipes the
Master Boot Record (MBR) and Volume Boot Record (VBR) is within its
test license validity period. - While the original Shamoon
malware attempted to overwrite operating system files with an image
of a burning U.S. flag, the recently discovered variant attempts to
overwrite Windows operating system files, although with a different
image, a .JPG file depicting the death of Alan Kurdi, a Syrian child
migrant who died while attempting to cross the Mediterranean
Sea.
The following is guidance for detecting the malware, counteracting
its activity, and attempting to prevent it from propagating in an
environment. Please note that performing any of these actions could
have a negative effect and should not be implemented without proper
review and study of the impact of the environment.
- Monitor any events in the SIEM that show dates in August
2012. - Monitor for system time change events that set the
clock back to and from August 2012. - Monitor for Remote
Registry service starts. - Monitor for changes to the
aforementioned registry key value, if the value is currently
non-zero. - Prevent and limit access to the aforementioned
shares, which could have significant impact based on setup.
- Prevent client-to-client communication to slow down the spread
of the malware, which could also have a significant impact based on
setup. - Monitor filesystems for the creation of any of the
filenames provided in the Indicators of Compromise list at the
bottom of the post. - Change the credentials of all
privileged accounts and ensure local Administrator passwords are
unique per system.
Indicators of Compromise
The following is a set of the Indicators of Compromise for the
identified Shamoon variant. We recommend that critical infrastructure
organizations and government agencies (especially those in the Gulf
Cooperation Council region) check immediately for the presence or
execution of these files within their Windows Server and Workstation
environments. Additionally, we recommend that all customers continue
to regularly review and test disaster recovery plans for critical
systems within their environment.
File name: ntssrvr64.exe
Path: %SYSTEMROOT%\System32
Compile Time: 2009/02/15 12:32:19
File size:717,312
File name: ntssrvr32.exe
Path: %SYSTEMROOT%\System32 NA
NA
File size: 1,349,632
File name: ntssrvr32.bat
Path: %SYSTEMROOT%\System32 NA
MD5: 10de241bb7028788a8f278e27a4e335f
File size: 160
File name: gpget.exe
Path: %SYSTEMROOT%\System32
PE
compile time: 2009/02/15 12:30:41
MD5:
c843046e54b755ec63ccb09d0a689674
File Size: 327,680
File name: drdisk.sys
Path:
%SYSTEMROOT%\System32\Drivers
Compile time: 2011/12/28
16:51:29
MD5: 76c643ab29d497317085e5db8c799960
File Size: 31,632
File name: key8854321.pub
Path: %SYSTEMROOT%\System32
MD5: b5d2a4d8ba015f3e89ade820c5840639 782
File name: netinit.exe
Path: %SYSTEMROOT%\System32
MD5:
ac4d91e919a3ef210a59acab0dbb9ab5
File Size: 183,808
Service Details
Display name: "Microsoft Network Realtime
Inspection Service"
Service name: "NtsSrv"
Description: "Helps guard against time change attempts
targeting known and newly discovered vulnerabilities in network time
protocols"
Files created:
- %WINDIR%\inf\usbvideo324.pnf
- %WINDIR%\system32\netinit.exe
Dynamic Analysis Observables
RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\NtsSrv\
RegistryItem HKLM\SYSTEM\ControlSet001\Services\NtsSrv\
RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\wow32\
RegistryItem HKLM\SYSTEM\ControlSet001\Services\wow32\
RegistryItem HKLM\SYSTEM\CurrentControlSet\Services\drdisk\
RegistryItem HKLM\SYSTEM\ControlSet001\Services\drdisk\
FileItem C:\Windows\System32\caclsrv.exe
FileItem C:\Windows\System32\certutl.exe
FileItem C:\Windows\System32\clean.exe
FileItem C:\Windows\System32\ctrl.exe
FileItem C:\Windows\System32\dfrag.exe
FileItem C:\Windows\System32\dnslookup.exe
FileItem C:\Windows\System32\dvdquery.exe
FileItem C:\Windows\System32\event.exe
FileItem C:\Windows\System32\extract.exe
FileItem C:\Windows\System32\findfile.exe
FileItem C:\Windows\System32\fsutl.exe
FileItem C:\Windows\System32\gpget.exe
FileItem C:\Windows\System32\iissrv.exe
FileItem C:\Windows\System32\ipsecure.exe
FileItem C:\Windows\System32\msinit.exe
FileItem C:\Windows\System32\netx.exe
FileItem C:\Windows\System32\ntdsutl.exe
FileItem C:\Windows\System32\ntfrsutil.exe
FileItem C:\Windows\System32\ntnw.exe
FileItem C:\Windows\System32\power.exe
FileItem C:\Windows\System32\rdsadmin.exe
FileItem C:\Windows\System32\regsys.exe
FileItem C:\Windows\System32\routeman.exe
FileItem C:\Windows\System32\rrasrv.exe
FileItem C:\Windows\System32\sacses.exe
FileItem C:\Windows\System32\sfmsc.exe
FileItem C:\Windows\System32\sigver.exe
FileItem C:\Windows\System32\smbinit.exe
FileItem C:\Windows\System32\wcscript.exe
Source:
FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region
