Lab 06 - Malware

Setup

For this lab we will use the provided Windows VM. Please download it from here in advance (~12GB archived; you will need ~30-40GB of free storage on your computer).

The VM is compatible with VMWare (Workstation and Player) >16. You can download VMWare here. We recommend Workstation 17.

All exercises will be done inside the Windows VM. DO NOT copy the provided files outside of the VM. Even if it is “didactic malware”, written by us, it can actually be damaging to your computer.

Every tool you need is already installed on the VM we provided. If it’s not on the taskbar, you can find it on your Desktop, in the folder named Tools.

If needed, we will also use Openstack (limited capacity). Use the isc_prj project and start a VM with the following specifications:

  • Source: ISC Malware Lab
  • Flavor: m1.isc_malware_lab

You don't need to specify an SSH key, we will be using the browser console to interact with the virtual machine.

00. Infection vector

You are Gigel, an accountant at some lifeless notary firm. One day you receive an email with an attached Excel from ¿̶̦̞̗́͗̕y̸̳̹̗̆̏̍ǫ̵̭̞́͗͘ṷ̵̝͋̽r̸̢̪̈́ ̵͈̪̥̀̈́̓ḃ̶͇̬͑o̷͙̰̊͜š̷̱͈̐s̴͔͙̿?̵̤̽͆̕ telling you it’s some important financial data that has to be submitted until the end of the day to the authorities. Have you missed something? But you’re a good accountant, how did this happen? It’s probably something the bossman doesn’t really understand and is panicked for no reason, so you decide to open the attachment. You are filled with an extreme boredom and just want to get this stuff done and go back to scrolling Reddit, so you ignore any and all pop-ups, allow everything (despite the constant nagging of those pesky IT guys).

The attachment is on your Desktop. Go ahead, open it. What could go wrong?

01. Office Macros

You are now infected.

One of the most common infection vectors is phishing and social engineering, which relies on the user simply opening a malicious binary. In our case, simply opening that Excel document got you infected. You might not see anything suspicious happening for now, so keep reading.

Online sandboxes

While the VM we provided has some included tools for analysis, you probably don’t know where to get started. We recommend trying one of the available online sandboxes available.

The sandboxes mentioned above will take the documents you upload, run them (just like you did), but they also run some static analysis and monitor a few other things:

  • process execution, including any child processes
  • network activity
  • static analysis for suspicious signatures
    • Encoding detection
    • Binary packing detection
    • YARA Rules (a format to specify signatures for malware)

Pick one sandbox and submit the Excel document. See what info you can gather from the results.

Hint 1

Hint 1

Look at the processes that are executed, does anything look suspicious?

Hint 2

Hint 2

What about network connections?

Visual Basic macros

From sandbox results, you can probably observe some references to a Powershell process being started by Excel. Powershell is a shell, just like bash and is (at least from Windows 10/11) the default system shell on Windows. So, why would Excel, a spreadsheet program, need to open a shell prompt and run commands? In usual operation, it doesn’t, but for more advanced use cases, Excel (and some other Office products) allow you to write “macros”, which are functions written in the Visual Basic programming language.

You can read more about this

Since our macro got executed when we opened the document, we need a way to see it without running Excel. We can use the oletools Python package for this.

FLAG 1 [30p]

Read the documentation for oletools, available on Github and extract the macro. oletools is already installed in your virtual machine.

Hint

Hint

oletools is the package name. Check the documentation for the name of the tool that seems to do what you want.

Observe the output you got from oletools. It also provides some insight into what the macro is doing, including the reason it automatically executes when the Excel workbook is opened.

We recommend using CyberChef to decode the powershell payload that is executed. Some useful CyberChef functions you might want to use (not completely necessary to use all of them): Find/Replace, Drop Bytes, some decoding function (figure out the encoding, or let CyberChef help you), Decode text.

Hint

Hint

Windows uses UTF-16 Little Endian text encoding by default.

In the end you get a weird looking Powershell script. You don’t need to worry about understanding it, but if you want to read more, you can do it here. Some useful information you can get from this Powershell script:

  • the flag for this exercise
  • the address for the attacker’s infrastructure (which you also observed in the sandbox results)

02. Command and Control (C2 / C&C)

What you uncovered is a command and control stager. Command and control attacks are a type of attack where a program is used to gain control of the infected computers. This requires a connection to a command and control server, where attackers can see the infected devices and send command to them. Some functionality of command and control binaries:

  • process control (spawning, killing and dumping processes)
  • information gathering (user, network, computer)
  • file transfer
  • covert persistence (via process injection, beacons, backdoored binaries)
  • screenshot taking

FLAG 2 [10p]

Attackers might neglect the security of their own infrastructure. Check if this is the case. Maybe try some other known ports? (nmap is installed, but you probably don't need it)

The C2 stager we used is a pretty simple one. If you want to read more about C2 capabilities you can read this awesome blog post series about Sliver.

03. Ransomware

Ask your lab assistant to use the C2 server to send some actual malware your way.

As a backup, the ransomware binary can also be found in C:\Users\<your_user>\Documents\backup

As before, go ahead and run it, see what happens.

Ransomware is a type of malware that encrypts documents and files on your computer, demanding a ransom to obtain a decryption key or program. In our case, the entire content of the very_secret_documents folder on your Desktop has been encrypted.

But is there any way you can recover those files? Since we presume the attacker has a decryption key for your files, that means the ransomware must communicate in some way. Try and use Wireshark to see if any traffic seems out of the ordinary.

FLAG 3 [20p]

Try and find the decryption key.

FLAG 4 [10p]

Decrypt the files, maybe they contained a flag. You can use the provided decryptor.exe (on your Desktop), or you can challenge yourself and try to decrypt them manually (CyberChef can be of great help here; assume the encryption is a well-known one).

You can also use any of the sandboxes you used at the first exercise and see what useful information they can provide.

04. Infostealers

As the name suggests, this type of malware steals information from your system. Usually, they steal browser data, since it can contain:

  • stored passwords
  • saved credit cards
  • valid cookies (they can be used for session hijacking)

As before, run the provided infostealer.exe from your lab assistant (or the backup one)

Seemingly nothing happens (except that your browser might close on you), but let us take a look at what files are accessed by infostealer.exe. We can use the tool procmon64 from the Sysinternals Suite to analyze some of the runtime behavior of a program, including accessed files and network activity.

FLAG 5 [30p]

Find what information has been stolen from you. There’s a flag in there.

Use procmon64 to look for accessed files and network activity. By default procmon64 shows what all current processes are doing. Try and filter for our process (look at what options procmon64 offers you at the top of the window).

You need to run the binary again after setting up your filters!

Also try to have a look at the files that are managed by Chrome and check out the links at the end of the lab if you want to better understand how he passwords are stored. You also have a tool to explore SQLite databases installed already.

Hint

Hint

If there is some network activity that interests you, you can use Wireshark. It has some awesome features, like extracting objects from network requests (wink wink).

Make use of the sandboxes, maybe they also provide some useful information. See how it compares to what you find by manually analyzing the binary.

05. [Bonus] Anti-reversing techniques

If you were brave enough to try and decompile the executables, you might have noticed they look like gibberish. If not, use Ghidra to have a look at one of the executables.

The executables are missing any symbols and the code seems very hard to understand. That is because they are packed using UPX. While UPX is an executable packer, meant to be used for executable compression, it is also commonly used to make reverse engineering harder.

The good news is that you can also unpack it using UPX. It is already installed in your VM, so give it a try.

After unpacking it, try to decompile it again using Ghidra. Does it look a little bit more readable?

It is still not as readable as if you were expecting if you ever looked at a C binary decompiled, and that is because our executables were written in Go. Another technique that makes reverse engineering harder is the use of modern languages (Go, Rust, Zig, Nim), as they each come with their own (complex) runtime.

Further reading

isc/labs/06.txt · Last modified: 2024/11/11 14:43 by vlad_iulius.nastase
CC Attribution-Share Alike 3.0 Unported
www.chimeric.de Valid CSS Driven by DokuWiki do yourself a favour and use a real browser - get firefox!! Recent changes RSS feed Valid XHTML 1.0