SECURITY

Threat Advisory: STRT-TA02 - Destructive Software

The Splunk Threat Research Team is monitoring open channel intelligence and government alerts indicating the possibility of malicious campaigns using destructive software in relation to ongoing geopolitical events. Based on historical data of named geopolitical actors, the use of destructive payloads has been observed in past campaigns. These destructive payloads aim to disable targeted hosts beyond recovery and seek to disrupt, deny, and degrade an organization’s technology and services, especially Operational Technology which is the software and hardware directly related to the monitoring and operation of industrial systems (i.e Utilities such as telecommunications, electricity, water, gas, etc). 

If recent Ransomware campaigns are an indication of the effects malicious campaigns against healthcare, technology, food supply, and gas supply can have in real life (Colonial pipeline outage affected 45% of U.S East Coast fuel supply), then destructive payloads whose sole use is to render hosts unusable should be considered a possibility under the current geopolitical indicators. 

The Attack: The focus of this threat advisory is on a recently reported destructive payload by Microsoft MSTIC under the name of WhisperGate. We break down the different components and functions of how this payload works and provide a series of detections to mitigate and defend against this threat. 

Although we cannot prevent patient 0, we can, however, measure and recover execution artifacts which if used timely and operationalized as analytics and playbooks can provide analysts a tool to isolate, contain and prevent further damage.  Further on, this data may help understand the extent and the TTPs of current and future campaigns where these payloads may be in use. 

Ransomware is by itself a destructive payload, however, some past campaigns have shown the use of multiple payloads some of them with Ransomware characteristics used as decoys, and others with the same Ransomware characteristics, however, they execute destructive payloads at targeted organizations (i.e Hard disk erasure).

“WhisperGate” Indicators And Analysis:

Stage 1: MBR Wiper

This wiper malware contains code that affects the Master Boot Record (MBR) sector of the compromised host. This wiper will try to overwrite or replace the original MBR with the destructive MBR code. The screenshot below shows a code snippet to overwrite the MBR with the malicious master boot record code containing the ransom note.


Stage2: Discord Downloader

Delay Of Execution

This stage 2 malware contains a possible defense evasion that might bypass AV detection technology like emulation or even sandbox testing that monitors process behavior in a period of time (let say less than 20 sec.). The evasion is achieved by running a base64 encoded powershell that will delay its execution. The screenshot below shows the code it runs twice to sleep for 20 sec.


Encoded command

Powershell -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==

Decoded command

Powershell Start-Sleep -s 10

Discord Download

After the sleep, Stage 2 will try to download a “.jpg” file in the discord server. The downloaded file is another .net compiled malware which is the stage 3 that is in reverse form. By using a simple python script you can reverse it to make it a valid PE executable. Below is the screenshot of how it downloads the stage 3 malware in the discord server.


Stage 3: Defense Evasion and Process Injection (File Corrupter)

The stage3 is another .net compile malware that will load its resource data to decrypt it, which is the advancedrun.exe and the file corrupter malware.

Evading Windows Defender AV

As soon as the stage3 executes, it will drop advancedrun.exe and a vbscript in %temp% folder to evade Windows Defender AV. The screenshot below shows how “Advacedrun.exe (Nirsoft Tool) was used to disable WinDefender service and remove or delete Windows Defender directory in Programdata folder.

“C:\Users\Administrator\AppData\Local\Temp\AdvancedRun.exe” /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run


“C:\Users\Administrator\AppData\Local\Temp\AdvancedRun.exe” /EXEFilename 
“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” /WindowState 0 /CommandLine “rmdir 
‘C:\ProgramData\Microsoft\Windows Defender’ -Recurse” /StartDirectory “” /RunAs 8 /Run


The .vbs file drop in the%temp% folder will add C:\ drive to the exclusion path of Windows Defender.


Process Injection - File Corrupter Malware

It will create a suspended process of InstallUtil.exe in %temp% folder to inject the file corrupter malware. Below is the CreateProcess API call for the said file to prepare its injection.


By Extracting the file that it will inject in InstallUtil.exe using WriteProcessMemory API, we were able to grab the corruptor malware.

This malware will first enumerate all the drive types connected on the compromised machine. It looks specifically for “Fixed” or “Remote” drives as a starting point in traversing all possible files to corrupt.


If it finds a file during its enumeration, It will convert its string filename in all capital characters then check if the file extension is in its list. Below is the screenshot of code that checks the file extension and the list of its targeted file type.


File extension list

.HTML .HTM .SHTML .XHTML .PHTML .PHP .JSP .ASP .PHPS .PHP5 .ASPX .PHP4 .PHP6 .PHP7 .PHP3 .DOC .DOCX .XLS .XLSX .PPT .PPTX .PST .OST .MSG .EML .VSD .VSDX .TXT .CSV .RTF .WKS .WK1 .PDF .DWG .ONETOC2 .SNT .JPEG .JPG .DOCB .DOCM .DOT .DOTM .DOTX .XLSM .XLSB .XLW .XLT .XLM .XLC .XLTX .XLTM .PPTM .POT .PPS .PPSM .PPSX .PPAM .POTX .POTM .EDB .HWP .602 .SXI .STI .SLDX .SLDM .BMP .PNG .GIF .RAW .CGM .SLN .TIF .TIFF .NEF .PSD .AI .SVG .DJVU.SH .CLASS .JAR .BRD .SCH .DCH .DIP .PL .VB .VBS .PS1 .BAT .CMD .JS .ASM .PAS .CPP .CS .SUO .ASC .LAY6 .LAY .MML .SXM .OTG .ODG .UOP .STD .SXD .OTP .ODP .WB2 .SLK .DIF .STC .SXC .OTS .ODS .3DM .MAX .3DS .UOT .STW .SXW .OTT .ODT .PEM .P12 .CSR .CRT .KEY .PFX .DER .OGG .RB .GO .JAVA .INC .WAR .PY .KDBX .INI .YML .PPK .LOG .VDI .VMDK .VHD .HDD .NVRAM .VMSD .VMSN .VMSS .VMTM .VMX .VMXF .VSWP .VMTX .VMEM .MDF .IBD .MYI .MYD .FRM .SAV .ODB .DBF .DB .MDB .ACCDB .SQL .SQLITEDB .SQLITE3 .LDF .SQ3 .ARC .PAQ .BZ2 .TBK .BAK .TAR .TGZ .GZ .7Z .RAR .ZIP .BACKUP .ISO .VCD .BZ .CONFIG

If the file extension is in its list, it will generate a random value that will serve as the file extension of its corrupted file, then it will mem allocate with size of 0x100000 bytes and fill it with “0xCC” using memset API. After that it will open the target file, overwrite it with the allocated memory fill of 0xCC bytes and rename it with the random generated file extension.

Below is the screenshot during the corruption process of this malware, and how it overwrites the file with 0xCC that makes it not recoverable.


Ping Sleep and the Melting Batch Script

This corruptor malware will try to delete itself using the known batch script command like in the screenshot below. Before that, it also used a ping utility tool to generate sleep for 4-5 sec.


Detections

Ping Sleep Batch Command

This analytic will identify the possible execution of ping sleep batch commands. This technique was seen in several malware samples and is used to trigger sleep times without explicitly calling sleep functions or commandlets. The goal is to delay the execution of malicious code and bypass detection or sandbox analysis.

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
  where `process_ping` (Processes.parent_process = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") OR 
  (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*")
  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
  | `drop_dm_object_name("Processes")` 
 | `security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` 


Powershell Remove Windows Defender Directory

This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where  it used Nirsoft's advancedrun.exe to gain administrative privileges to then execute a PowerShell   command to delete the Windows Defender folder.

`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows Defender*" 
 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` 


Suspicious Process With Discord DNS Query

This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution.

`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" 
  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` 


Excessive File Deletion In WinDefender Folder

This analytic will identify excessive file deletion events in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which adversaries abused Nirsoft's advancedrun.exe to gain administrative privilege to then execute PowerShell   commands to delete files within the Windows Defender application folder.

`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" 
  | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by user EventCode Image ProcessID Computer
  |where count >=50
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` 


Windows InstallUtil in Non Standard Path 

The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location.

Windows NirSoft AdvancedRun

The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec.


Windows DotNet Binary in Non Standard Path

The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory.


Splunk Security Content 

Name

Technique ID

Tactic

Description

powershell windows defender exclusion commands


T1562.001

Defense Evasion

This analytic will detect a suspicious process command-line related to windows defender exclusion feature.

windows defender exclusion registry entry

T1562.001

Defense Evasion

This analytic will detect a suspicious process that modifies a registry related to windows defender exclusion feature.

executables or script creation in suspicious path

T1036

Defense Evasion

This analytic will identify suspicious executable or scripts (known file extensions) in a list of suspicious file paths in Windows. This technique is used by adversaries to evade detection. The suspicious file paths are known paths used in the wild and are not common to have executable or scripts.

add or set windows defender exclusion

T1562.001

Defense Evasion

This analytic will detect a suspicious process command-line related to windows defender exclusion feature. This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code.

attempt to stop security service

T1562.001

Defense Evasion

This search looks for attempts to stop security-related services on the endpoint.

wscript or cscript suspicious child process

T1134.004
T1543
T1055
T1134

Defense Evasion, Privilege Escalation, Persistence,

This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other scripts like powershell or spawn a suspended process to inject its code as a defense evasion.

process deleting its process file path 

T1070

Defense Evasion

This detection is to identify a suspicious process that tries to delete the process file path related to its process. 

high file deletion frequency

T1485

Impact

This detection detects a high amount of file deletions in a short time for specific file types. 

suspicious process file path

T1543

Persistence, Privilege Escalation

The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious software.

CMD Carry Out String Command Parameter

T1059.003

Execution

The following analytic identifies command-line arguments where cmd.exe /c is used to execute a program. cmd /c is used to run commands in MS-DOS and terminate after command or process completion. 

Impacket Lateral Movement Commandline Parameters

T1021

T1021.002

T1021.003

T1047

T1543.003

Lateral Movement, Execution, Persistence, Privilege Escalation

This analytic looks for the presence of suspicious command line parameters typically present when using Impacket tools. 

Suspicious Process DNS Query Known Abuse Web Services

T1059.005

Execution

This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host.

Malicious PowerShell Process - Encoded Command

T1027

Defense Evasion

The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code.

Suspicious Process With Discord DNS Query


T1059.005

Execution

This analytic detects a suspicious process making a DNS query via known,

  abused  VoIP, instant messaging, and digital distribution platforms used to download external files. 

  This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. 

Ping Sleep Batch Command

T1497.003

Defense Evasion, Discovery

This analytic is to detect a possible ping sleep batch command. This technique was seen in several malware and adversaries 

  to trigger sleep without calling sleep function or commandlets to delay its execution to bypass detection and sandbox analysis.

Powershell Remove Windows Defender Directory


T1562.001

Defense Evasion

This analytic is to detect a suspicious powershell command to delete Windows Defender folder. 

Windows InstallUtil in Non Standard Path



T1218.004

Defense Evasion


Identifies the Windows binary InstallUtil.exe running from a non-standard location.

Windows DotNet Binary in Non Standard Path


T1036.003

Defense Evasion

Identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory.


Excessive File Deletion In WinDefender Folder


T1485

Impact

This analytic is to detect suspicious excessive file deletion events in Windows Defender folder.

Windows NirSoft AdvancedRun


T1588.002

Resource Development

Identifies the use of AdvancedRun.exe

IOC:

File name

Hashes - Sha256

Stage1 - Mbr wiper

a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92

Stage2 - Discord downloader

dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78

Stage3 - not fix

923eb77b3c9e11d6c56052318c119c1a22d11ab71675e6b95d05eeb73d1accd6

Stage3 - fix (tbopbh.dll)

9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d

advancedrun.exe

cd5cb94cba8f2d5de82cfb548d21066b5bd79a0e8f721e86c464e5ad50f85d5b

File Corrupter malware

34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907

Nmddfrqqrbyjeygggda.vbs

db5a204a34969f60fe4a653f51d64eee024dbf018edea334e8b3df780eda846f

Mitigation 

As outlined in CISA Alert (AA22-011A) and other CISA recently released a communication on how to Implement Cybersecurity Measures in order to protect against potential critical threats, here are some steps organizations can take right now in order to protect themselves. 

Learn More

You can find the latest content about security analytic stories on research.splunk.com. For a full list of security content, check out the release notes on Splunk Docs.

Feedback

Any feedback or requests? Feel free to put in an issue on Github and we’ll follow up. Alternatively, join us on the Slack channel #security-research. Follow these instructions If you need an invitation to our Splunk user groups on Slack.


Contributors

We would like to thank the following for their contributions to this post:

  • Rod Soto
  • Teoderick Contreras
  • Michael Haag
  • Jose Hernandez
  • Lou Stella
  • Mauricio Velazco 

 

The Splunk Threat Research Team is an active part of a customer’s overall defense strategy by enhancing Splunk security offerings with verified research and security content such as use cases, detection searches, and playbooks. We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats. The Splunk Threat Research Team focuses on understanding how threats, actors, and vulnerabilities work, and the team replicates attacks which are stored as datasets in the Attack Data repository

Our goal is to provide security teams with research they can leverage in their day to day operations and to become the industry standard for SIEM detections. We are a team of industry-recognized experts who are encouraged to improve the security industry by sharing our work with the community via conference talks, open-sourcing projects, and writing white papers or blogs. You will also find us presenting our research at conferences such as Defcon, Blackhat, RSA, and many more.


Read more Splunk Security Content

Join the Discussion