The New Face of PowerShell: Ransomware Powered by PowerShell-Based Attacks

 

Summary

 

The PowerShell for writing malicious code is a normal way, and in the past, usually PowerShell itself was played as a supporting role, like executing cmdlets or loaders, but the trend is now to be changed. To make a ransomware, totally with pure PowerShell, is never seen before, and recently many samples were discovered, which attracted me to learn from what happened.

 

Technique analysis

 

The PowerShell ransomware samples have the same abilities, such as deleting shadows, stopping interfering processes, disabling the defender, spreading to the network, and adding registry persistence, and so on; the whole thing is done by the only PowerShell.

 

Third party software encryption scheme

One of the PowerShell ransomware is to utilize third-party encrypt free software called VeraCrypt to help encrypt the data of the drive; it will download from the remote address https[:]//Launchpad[.]net/veracrypt/trunk/1.25.9/+download/VeraCrypt_Setup_x64_1.25.9[.]msi and install VeraCrypt when the PowerShell is executed.

The sample MD5 hash: 982433cb4f485fb6f3cd9fb32cce3bb2

Fig.1 Third party VeraCrypt scheme by PowerShell

The samples MD5 hashes:

f3b663ef29fd2f8b41cdcf17b4a4300d

ffef1e40446902adc8071354fd39c1c6

Fig.2 Third party VeraCrypt scheme by PowerShell

 

RSA and AES encryption scheme

One of the PowerShell ransomware's purposes is to encrypt the data of potential victims by combining both the RSA and AES algorithms, which is a common solution by other ransom groups. Here without talking about the detail of encryption, like how to save the AES key and IV and how to use the public key.

The samples MD5 hashes:

118bd1887d7a1f825826e3a00f06b98e

4e7fd80028d4d0b227d48da1843762ab

Fig.3 RSA+AES scheme by PowerShell

 

 

Conclusion

As you know, like another ransomware group, their source code was leaked, and then more threat actors will emerge. The PowerShell scripts will become more popular for writing more powerful malicious code. Obviously, it will be utilized more, and its previously subordinate role will also change as people see more cases. And on those samples without any obfuscation technique, it would be changing.

 

IOCs

Files:

982433cb4f485fb6f3cd9fb32cce3bb2

f3b663ef29fd2f8b41cdcf17b4a4300d

ffef1e40446902adc8071354fd39c1c6

118bd1887d7a1f825826e3a00f06b98e

4e7fd80028d4d0b227d48da1843762ab

 

End.

Ransom note graphic representations

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

The Art of Deception: A Deep Dive into Advanced Trojan-Dropper Obfuscation and Their True Intentions

Summary

 

First thanks for Szabolcs Schmidt was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger.

In this report, I do plan to dive deep into more details of the advanced Trojan dropper; it looks like obfuscation mechanisms, but until now, their true intentions have been unknown.

The Trojan dropper is very intriguing and different from other APT groups. If you are keen to learn from the latest and related report, please click here.

 

Technical analysis

 

Basic info

The sample hashs:

md5 A699AFD908E0DEC5C96FF7188450B89F

Sha256
f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c

 

Operation system: Operation system: Windows(95)[I386, 32-bit, GUI]

(Heur)Packer: Packer detected[High entropy + Section 1 (".data") compressed]

 

 

Advanced string obfuscation Mechanisms?

The strings in the malware Trojan dropper were obfuscated, so it is a big challenge for only static analysis. It is also not to encode those strings with simple base64 or XOR; It appears that it is a good and User defined advanced string obfuscation techniques. Until now it is not clear, let’s do it.

Fig.1 User defined advanced strings obfuscation techniques

 

Three categories for obfuscation mechanisms

The above string looks like obfuscation mechanisms can be classified into three categories: the hardcoded prefix with %s, the hardcoded suffix with %s, and the hardcoded without %s.

The hardcoded prefix with %s

Let’s take the string “%s lbMG4xVIjgrp99jCpcEHRP2Dk4tuy” as an example: it allocates a memory block of size a4 + 1 and If the memory allocation is successful (v5 is not NULL), the first byte of the allocated memory is set to the value of aSLbmg4xvijgrp9[0].

Fig. 2 the hardcode prefix

 

 

The hardcoded suffix with %s

Let’s take the string “iKutjR2ydZ1tUZPHflBndXLYdaNF%s” as an example: it allocates a memory block of size a1 + 48239 and Whether the length of the string "iKutjR2ydZ1tUZPHflBndXLYdaNF%s" is odd and Regardless of the conditional check, the function always returns the pointer v2.

Fig. 3 the hardcode suffix

 

 

The hardcoded without %s

Let’s take the string “WaioFh2jmJmyIwAM” and the sub_407FE3 as an example:

1.      The strings are related to the sub_407F3E includes The hardcoded suffix with the argument 323, allocates memory, and immediately frees it;

2.      Attempts to allocate memory of size a5 + 1

3.      If the allocation fails, retries up to 2060(0x80C) times, sleeping for 72(0x48u) milliseconds between each retry.

4.      If all retries fail, terminates the program using exit(0).

5.      Returns the pointer to the allocated memory.

Fig. 4 without %s

 

The below is another example, and it seems more complicated, but the design is similar when it allocates memory and immediately frees it, sleeping in different times and exiting.

Fig. 5 without %s

 

 

 

What’s the purpose?

What purpose do those three categories serve as obfuscation techniques? Let’s move forward to the type of the hardcoded without %s, which is a little bit different to find when it allocates memory, and v23 points to the 31st byte (offset 31) of the allocated memory block, which points to a new offset within the allocated memory block and then frees it. And the variable v23 is not used for any purpose. It really attracts malware analysts to pay close attention to it; the similar designs are spread in the middle of the code.

Fig. 6 unclear purpose 1

 

Let’s continue to see more examples. The function sub_424BCE allocates memory and performs a specific initialization on the allocated memory and checks if the first byte is equal to the ASCII49 value for the character '1'). If true, it isv29 incremented by 1. and finally freed. And the variable v29 is not used for any purpose.

Fig. 7 unclear purpose

 

 

 

Seems to be finding new things

Until now, the purpose of those things is unclear; curiosity drives me to learn more. I am careful to observe the code and find the function ub_407FE3 is used five times (here just showing the snippet), so I am very excited to know what the motivation is for this.

Fig. 8 ub_407FE3 is used for five times

 

Let’s move to the first sub_407FE3 and step into the sub_407F3E, and the function allocates 48,562 bytes of memory using the allocated malloc and The expression strlen("iKutjR2ydZ1tUZPHflBndXLYdaNF%s") & 1 checks if the length is odd and always returns v2, which is the memory pointer; the string “iKutjR2ydZ1tUZPHflBndXLYdaNF%s” is used for a condition to calculation.

Fig. 9 sub_407F3E

 

And then the parameter v56 passed to the next function sub_4149AA(2054, 247, 3125, 722, v56, 1464); and finally create the temp directory "C:\\Users\\xxx\\AppData\\Local\\Temp\\" to the allocated memory. So here we know that the string “iKutjR2ydZ1tUZPHflBndXLYdaNF%s” looks like an obfuscation technique, but in fact it can’t be deobfuscated, and the design is to intentionally mislead analysts who consider it some kind of obfuscation technique.

Fig.10 Trojan dropper get the temp directory

 

To continue moving forward and diving deeper into the function sub_410E9D(4552, 0, v55, 9993, 0, 1766, v51, v56, v54) and their parameter, the variable v55 from the function v55 = (void *)sub_407FE3(6897, 41, 862, 0, 2046); the value 003B2AE0 is a pointer address that now seems without any valuable data.

Fig. 11 without any valuable data

 

Moving forward to the function sub_421C4C and diving deeper into details and understanding that it will generate random strings as a part of the Trojan dropper file name (e.g, TujxgfVN) that are based on the specific strings “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789”, but the whole process does not use any obfuscation string. It is really unbelievable that it seems to do mathematical calculations but is actually loading DLLs; it implies that the threat actor has high skills for hidden purposes;.

Fig. 12 the code for generating a random string

Fig. 13 return a random string TujxgfVN

 

The variable v55 is used for many functions as a parameter passed, but let’s focus on the next function, sub_410E9D, to see what’s happened.

Fig. 14 v55 is used many times

 

When sub_410E9D finished and the address of memory 003B2AE0 and its values changed to the strings “C:\\Users\\xxx\\AppData\\Local\\Temp\\Verify-TujxgfVN.exe,” it is about to be executed as a new name Trojan dropper in the new directory. Yeah, that’s it! The value of address in memory will pass to the next function as a parameter.

Fig.15 create a new Trojan dropper in temp directory

 

When the Trojan dropper Verify-TujxgfVN.exe is created, it will be triggered and executed by the runas a powerful command-line tool that allows you to run programs or commands as a different user, typically with elevated privileges (e.g., as an administrator).

Fig.16 to run the Trojan dropper Verify-TujxgfVN.exe

 

Conclusion

From the above process of analysis, those strings are embedded in Trojan dropper is not obfuscation techniques but well-designed related to memory allocated and the information that Trojan dropper will handle with, they don’t need to do a deobfuscation trying or decoding with them, those strings themselves without any practical significance, such as prompt information, API or system commands, the design is very different from other APT group, it seems that the threat actors are good at math and the Memory data technology processing, and with high programming skill and understanding how to anti-analysis and protect the malware itself, on the process of debugging, and finding the command-line instruction “cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"%s\"” that combines several actions to remove itself and anti-debugger. After all, this is a novel design and a new try for hiding their true intentions. Very special!

 

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Unmasking the Threat: Understanding Sophisticated Trojan-Dropper Mechanisms

 

Summary

 

First thanks for Szabolcs Schmidt was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger, I have no other words, you are doing an amazing work.

Abuse.ch's Malware Bazaar is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.

 

In this report, I do not plan to dive deep into all the details of the technique, but it is possible to make it up when having enough time to analyze; I would like to do that. In fact, it will learn more when diving deeper into the malware itself.

 

 

Technical analysis

 

Basic info

 

The sample hashs:

md5 A699AFD908E0DEC5C96FF7188450B89F

Sha256
f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c

 

Operation system: Operation system: Windows(95)[I386, 32-bit, GUI]

(Heur)Packer: Packer detected[High entropy + Section 1 (".data") compressed]

 

 

To observe the timeline and activities of the malware running in the sandbox, which created many files, such as DLLs and XML files, which created a task and connected to C2, from their behavior being checked, it is highly confident the malware is the type of Trojan dropper. After all, a logic flow graphic is as follows.

Fig.1 Trojan-Dropper Mechanisms

 

In the first stage, the Trojan dropper constantly tries to escalate privileges to execute malicious actions with the “runas” command in Windows, triggering a UAC prompt with a program name like “%sVerify-%s.exe,” which is created on the temp path like “C:\\Users\\XXX\\AppData\\Local\\Temp\\Verify-VBmJOhWZBbsNCmG.exe,” and once it is allowed to execute, it will drop a DLL file (e.g., eHMuMPu.dll). The eHMuMPu.dll will create a new XML file (e.g., dAdyJ6J.xml) and create the Trojan dropper itself with a new name (e.g., HfNUDO.exe) in the path like “C:\Program Files (x86)\Common Files\SpeechEngines\CSXW942RQP4MrCBvYGRyLsGsK\HfNUDO.exe.”. On the next step, it will continue to use the command line “schtasks /create /tn qb8iA2pa3SXfu /XML %AllUsersProfile%\Start Menu\6MGmiTas9Ndu41eCYbw\dAdyJ6J.xml /F” to create a new task named qb8iA2pa3SXfu with XML, which will execute the task every five minutes.

Fig.2 the first stage

 

In the second stage, the Trojan dropper HfNUDO.exe creates the DLL XSei1gC.dll on the “%AppData%\Media Center Programs\5xHEBJtPlIJ2Ifh\XSei1gC.dll”, and runs it with rundll32.dll in cmd.exe, which can query the details of the task qb8iA2pa3SXfu and create a new DLL BJtPlI.dll on the “%ProgramFiles% (x86)\Common Files\WanNengSoftManager\hI5sEDIwfuuZzva7AiY5A75x\BJtPlI.dll”. Because the Trojan dropper executes the task to do persistence every five minutes, which will create the two DLLs; they have the same abilities but different file names, so the DLLs can be observed in different directories. It is so crazy!

Fig.3 create DLLs with persistence task

 

When the BJtPlI.dll is created by XSei1gC.dll, it will go to the third stage, which will do antivirus and remove the Windows Defender as follows.

Fig.4 Anti Windows Defender

 

In the fourth stage, BJtPlI.dll will connect to the C2 server and execute the attacking campaign.

Fig.5 connect to C2 server

 

The C2 server can be accessed until the write-up is finished. Hunting down the IP 188[.]166.28.204, we can collect many attacking samples deployed by the threat actor. It seems that very hot attacking activities, maybe that’s why Szabolcs Schmidt was calling malware analysts, I’m really appreciate it again and I now do not dive deeper into the sample.

Fig.6 C2 server still working and hot attacking activities

Conclusion

From the above analysis, it appears that the malware is the type of Trojan dropper. It is a little bit new to use XML to create a task as a technique, and with multi-stage DLL techniques, it is highly confident that it is a skilled and experienced APT group, a more hidden threat around the digital world; let’s pay close attention.

 

 

IoCs

Files:

Trojan-Dropper Md5 A699AFD908E0DEC5C96FF7188450B89F

Sha256
f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c

 

Dropped by Trojan-Dropper:

dAdyJ6J.Xml md5 621d17a2e9562fb63248edec813fd481

Sha256

1853cc36050f36dc525ab479c77846e976525269066a6cf4bacc4e25eb55d465

 

eHMuMPu.dll md5 3c46ae847e57438d551ad2e5dceaa100

Sha256

107deecec00a31402430a813be00534e4a3cfc4ac5ded872caf4d2c50d117c25

 

BJtPlI.dll md5 056f31e74efa70a140105fdd74cff033

Sha256

6a66672beba2df1babb7801f63f3e171cf09b0807e1f7be86b42617a29eb983b

 

XSei1gC.dll md5 7c88d53706449de3a09dfd1ca60e81cb

Sha256

80c7d43c40872ff4b3a88f6d1dfe57c9facf9544eedfe08e7db7057e953eec9d

 

 

 

Host:

HKCU\Software\Microsoft\CTF\TOZYHhZP7JrXsnrqoh9bsgGED9aA

\SOFTWARE\Conexant\SAII\Controllayer\Si5cETIwNH7RbB7KQWrrV

cmd.exe /c rundll32 %ProgramFiles% (x86)\Common Files\SpeechEngines\GRyLsGsKSP7YyVjekJtym08\eHMuMPu.dll,

A31RU8dofhmCksIVB0GquGp0C8FYekLqp2qvDoSbkisXSjuqUyxv6KG2aaSOGLRUN

schtasks /query /tn qb8iA2pa3SXfu

schtasks /create /tn qb8iA2pa3SXfu /XML %AllUsersProfile%\Start Menu

\6MGmiTas9Ndu41eCYbw\dAdyJ6J.xml /F

%ProgramFiles% (x86)\Common Files\SpeechEngines\CSXW942RQP4MrCBvYGRyLsGsK\HfNUDO.exe

cmd.exe /c rundll32 %AppData%\Media Center Programs\5xHEBJtPlIJ2Ifh\XSei1gC.dll,

A31RU8dofhmCksIVB0GquGp0C8FYekLqp2qvDoSbkisXSjuqUyxv6KG2aaSOGLRUN

rundll32  %AppData%\Media Center Programs\5xHEBJtPlIJ2Ifh\XSei1gC.dll,

A31RU8dofhmCksIVB0GquGp0C8FYekLqp2qvDoSbkisXSjuqUyxv6KG2aaSOGLRUN

schtasks /query /tn qb8iA2pa3SXfu

schtasks /query /tn qb8iA2pa3SXfu /FO LIST /V

HKCU\Software\Microsoft\CTF\TOZYHhZP7JrXsnrqoh9bsgGED9aA

HKCU\Software\Microsoft\Sensors\aFIYzgtmOjU2vEv\XJkYu2C7y3NPUVxpnW5WxGs0ISC

rundll32 %ProgramFiles% (x86)\Common Files\WanNengSoftManager\hI5sEDIwfuuZzva7AiY5A75x\BJtPlI.dll,cmlPc6dI8

cmd.exe /c rd /q /s %ProgramFiles%\Windows Defender

cmd.exe /c rd /q /s %ProgramFiles% (x86)\Windows Defender

cmd.exe /c rd /q /s %AllUsersProfile%\Microsoft\Windows Defender

cmd.exe /c rd /q /s %ProgramFiles%\Windows Defender Advanced Threat Protection

cmd.exe /c rd /q /s %ProgramFiles% (x86)\Windows Defender Advanced Threat Protection

cmd.exe /c del %WinDir%\System32\MRT.exe /q /s /f

cmd.exe /c del %WinDir%\SysWOW64\MRT.exe /q /s /f

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

HKLM\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\DisableAntiVirus

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRoutinelyTakingAction

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ServiceKeepAlive

HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks

\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0\CheckSetting

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableSpecialRunningModes

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRealtimeMonitoring

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates\ForceUpdateFromMU

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features\TamperProtection

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Antivirus\Cloud Delivered Protection\DisableCloudProtection

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen

%ProgramFiles% (x86)\Common Files\SpeechEngines\GRyLsGsKSP7YyVjekJtym08\eHMuMPu.dll

%ProgramFiles% (x86)\Common Files\SpeechEngines\CSXW942RQP4MrCBvYGRyLsGsK\HfNUDO.exe

%AllUsersProfile%\Microsoft\Windows\Start Menu\6MGmiTas9Ndu41eCYbw\dAdyJ6J.xml

%ProgramFiles% (x86)\Common Files\WanNengSoftManager\hI5sEDIwfuuZzva7AiY5A75x\BJtPlI.dll

 

Network:

TCP 188[.]166.28.204:80

UDP 188[.]166.28.204:137 

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

AsyncRAT in Action: UAC-0173’s Latest Advanced Antivirus Detection & Evasion Techniques

 

Summary

UAC-0173 is a threat actor group known for targeting Ukrainian organizations with sophisticated malware campaigns. One of their preferred tools is AsyncRAT. This report explores the antivirus detection and evasion techniques used by UAC-0173 in their AsyncRAT campaigns, providing insights into how defenders can detect.

Abuse.ch's Malware Bazaar is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.

 

 

Technical analysis

 

Basic info

The sample hashs:

md5 e9cedc98677b6b5146b14009ced7d624

Sha1 1b6e14e578c613932496bfd49c616760bdceb2c1

 

Operation system: Windows (I386, 32-bit, EXEC]

Packer: no

 

 

Deploy main abilities

This client program, like other RATs, has its main abilities: checking VMs or sandboxes, killing processes, privilege escalation, and so on. The below will introduce them one by one.

 

 

Anti-Analysis

In order to anti analysis, as you know, WMI(Windows Management Instrumentation) is a powerful tool for managing and querying system information, and it is often used by system administrators, developers, and even malware authors. In latest variant, a new finding, it uses The query SELECT * FROM Win32_CacheMemory to retrieve information about the cache memory on a Windows system.  Win32_CacheMemory is a WMI class that represents the cache memory on a system. It provides details about the cache memory, such as its size, type, and status. Here It appears that it attempts to detect whether the code is running in a virtualized environment (e.g., a VM or sandbox).

Fig.1 WMI with Win32_CacheMemory

 

 

Killing processes

Like other malware, it is still in the same way and uses The CreateToolhelp32Snapshot function is a Windows API used to create a snapshot of specified processes, heaps, modules, or threads in the system, and it will kill these processes, including a mix of legitimate system utilities, antivirus components, and tools commonly, as follows:
Taskmgr.exe

ProcessHacker.exe

procexp.exe

MSASCui.exe

MsMpEng.exe

MpUXSrv.exe

MpCmdRun.exe

NisSrv.exe

ConfigSecurityPolicy.exe

MSConfig.exe

Regedit.exe

UserAccountControlSettings.exe

taskkill.exe

Retrieve Antivirus

It uses The query SELECT * FROM AntivirusProduct is a WMI query used to retrieve information about antivirus products installed on a Windows system.  This WMI class provides details about antivirus products installed on the system, such as the product name, version, and status.

Fig.2 WMI with AntivirusProduct 

 

 

Privilege Escalation
Malware often checks if the current user has administrative privileges to determine if it can perform privileged operations. Here is uses the specific RID 544 and other well-known RIDs (e.g., 545 for Users, 546 for Guests).

 

 

Bypass technique

The below snippet code appears to be attempting to disable or tamper with Windows' Antimalware Scan Interface (AMSI) by modifying the AmsiScanBuffer function in amsi.dll. This is a well-known technique used by malware to bypass Windows Defender and other security solutions. The strings encoded by base64.

Fig.3 disable with Windows' Antimalware Scan

 

 

 

Conclusion

From the above analysis, it appears that Windows Management Instrumentation (WMI) is widely used by malware for evasion techniques. UAC-0173 seems skillful and positive for this, Additionally, it is worth mentioning that many attack samples were written in. .net by UAC-0173.A more hidden threat around the digital world; let’s pay close attention.

 

 

IoCs

File:

Version: 1.0.7

Group: ua_nno_bm

md5 e9cedc98677b6b5146b14009ced7d624

Sha1 1b6e14e578c613932496bfd49c616760bdceb2c1

 

Network:

Host: 89[.]105[.]201[.]98

Ports: 591,4443,8080,4444,8888,8090

 

References

1.       hxxps[:]//cert.gov.ua/article/6282536

2.       hxxps[:]//bazaar.abuse.ch/user/18825/

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher