The firewall alerted the Security Operations Center that one of the machines at the Sales department, which stores all the customers' data, contacted the malicious domains over the network. When the Security Analysts looked closely, the data sent to the domains contained suspicious base64-encoded strings. The Analysts involved the Incident Response team in pulling the Process Monitor and network traffic data to determine if the host is infected. But once they got on the machine, they knew it was a ransomware attack by looking at the wallpaper and reading the ransomware note. Can you find more evidence of compromise on the host and what ransomware was involved in the attack?
Q1. Provide the two PIDs spawned from the malicious executable. (In the order as they appear in the analysis tool)
The first question can be found after uploading the Logfile.CSV and traffic.pcap files from the Analysis Files to ProcDot and selecting the Launcher button to select a process from the list. After doing so a list of processes that were active while procmon was monitoring while be shown. After looking through the list I was able tell these two PIDs (8644,7128) were spawned from the malicious executable exploreer.exe. It's safe to assume it was given this name so that it could be easily overlooked and would be confused for the actual explorer.exe.
Q2. Provide the full path where the ransomware initially got executed?(Include the full path in your answer)
Once ProcDot graphs all active processes and network activity, after looking through the data we can see the file path where exloreer.exe was initially executed. c:\users\sales\appdata\local\temp\exploreer.exe.
Q3. This ransomware transfers the information about the compromised system and the encryption results to two domains over HTTP POST. What are the two C2 domains? (no space in the answer)
To answer this question you will need to head over to the second instance of the malicious process 7128 after scrolling through the captured data, you'll find a segment where exploreer.exe is sending and receiving a stream of TCP traffic from cisco[.]com, mojobiden[.]com IP: 188.8.131.52 and, paymenthacks[.]com IP: 184.108.40.206. Based on the flow of the traffic exploreer.exe seems to be sending and receiving data from mojobiden[.]com it's safe to assume that this is how the threat actor sends commands to the malware and receives data from the victims system. Paymenthacks[.]com must be where all the data that was collected from the victims system is being sent to based on the flow of the traffic, there is only outgoing traffic being sent to that domain.
If you right click on the mojobiden server and click Follow TCP Stream you can scroll down until you come across information in red text, here you will find the User-Agent information which is Firefox/89.0.
Going back to the network traffic from question 3&4 there was data being sent to and from a Cisco server with the address 220.127.116.11. If you right click on the Cisco Server bubble you will find Cisco Umbrella being mentioned in the data. You can read more about Cisco Umbrella here.
Q8. Find the PID (Process ID) of the process which attempted to change the background wallpaper on the victim's machine.
If you follow the thread 4892 created by 7128 you will see that there is a value set in the register path HKCU\Control Panel\Desktop\Wallpaper the value is c:\programdata\ ley9kpi9r.bmp.
Q9. The ransomware mounted a drive and assigned it the letter. Provide the registry key path to the mounted drive, including the drive letter.
You can find the answer to this question by following the thread 4892 and you will see the registry path for the mounted device. HKLM\SYSTEM\MountedDevices\DosDevices\Z:.
Q10. Now you have collected some IOCs from this investigation. Provide the name of the ransomware used in the attack. (external research required)
For this question you can look up the C2 servers on threat intel sites like VirusTotal and AlienVault. On VirusTotal enter the C2 address in the VirusTotal search bar and head to the community tab. This concludes the Dunkle Materie room and I hope you enjoyed this room as much as I did. Happy Hacking! 😊