Unit42

In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto’s Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.

在这个Sherlock中，您将熟悉Sysmon日志和各种有用的EventID，用于识别和分析Windows系统上的恶意活动。Palo Alto的第四十二单元最近对UltraVNC活动进行了研究，攻击者利用UltraVNC的后门版本来维持对系统的访问。该实验室受到该活动的启发，并指导参与者完成活动的初始访问阶段。

任务列表

1、有多少个事件ID为11的事件日志？

How many Event logs are there with Event ID 11?

56

2 、每当在内存中创建进程时，都会记录事件ID为1的事件，其中包含命令行、哈希、进程路径、父进程路径等详细信息。这些信息对分析师非常有用，因为它可以让我们看到系统上执行的所有程序，这意味着我们可以发现任何正在执行的恶意进程。感染受害者系统的恶意程序是什么？

Whenever a process is created in memory, an event with Event ID 1 is recorded with details such as command line, hashes, process path, parent process path, etc. This information is very useful for an analyst because it allows us to see all programs executed on a system, which means we can spot any malicious processes being executed. What is the malicious process that infected the victim’s system?

C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe

3、哪个云驱动器被用来分发恶意软件？

Which Cloud drive was used to distribute the malware?

dropbox

4、最初的恶意文件带有时间戳（一种防御规避技术，更改文件创建日期以使其看起来旧），它在磁盘上创建了许多文件。PDF文件的时间戳更改为什么？

The initial malicious file time-stamped (a defense evasion technique, where the file creation date is changed to make it appear old) many files it created on disk. What was the timestamp changed to for a PDF file?

2024-01-14 08:10:06

5、恶意文件在磁盘上丢弃了一些文件。磁盘上的“once.cmd”是在哪里创建的？请提供完整的路径和文件名。

The malicious file dropped a few files on disk. Where was “once.cmd” created on disk? Please answer with the full path along with the filename.

C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd

6、恶意文件试图访问虚拟域，很可能是为了检查internet连接状态。它试图连接到哪个域名？

The malicious file attempted to reach a dummy domain, most likely to check the internet connection status. What domain name did it try to connect to?

www.example.com

7、恶意进程试图访问哪个IP地址？

Which IP address did the malicious process try to reach out to?

93.184.216.34

8、恶意进程在用UltraVNC的后门变体感染电脑后自行终止。这个过程是什么时候结束的？

The malicious process terminated itself after infecting the PC with a backdoored variant of UltraVNC. When did the process terminate itself?

2024-02-14 03:41:58

分析

.
├── unit42.zip
└── Microsoft-Windows-Sysmon-Operational.evtx

时间 ID 为 11 的日志表示驱动内部错误，可以通过 Windows 事件查看器进行过滤

事件 ID：11，事件数：56

过滤事件 ID：1，查看内存中创建的进程

通常情况下 pingsender.exe 是火狐浏览器的用于遥测的程序，参数对应的域名是 mozilla.org 初步判断无恶意

再搜索一下文件 Hash

安全！

第二个进程使用同样的手法，基本信息可以看到文件路径在下载目录，并且文件名结尾是两个 .exe 不像是正常公司开发的软件，那么有很大的可能是下载的恶意程序

搜索文件 Hash

发现恶意程序，因此答案为：C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe

对于分发恶意软件的云驱动器应该是指云存储

事件 ID 22 表示 DNS 解析

事件 ID：15 表示文件流创建日志，可以确定云存储使用的 dropbox 了

事件 ID：2 表示文件时间已修改，找到 pdf 文件，修改时间为 2024-01-14 08:10:06

事件 ID：11 表示文件创建，找到 once.cmd 路径：C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd

事件 ID：22 表示域名解析，找到正在尝试访问 www.example.com

事件 ID：3 表示进程网络连接信息，找到试图访问的 IP 为：93.184.216.34

事件 ID：5 表示进程退出，找到进程退出时间为： 2024-02-14 03:41:58

Hints

1. Go to “Filter Current Log” and in the Event ID field type 11. Then click “Apply.”
2. Filter events for Event ID 1. Look for any suspicious file names executing from odd directories.
3. Event ID 22 can be used to look for any DNS Queries made by the system. Do not filter for any specific event ID; start analyzing the events from the oldest available event. If you see events related to the malicious file being created, look for an Event ID 22 event surrounding that event.
4. Filter for Event ID 2. This event ID records any file creation time changes on any files on the system.
5. Filter for Event ID 11 and note the files created where the Image name is the name of the malicious file.
6. Filter for Event ID 22 and look for the image field. The process name should be the malicious file making the connection.
7. Look for Event ID 3. It records the IP address, port, and the process trying to make the connection.
8. Filter for Event ID 5 and look for the Image name, which should be the malicious process.