Conti­­­­­­­

An Exchange server was compromised with ransomware. Use Splunk to investigate how the attackers compromised the server.

Scenario: Some employees from your company reported that they can’t log into Outlook. The Exchange system admin also reported that he can’t log in to the Exchange Admin Center. After initial triage, they discovered some weird readme

Task: You are assigned to investigate this situation. Use Splunk to answer the questions below regarding the Conti ransomware. files settled on the Exchange server.

To perform my investigation, I have the option to access the Splunk instance through either the Attack Box or OpenVPN. The IP address for the Splunk instance is MACHINE_IP:8000.

Get Krina Patel’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Step1: We will first connect to OpenVPN in order to access Splunk.

Step2: Then, we will click on start machine button in order to start our machine. Active machine information with Title, IP address, and time for expires will be shown. We can always add 1 hour to practice and explore more.

Step3: We will then navigate to the IP address, a separate browser window with the dashboard of splunk interface will be shown.

Step4: So, we go to Splunk here, we select all time. And since we don’t have an index. Here for the data, we’re going to choose star indicating retrieve all of the data that has been ingested into Splunk. So, we have around 17,078 events with different source types.

Step5: Okay, so now let’s see the first question. Can you identify the location of the ransomware? Okay, so the first thing we identify the data set and next we need to select a source. So, the source type for such a question is to select the Wind event log, Microsoft Windows, Sysmon/Operational. We select that and we see how many events we’ve got, its 2664.

To narrow the search even further, we specify that we’re looking for exe files. We’re looking to find directory of the ransomware so that’s also on the list. Now, some of the interesting fields which we want are CurrentDirectory, CommandLine, Image, Hashes, ParentCommandLine and ParentImage. So, we’re going to compile all of these fields, reserve the values using a table. In order to find the ransomware we have to look at directory & executable name. These would be the ideal judgment factors to find ransomware. It would be actually sometimes possible that some ransomware hides some data in the systems, but that’s unlikely to happen. So, we’re going to dedup current directory. I’m going to remove duplicate fields or duplicate values. Now, we have administrator documents, sys32, Mozilla firefox, and lastly we have this splunk. So among these directories, the only one that’s weird actually is this. So, normally when we launch the command line, yes, the parent image and the parent command line would be here, but the location of the command prompt executable would not be in the user administrator. That’s weird occurrence of this application. So, we’re going to actually answer with this question because it is the only thing that’s weird here.

Step6: What’s the system event ID for the related file curation event? We don’t need the splunk for this question. The system or event ID for file creation is 11. We can find that in the documentation of Sysmon Events.

Step7: Can you find the Md5 hash of the ransomware? So that’s why I selected to outline the hashes in the table here because I want to see the hash of all the executables.

So, we can copy MD5 hash and just use Virus Total to search this hash and as we can see, the search confirms or the results confirm the thought that this is ransomware and specifically it is Conti ransomware.

Step8: So now we are trying to find out what is the file name saved to multiple locations. So, let’s reset. Now the command go back and keep only the source type as sysmon. So, since this is a file creation event, we’re going to filter according to the file event. So, we go to event code and we highlight 11.

Okay, so as we can see, we have got several results. Of course, we’re not interested in the Clean Manager. So, we’re going to skip to the next page. We have powershell. We are looking to see if there are any files that have been saved by the CMD. We can now see, the ransomware saved several files in several locations, readme.txt in several locations, as we can see with the same image name. So that would be the answer for the question.

Step9: What was the command attacker used to add a new user to the compromised system? So again, here we’re looking to filter by events. Normally when a user is added to the system, an event is created in Windows events. We’re going to change the source type to Windows event log security.

So, we are filtering according to the EventCode. The event ID for Windows user creation, its 4720. Let’s analyze, a file creation event and the user’s name was security ninja. Now we know the account name.

So, what we’re going to do here, we’re going to copy that and switch back to the original view. And here we select back the sysmon. So, we’re going to put our security ninja to include all of the event logs captured by Sysmon and had the security ninja end up. And of course, we look also at the parent command line to see the first process that executed the command or invoked the command. So, we see we have here two instances or three instances of CMD. If you take a look at the first command, net user security ninja, hard to hack. That’s the first one. But if you also take a look at the next one, net locally group administrator, security ninja, it’s adding the user to administrator to elevate the privileges. And the last one, which actually adds the user security ninja to the remote desktop users so that security ninja or the attacker would be able to log in remotely using the RDP protocol.

Step10: Next one. The attacker migrated the process for better persistence. What’s the migrated process image and what’s the original process image? So, we have to find out what was the process used when the attacker first got into the system. And then we have to find out what was the process that were used for migration or persistence purposes. We can find the clue from the question that it asking about an event. The event is process migration. Process migration is kind of remote thread. And we can filter all the remote thread events using sysmon. So, for remote thread, the event ID is 8.

Normally a process migration contains two fields a source process and target process. A source process is the original process and the target process is the process to which the migration or to which the original process migrated. It’s telling us that powershell launched on the system and then we’re migrated to unsecapp. Unsecapp then somewhat migrated into lsass to retrieve the hashes of the users.

Step11: What’s the process image used for getting the system hashes? So, we’re going to stay with sysmon and now we’re going to filter the results to aspx. Why aspx? Because actually aspx is the shell. If we want to deploy op shell into an Exchange server, we would have to do it with aspx. That’s the extension of any web shell that would be deployed into IAS server. And we see here the full command. And you see a weird file name. So, it’s the only instance of an aspx file and it’s actually being executed by a command.

Step12: What’s the command line that executed this webshell?

Step13: What three CVEs did this exploit leverage? For this, we have to go out of the box of tryhackme and do some external research.