PS Eclipse
Use Splunk To Investigate Ransomware Activity
As a SOC analyst working for TryNotHackMe, a Managed Security Service Provider company, I have received a request from a client to investigate an issue on a device belonging to Keegan. The customer reported that the machine is functioning normally, but some files have unusual file extensions and they suspect a ransomware attack. My manager has instructed me to use Splunk to examine the events that took place on Keegan’s device on Monday, May 16th, 2022 to determine the cause of the problem.
To perform my investigation into the events on Keegan’s device, I have the option to access the Splunk instance through either the Attack Box or OpenVPN. The IP address for the Splunk instance is MACHINE_IP.
Step1: We will first connect to OpenVPN in order to access Splunk.
Step2: Then, we will click on start machine button in order to start our machine. Active machine information with Title, IP address, and time for expires will be shown. We can always add 1 hour to practice and explore more.
Step3: We will then navigate to the IP address, a separate browser window with the dashboard of Splunk interface will be shown.
Step4: So, we go to Splunk here, we select all time. And since we don’t have an index. Here for the data, we’re going to choose star indicating retrieve all of the data that has been ingested into Splunk. So, we have around 17,078 events with different source types.
Step5: So, now we have other sources, we have event logs from Windows. We’re required to find out the source of the infection, the files, and if any, we need to point down all the servers. So typically, that’s what we do when we investigate an event. So let’s see, we have some 191 interesting fields that are required by us to investigate the attack. Let’s take a look at these fields and check mark the fields that we may need.
Step6: Let’s take a look at the destination IP. So, as we can see the destination IP, we have two IP addresses hitting the most events.
Step7: Let’s take a look at destination port. We have 3 values, i.e., 443, 80 and 445. So, as you can see, we can have a clue on the activity we are investigating. Mainly we are investigating network connections here in the machine, specifically the network connections happening over protocol https, http as well. So it means the machine, the source machine we are investigating has been downloading stuff from the Internet and retrieving stuff from the Internet.
Step8: If we click on the first IP address, as we can see there, we have 206 events, and we can see there is an executable called Outstanding Gutter under the temp directory. So, this seems fishy as well. All right, so let’s go here and find the questions. The question states that the binary was downloaded. So, it has been downloaded either through port 80, 443 or 445. In port 80, we have four events. In port 443, we have 296 events. So, the way to go is we can go to 443. Here, we see a weird name, weird binary name.
Step9: We have to find more clues. So, if we scroll down we see protocol TCP not https, scrolling more, we have only this source IP image. So, in the image we have, as we can see, three paths are involved. We have the OUTSTANDING_GUTTER under Temp, we have the Windows defender, and we have one drive. Okay, now, as we can see, we have only three executables when it comes to portfolio.
Step10: If we scroll more, we can see that PowerShell was used to connect over port 80 to destination server. We just don’t know the command that was used. If we go back and write PowerShell, we have 291 events involved with PowerShell. So, if we go to command line, we see 13 command lines, and one seems a bit fishy again. So, we have PowerShell used and we have the Base 64 string.
Step11: Now, we will decode the Base64 to text in order to understand the commands.
Step12: As we can see from decoded text, after the download of the file scheduled task was created to execute the OUTSTANDING_GUTTER.exe with elevated privileges. So, create the task and run the task. Okay, so we have many things to answer here. So first, as we can see, this is the weird executable name, or the Wield executable file retrieved from the destination and the executable was scheduled to run a system using scheduled tasks. Most probably this is the ransomware, or it could be the executable that will retrieve the ransomware. Now, as we can observe, we have domain name or the destination from which the executable was downloaded after we defang the URL.
Step13: In order to answer the next question, what permissions will the suspicious binary run as? What was the command to run the binary with elevated privileges? Who was the user? The user is system, but the correct format is NT authority system followed by semicolon and the command used to run the binary. Let’s look at query name. This is interesting. If we click on query name here we get five events and let’s take a look at one of the events. So, the user has not translated query name. As we can see, it looks part of the main two servers or the domain name from which the original binary name was retrieved.
This ends with ngrok.io and it has another extension in our sub domain from which or to which the executable connected to after it has been downloaded. So, to answer the question, the suspicious binary connected to a remote server, what address does it connect to? This is the address. It becomes clear now through the query name. So to answer just do the defang on the URL.
Get Krina Patel’s stories in your inbox
Join Medium for free to get updates from this writer.
Step14: A partial script was downloaded to the same location as the suspicious binary. What was the name of the file? So basically, this file was downloaded and then it has downloaded another file. The other file is partial script. Probably the partial script is the script that actually has encrypted the files on the system. The file look is located under the temp directory. So, if we want to search for the partial script what we can do, we can make our life easier by typing “.ps” one of the extensions for the partial files. By doing that we look for all of the partial scripts in the events. So, we have around 36 events now to make things easier. So, if we go back and investigate the files, in one of the files we can see target file name, image, etc. So, as we can see, this partial script has been downloaded through PowerShell, which actually narrows down the suspicions if we investigate other files, maybe this script here. So, if we look at the message, all of the messages carry file delete archived.
Step15: What do you think was the actual name of the script? So basically, after the script here was downloaded, it was flagged as malicious. So, to find out how, let’s go back and we can grab the MD5 hash. By grabbing the MD5 hash, we can find out the real name of the script by using virustotal. We go to details and we see the names suggested for this partial script. The real name is Black Sun. That was the real name based on the hash.
Step16: So, what’s the full path to which the ransom note was saved? We want to look for a ransomware note. Look for the ransomware note. We can use .txt as the file extension because the ransomware notes are normally stored as text files. So, we look for all the text files or all the files that have the text extension. And we have three events probably we have three notes, one under the downloads, two under the temp directory.
Step17: And the last question, the script saved an image file to disk to replace the user’s desktop wallpaper, which can also serve as an indicated compromise. What’s the full path of the image? Basically, when the ransomware is downloaded to the system, they replaced the desktop background or wallpaper with a different image, we have to find out that image. So how to find out the image? We can search for image files. We start with maybe .png or .webp.
