3CX Supply Chain - CyberDefenders Lab Writeup

A large multinational corporation heavily relies on the 3CX software for phone communication, making it a critical component of their business operations. After a recent update to the 3CX Desktop App, antivirus alerts flag sporadic instances of the software being wiped from some workstations while others remain unaffected. Dismissing this as a false positive, the IT team overlooks the alerts, only to notice degraded performance and strange network traffic to unknown servers. Employees report issues with the 3CX app, and the IT security team identifies unusual communication patterns linked to recent software updates.

As the threat intelligence analyst, it's your responsibility to examine this possible supply chain attack. Your objectives are to uncover how the attackers compromised the 3CX app, identify the potential threat actor involved, and assess the overall extent of the incident.

Easy - Threat Intel | Completion Achievement

1. Understanding the scope of the attack and identifying which versions exhibit malicious behavior is crucial for making informed decisions if these compromised versions are present in the organization. How many versions of 3CX running on Windows have been flagged as malware?

We can do some research online to find our answer:

Versions 18.12.407 and 18.12.416 are compromised.

2. Determining the age of the malware can help assess the extent of the compromise and track the evolution of malware families and variants. What's the UTC creation time of the .msi malware?

Let's read some information about this file with the file command:

However, the provided Create Time/Date field appears to be incorrect or using a different timezone. Checking the VirusTotal page with the SHA256 hash of the malware file should reveal the correct timestamp on UTC:

└─$ sha256sum 3CXDesktopApp-18.12.416.msi
59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983  3CXDesktopApp-18.12.416.msi

It seems the timestamp obtained from file was just slightly off. It's always good to check more reputable sources such as VirusTotal to find a correct answer.

3. Executable files (.exe) are frequently used as primary or secondary malware payloads, while dynamic link libraries (.dll) often load malicious code or enhance malware functionality. Analyzing files deposited by the Microsoft Software Installer (.msi) is crucial for identifying malicious files and investigating their full potential. Which malicious DLLs were dropped by the .msi file?

We can find malicious DLLs dropped by the malware through the Relations > Dropped Files pane on the VirusTotal page. We need to find DLL files with a File Type equal to Win32 DLL and a high amount of detections. After enough scrolling, we can find two relevant malicious DLL files:

ffmpeg.dll (7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896)

d3dcompiler_47.dll (11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03)

4. Recognizing the persistence techniques used in this incident is essential for current mitigation strategies and future defense improvements. What is the MITRE Technique ID employed by the .msi files to load the malicious DLL?

Based on the names of these dll files, we can assume that these files impersonate or replace legitimate system files or programs to run malicious code. After doing some online research, this is the MITRE Technique ID that follows this description:

5. Recognizing the malware type (threat category) is essential to your investigation, as it can offer valuable insight into the possible malicious actions you'll be examining. What is the threat category of the two malicious DLLs?

Going back to the VirusTotal reports of both malicious DLLs, we can see that they both fall under a certain threat category:

6. As a threat intelligence analyst conducting dynamic analysis, it's vital to understand how malware can evade detection in virtualized environments or analysis systems. This knowledge will help you effectively mitigate or address these evasive tactics. What is the MITRE ID for the virtualization/sandbox evasion techniques used by the two malicious DLLs?

We can do some online research to find the correct MITRE ID based on this question:

7. When conducting malware analysis and reverse engineering, understanding anti-analysis techniques is vital to avoid wasting time. Which hypervisor is targeted by the anti-analysis techniques in the ffmpeg.dll file?

Going back to the VirusTotal report belonging to the ffmpeg.dll, we can find our answer about the anti-analysis techniques used in the Behavior > Capabilities > Anti-Analysis section.

8. Identifying the cryptographic method used in malware is crucial for understanding the techniques employed to bypass defense mechanisms and execute its functions fully. What encryption algorithm is used by the ffmpeg.dll file?

We can find information about encryption algorithms used by the malware in the Data-Manipulation section right below Anti-Analysis:

9. As an analyst, you've recognized some TTPs involved in the incident, but identifying the APT group responsible will help you search for their usual TTPs and uncover other potential malicious activities. Which group is responsible for this attack?

We can find the threat actor responsible for this supply chain attack with the search query 3CXDesktopApp-18.12.416.msi threat actor. I found this report which mentions the name of the APT group responsible for this attack: