“In this very easy Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.”
In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.
DFIR - Very Easy
The only file inside the ZIP file is an .evtx file (Microsoft-Windows-Sysmon-Operational.evtx). I will be using the Windows Pwnbox for this Sherlock to use Event Viewer.
To extract the .evtx file, use 7zip and enter the password.
- How many Event logs are there with Event ID 11?
Event ID 11 is used by Sysmon to log when a file is created, which could be a good starting point in our investigation. Open the .evtx file on Event Viewer and select Filter Current Log...
Enter 11 in the selected field and the amount of File Created events will be at the top.
Answer: 56
- Whenever a process is created in memory, an event with Event ID 1 is recorded with details such as command line, hashes, process path, parent process path, etc. This information is very useful for an analyst because it allows us to see all programs executed on a system, which means we can spot any malicious processes being executed. What is the malicious process that infected the victim's system?
Let's do the same process for Event ID 1. Clicking on the events from bottom to top will allow us to see events in a chronological order. There's only 6 events with Event ID 1, so manual log reading should be OK. We encounter the following event, which is very suspicious.
This .exe file and its associated details are odd, this should be the file we are looking for.
- Which Cloud drive was used to distribute the malware?
Since this question mentions a cloud drive, the malware must have been downloaded from a reputable cloud provider onilne. Looking at DNS traffic could reveal the name of this cloud provider. Using Event ID 22 (DNS Query) should return some answers.
Knowing that the timestamp of our suspicious log is 2/14/2024 3:41:56AM, this DNS query happens right before the malware file is created (2/14/2024 3:41:26 AM). The malware must have been downloaded from that cloud provider mentioned in QueryName: Dropbox.
- For many of the files it wrote to disk, the initial malicious file used a defense evasion technique called Time Stomping, where the file creation date is changed to make it appear older and blend in with other files. What was the timestamp changed to for the PDF file?
There is a very convenient Sysmon Event ID for this specific scenario: Event ID 2 (File Creation Time Changed). Using that Event ID within Filter Current Log... and using the Find function with the pdf string will return an event log showing a PDF file that displays evidence of Time Stomping:
- The malicious file dropped a few files on disk. Where was "once.cmd" created on disk? Please answer with the full path along with the filename.
A malicious file dropping some files should count as a program creating files, which falls under Sysmon Event ID 11. Using the Find... action to find the once.cmd file reveals the full path:
- The malicious file attempted to reach a dummy domain, most likely to check the internet connection status. What domain name did it try to connect to?
Sysmon Event ID 22 (DNS Query) should display information about domain names contacted by the malicious file.
This event shows the malicious file trying to contact the highlighted domain.
- Which IP address did the malicious process try to reach out to?
Sysmon Event ID 3 (Network Connection) will be useful to display all instances of network connections being initiated by the malware. In the provided .evtx file, there is only one Network Connection event, and it belongs to the malicious process associated with the malware.
- The malicious process terminated itself after infecting the PC with a backdoored variant of UltraVNC. When did the process terminate itself?
We will use Sysmon Event ID 5 (Process Terminated) to find instances of the malicious process being terminated. Upon entering the filter, we will see a single log showing when the process was terminated:
