TryHackMe Write-up | MISP Task 5 Scenario Event

CIRCL (Computer Incident Respons Center Luxembourg) published an event associated with PupyRAT infection. Your organisation is on alert for remote access trojans and malware in the wild, and you have been tasked to investigate this event and correlate the details with your SIEM. Use what you have learned from the room to identify the event and complete this task.

Answer the questions below

What event ID has been assigned to the PupyRAT event?

How to: Start at the home page of MISP, on the right side of the screen is a filter box, type into the filter box PupyRAT. Click the Filter button and give it a moment, the page for PupyRAT should load up and the Event ID will be the first entry you see. Copy and past it over in the answer box on THM. 

Answer: 1146

The event is associated with the adversary gaining ______ into organisations.

How to: Look at the tags for this event, the answer can be found in the purple tag labeled ms-caro-malware:malware-type. 

Answer: Remote Access 

Hint: What does RAT stand for?

What IP address has been mapped as the PupyRAT C2 Server

How to: Use ctrl + f, to bring up the find feature. Type into the find bar command this will bring you to the only time it is mentioned on the page. The IP address to the left of this find is the IP address of the C2 server. 

Answer: 89.107.62.39

From the Intrusion Set Galaxy, what attack group is known to use this form of attack?

How to: Scroll back up towards the top, till you see the galaxy tab (the text is blue in this area). Then look for the Intrusion Set label. The one entry under this is the answer to this question. 

Answer: Magic Hound

There is a taxonomy tag set with a Certainty level of 50. Which one is it?

How to: Go back up to the tags section, look for a liter blue background with white text and the number 50. The first part of this is the answer to this question. 

Answer: OSINT 

Hint: Check Tags

TryHackMe Write-Up | MISP Task 3 Using the System

 

For you to understand how MISP works and follow along in the task, launch the attached machine and use the credentials provided to log in to the Analyst Account on https://LAB_WEB_URL.p.thmlabs.com/. Wait 1 minute for the URL and lab to start up.

Username: Analyst@THM.thm  Password: Analyst1234&

---

Dashboard

The analyst's view of MISP provides you with the functionalities to track, share and correlate events and IOCs identified during your investigation. The dashboard's menu contains the following options, and we shall look into them further:

• Home button: Returns you to the application's start screen, the event index page or the page set as a custom home page using the star in the top bar.
• Event Actions: All the malware data entered into MISP comprises an event object described by its connected attributes. The Event actions menu gives access to all the functionality related to the creation, modification, deletion, publishing, searching and listing of events and attributes.
• Dashboard: This allows you to create a custom dashboard using widgets.
• Galaxies: Shortcut to the list of MISP Galaxies on the MISP instance. More on these on the Feeds & Taxonomies Task.
• Input Filters: Input filters alter how users enter data into this instance. Apart from the basic validation of attribute entry by type, the site administrators can define regular expression replacements and blocklists for specific values and block certain values from being exportable. Users can view these replacement and blocklist rules here, while an administrator can alter them.
• Global Actions: Access to information about MISP and this instance. You can view and edit your profile, view the manual, read the news or the terms of use again, see a list of the active organisations on this instance and a histogram of their contributions by an attribute type.
• MISP: Simple link to your baseurl.
• Name: Name (Auto-generated from Mail address) of currently logged in user.
• Envelope: Link to User Dashboard to consult some of your notifications and changes since the last visit. Like some of the proposals received for your organisation.
• Log out: The Log out button to end your session immediately.

Home Dashboard showing available events

Event Management

The Event Actions tab is where you, as an analyst, will create all malware investigation correlations by providing descriptions and attributes associated with the investigation. Splitting the process into three significant phases, we have:

• Event Creation.
• Populating events with attributes and attachments.
• Publishing.

We shall follow this process to create an event based on an investigation of Emotet Epoch 4 infection with Cobalt Strike and Spambot from malware-traffic-analysis.net. Follow along with the examples provided below.

Event Creation

In the beginning, events are a storage of general information about an incident or investigation. We add the description, time, and risk level deemed appropriate for the incident by clicking the Add Event button. Additionally, we specify the distribution level we would like our event to have on the MISP network and community. According to MISP, the following distribution options are available:

• Your organisation only: This only allows members of your organisation to see the event.
• This Community-only: Users that are part of your MISP community will be able to see the event. This includes your organisation, organisations on this MISP server and organisations running MISP servers that synchronise with this server.
• Connected communities: Users who are part of your MISP community will see the event, including all organisations on this MISP server, all organisations on MISP servers synchronising with this server, and the hosting organisations of servers that are two hops away from this one.
• All communities: This will share the event with all MISP communities, allowing the event to be freely propagated from one server to the next.

Additionally, MISP provides a means to add a sharing group, where an analyst can define a predefined list of organisations to share events.

Event details can also be populated by filling out predefined fields on a defined template, including adding attributes to the event. We can use the email details of the CobaltStrike investigation to populate details of our event. We will be using the Phishing E-mail category from the templates.

Attributes & Attachments

Attributes can be added manually or imported through other formats such as OpenIOC and ThreatConnect. To add them manually, click the Add Attribute and populate the form fields.

Some essential options to note are:

• For Intrusion Detection System: This allows the attribute to be used as an IDS signature when exporting the NIDS data unless it overrides the permitted list. If not set, the attribute is considered contextual information and not used for automatic detection.
• Batch import: If there are several attributes of the same type to enter (such as a list of IP addresses, it is possible to join them all into the same value field, separated by a line break between each line. This will allow the system to create separate lines for each attribute.

In our example below, we add an Emotet Epoch 4 C2 IP address associated with the infection as our attributes, obtained from the IOC text file.

The analyst can also add file attachments to the event. These may include malware, report files from external analysis or simply artefacts dropped by the malware. We have added the Cobalt Strike EXE binary file to our event in our example. You also have to check the Malware checkbox to mark the file as malware. This will ensure that it is zipped and passworded to protect users from accidentally downloading and executing the file.

Publish Event

Once the analysts have created events, the organisation admin will review and publish those events to add them to the pool of events. This will also share the events to the distribution channels set during the creation of the events.

Answer the questions below

How many distribution options does MISP provide to share threat information?

How to: The answer can be found in the Event Creation section above or if you have already created the event in the MISP, choose to edit event then go over to Distribution , click on it and count the number of chooses. This is your answer. 

Answer: 4

Which user has the role to publish events?

How to: The answer can be found in the Publish section above, and if you are typing it into the answer box and getting wrong you have to use the british spelling for the first word. 

Answer: organisation admin

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch Blog.

 Today we will talk about the "GoodWill" ransomware

 

Have you heard of this ransomware?  It is called "GoodWill" and it seems to aim at making you a better person.  You may be asking yourself how does it do this?  Well, I shall discuss with you how it is done.  First, your computer will need to be infected with this ransomware, this can be done like any other virus you get on your PC.  You clicked on a link you shouldn’t have, downloaded a pirated movie or game, went to that porn site, etc.  But now your computer is infected and there is only one way to get it decrypted.

 

Technically there are several "Activities" in this one way but we shall look at them one at a time.  The first "Activity" they require you to do is to cloth a roadside homeless person.  But you not only have to give them clothing, but you must also create a Facebook, Instagram, or Whatsapp story about clothing the homeless.  You must also use the photo frame they give you and encourage others to do it as well.  Once you do this then you have to send them an email with a screenshot of the post and the post link, here is my favorite part, it says and I quote "later our team will verify the whole case and promotes you for the next activity".  So then you have to wait till their team verifies what you have done, then you can move on to the next "Activity".  Let's look at the next "Activity" to see what our "GoodWill" entail.

 

The next "Activity" is to pick up 5 poor children from your neighborhood and take them out for dinner at Dominos, Pizza Hut, or KFC.  Then once again you will have to make a story post on your social media, this time though the kids have to be in the picture and have smiles on their faces.  You must again use their picture frame and take screenshots of the post, this time though you will need to take a picture of your receipt to send along with to the ransomware people.  Also again you will have to wait to have it verified before you can move on to the third and final "Activity".

 

The final "Activity", now requires you to go to your nearest hospital, and find someone that needs their care paid for because they don't have the money and pay their medical bill.  That's correct, you must go pay their medical bill, or as the ransomware states "provide them maximum part of the required amount."  You will also need to get selfies with the person you just paid their medical bill, record the whole conversation between you and them and send it back to the ransomware people.  But you’re not done yet, after you have done everything above you then need to and I quote, "Write a beautiful article on your Facebook and Instagram by sharing your wonderful experience to other people that how you transform yourself into a kind human being by becoming victim of a ransomware called Good Will".  So you not only have to do all these "goodwill" acts but at the end, you have to create a post saying that this ransomware has changed your life for the better.  Then hopefully this ransomware group with send you a decryption key that you can decrypt your files.

 

Well, I don't know about you but I don't need ransomware forcing me into performing "activities" and making me post about it on social media to create awareness about the plight of being a human.  Are these things happening, yes. Do you wish more people would help with these issues, yep.  Should you hi-jack someone’s files and force them into this position in the hope it will make them a better person in the end, nope.  Ransomware in any form no matter have "pure" your intentions are, is illegal.  The easiest way to fight against ransomware is to keep your computer up-to-date with the latest security updates and to have a good anti-virus in place.

 

I hope this has informed you about some of the newest ransomware that could not only impact your work system but even your computer at home.  If you have any questions feel free to leave a comment below.  If you have any ideas for future DR notes please let me know, and maybe it will be a future DR note.  I hope you are having a great week and Be Awesome!

 

 

 

 

Sources:

 

New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor: https://thehackernews.com/2022/05/new-goodwill-ransomware-forces-victims.html

 

Eerie GoodWill ransomware forces victims to publish videos of good deeds on social media: https://blog.malwarebytes.com/ransomware/2022/05/eerie-goodwill-ransomware-forces-victims-to-publish-videos-of-good-deeds-on-social-media/#:~:text=GoodWill%20ransomware%20functions%20like%20any,to%20recover%20your%20locked%20files.

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch.

 Today we will talk about Follina 

                What is Follina?  Follina or CVE-2022-30190 is a zero-day exploit that uses Microsoft Word documents to execute Powershell code on your computer.  In the original document, the file has other hidden files inside of it by the use of compression, it is a .rar file.  So that once the document file is executed or run, you would reach out to a website to grab an HTML file.  This file would then run automatically, it would start a hidden command prompt window.  This hidden window would shut down the msdt (Microsoft Diagnostic Tool) program, it would then go through looking for a certain file that is encoded.  It would then save that file, decode that file, bring that file to the current directory, and execute a file called rgb.exe.  At the moment the rgb.exe file is unknown, meaning the infosec community isn’t sure what this file did, but what we do know is this is a form of RCE.

                 What is RCE?  RCE stands for remote code execution, it basically means that an attacker can create a file or program which I will refer to in the rest of this as a payload.  The payload will then be transferred over to someone else’s computer via any number of ways; i.e. email, USB stick, download, etc.  Once the payload is on the target system, it will need to be executed for the RCE to take effect.  Now RCE can be a lot of things, once it’s executed it could create a shell that gives the attacker access to your machine, it could execute ransomware, could add your machine to a bot-net (a future DR note), a bitcoin miner. Suffice it to say a lot can happen to your machine if it is run.

                 Do we need to worry about Follina?  Yes and no, at the time of writing this Microsoft is saying that it will be detected by Defender (Microsoft’s anti-virus) and will be labeled as “Mesdetty” and “Mesdetty Launch”.  Now let me explain why you should and shouldn’t worry about this.  Like all modern cyber threats, you should have concern enough to keep an eye out for it, but as of right now it doesn’t seem to be much of a threat because it hasn’t been used against anyone.  Not saying it won’t be used in the future but currently, it was pointed out that at the time of writing this no one has been a victim of this attack. 

                If you want to know more about Follina or CVE-2022-30190, check out my sources at the bottom of the email.  Also if you have any questions or if you have any topics you’d like me to discuss on a future DR note, please email me and let me know.  I hope everyone has a great week and Be Awesome!

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch.

 This week we continue the series of Know thy enemy, and this week we talk about Worms.

    Worms are a strange sounding malware for a computer, but this is one of the most damaging viruses that can be on your devices.  Well, what are worms and how do they harm your devices.    Here is how Malwarebytes (a popular anti-malware software) defines worms, a computer worm is a subset of the Trojan horse malware that can propagate or self-replicate from one computer to another without human activation after breaching a system.  Basically, after you have installed the Trojan (the malware we talked about last week) and activated it, it will do its thing as it infects your system.  It will self-replicate in that it will create many of itself to not only hide in your system, and then it will send out these copies of itself to other systems connected to it.  It does this, infecting of connected systems across the internet or LAN(Local area network).  Once you are infected with the worm it can do several things other than the self-replicating, and they are; install other malware, consume bandwidth, delete files, overload networks, steal data, open a backdoor, and deplete hard drive space.  It's worth mentioning, there is a difference between a Computer worm and a worm virus.  The former doesn't need any human interaction for it to work and run itself, the latter does, you need to activate it for it to start on its journey of destroying systems. 

    There have been many types of computer worms out there, here are some of the more infamous ones that if you are curious give them a Google; Morris worm, Bagle (aka beagle, mitglieder, and lodeight), Blaster, Conficker, ILOVEYOU, mydoom, Ryuk, SQL Slammer, Storm Worm, Stuxnet, and most recently the WannaCry.  Now, the WannaCry was more of a ransomware attack, but had worm components in it to help it infect hundreds of thousands of computers over 150 countries in just a few hours.  Crazy stuff, this malware is no joke if you get infected.

    What are the symptoms of a computer worm, and how do you get rid of them?  First the former, you will notice your computer slows down, freezes, and crashes a lot.  It will also throw up error messages on a constant basis.  Some other things you could notice would be missing or corrupt files, rapidly depleting hard drive space even if are not downloading or installing anything new, and you may notice firewall breach alerts.  How do you get rid of them?  The best solution is to get a good antivirus or anti-malware (my suggestions are Malwarebytes, they have a good track record), but do not op-in to a free one as it will most likely not fix the issue you are trying to fix.  If you try and just get rid of the virus yourself you will find that it might be impossible, as several factors will come into play; the worm could be active(so the files are in use and can't be deleted), more than one worm process may be running (the act of stopping one can just have it restarted back up by another), it has hooks into registry links that make it incredible hard to pin down and delete, and finally it could have infected your back-up so that if you would try and just load a back-up of windows you will just load a back-up with the worm still infecting your system.  If you do not want to pay for anti-malware, then your only other option is to completely erase your hard drive and reinstall your operating system from scratch. 

I hope this have been a little enlightening for you on the dangers of a worm to your system and any systems connected to it.  As always, you can leave a comment below if you have any questions.  Thank you and have a great week.

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch.

This week we continue the Know thy enemy series, and we talk about Trojans.

    So what are Trojans?  Now, we are not talking about the rubber balloons that come in the square wrapper.  We are going to talk about the malicious virus's that infect your computer.  So let's define what a Trojan is, a Trojan is a virus that can infect either any form of technology, what it does is it describes itself as a legitimate piece of software or code that once on a device it can give attackers the access they need to export files, modify data, delete files, or just plain alter the contents on the device it is infecting.  They might use different types of tactics to get you to fall victim, like social engineering, spoofing or phishing.  Trojans can come packed into game downloads, software tools for your device, apps, or even software patches. 

    So how can you protect against Trojans?  The best and easiest way is to keep your security software up-to-date.  No matter what you are using, if you do not have your security software up-to-date, then you can easily fall victim.  The patches that put in these up-dates is because they found new threats, that without the patch leaves you vulnerable.  But just keeping your security software up-to-date is not enough, it takes some know-how and restraint from you.  Here are a couple of tips, firstly downloading any pirated media (music, movies, games, books, software, etc.) could potentially be Trojans.  The attacker is looking for you to be like  “Hey want to check out the new Spider-Man movie for free, just click this link it's super safe and legit”.  Secondly, you can get it from unsolicited means like scam emails or text messages that have an attachment or link to click on.  They can seem like they are coming from a familiar source, but be careful and vigilant.  Thirdly,  only access website with the beginning of HTTPS.  The S is very important because it means it is secure, and keeps you safe.  Lastly, never sign in to an account if after you clicked on something it pops open a new tab or window and asks you to sign in, if you need to sign in go to the actual website and do it.  That way you know that you are not possibly signing in to a spoof site just used to get your credentials. 

    I hope this opens your eyes to how bad Trojan virus's can be and what type of havoc they can wreck.  As always if you have any questions feel free to message me.  Thank you and have a great week.