start	end	text
2050	9270	All right, so now what you're seeing on the screen is the setup steps for the
9270	15990	Ferothy ransomware. In the first screen what you are seeing is, it's the folder with the name
15990	23350	tools. That's where we have got most important files. So when I look at it, I've got two files
23350	29950	in there for this proof of concept. One of the name is most important file and the second one
29950	39830	being the sensitive passwords. So let's open one of the text files. Looking at the text file,
39830	46670	it seems that there is some text in there for the demo purposes, but it's in plain text right now.
46770	53230	So let's close this file and let's look at the second file, which is sensitive password files,
53910	59970	which contains some dummy passwords in there in plain text. Okay, so I'm going to close these
59970	68130	files now. So now you know that these are the important files on the machine, which we are
68130	77350	going to encrypt through Ferothy. Okay, what I've got on the right is the C drive of the
78070	83650	machine in which we are going to infect it with ransomware.
84150	91470	And what I'm going to show here is this is the folder structure. And remember that right now
91470	99250	we have configured our ransomware to encrypt files in the tools folder. However, this can be
99250	107810	customized to encrypt the full folder of the complete C drive or the whole document folder
107810	117450	or pictures or whatever you like. Okay, so let's keep it open and see how things are changing when
117450	122870	you run the ransomware on the infected machine. The third folder I have opened here is the
122870	131250	folder that is where all the certificates and the symmetric keys are going to get
131250	140450	dropped and then it's going to get exfiltrated out to the attacker. In the fourth window, I have got
141410	149430	browser open. In the first tab, I've got the Google Drive. Right now, if you look at this
149430	156030	Google Drive, there is only one folder and a file. However, there is no other thing available
156030	166490	here. So, for the exfiltration purposes, when you have big files, it's going to get exfiltrated to
166490	175590	Google Drive. So, I tried it with this test MP4 file, which is 126 MB and it works perfect.
176150	184690	So, what is going to happen is these files over here is going to get copied into
185270	193390	the Google Drive when you run the ransomware. And remember that we have distributed
193390	202590	our attacks infrastructure in a way that we are not relying on one
202590	211000	service. So, the symmetric keys are going to come to poke mail.
212130	217490	And how do you set up poke mail? I'm going to show you in a moment. But before that,
217490	228360	let's look at what sort of USC controls we have on the infected machine. So, let's look at the
229320	237740	USC settings. It seems that the highest level of USC is always notified.
238980	244200	Whenever the app tries to install a software or make any changes to the computer,
244560	251100	this is going to notify the user. So, this is currently set on always notified.
251660	260040	Let's minimize this and look at the current certificate store, which is the local store
260040	270420	on the box. So, the current store has got only one certificate in here.
270420	278620	However, when the ransomware is going to get deployed, you will see one of the other
278620	283320	certificates is going to get installed and then it's going to get removed afterwards.
283780	292820	Once you exfiltrate and encrypt these files inside the tools folder. Let's minimize this now.
293340	300300	So, let's set up our ransomware with the email address where you wanted to exfiltrate the
300300	307760	keys for the certificate. Right now, I've chosen the Statue of Liberty as a location.
307760	317760	So, I'm going to click on this and then get the geographic coordinates and I'm going to
318280	325920	paste it in here. So, this geographic coordinates is for the Statue of Liberty.
325980	333480	I'm going to set this as my location. So, once I set this as a location, you'll see that it has
333480	341900	created a unique location for me and then it has generated a random looking email account for me.
342280	354740	And then it has got one email in it as of now. So, you have to copy this email and then put it
354740	362740	inside your ransomware file and have to make changes in the email address parameter. So,
362740	373340	I'm going to do that now. So, I've modified the email address for one in here and the other
373340	379160	place where you want to make changes is email one parameter over here. So, after you make those
379160	387920	changes, save the file. So, I'm going to save this file and I'm going to minimize this for now.
387920	394100	And I have got... I've opened a PowerShell file and I'm going to run the ransomware.
395100	400960	To run the ransomware, all you need to do is just run one single PowerShell file.
401280	407740	Once this is going to run, you will start seeing files going to get dropped inside the temporary
407740	419620	folder. And then in Gmail Drive, you are going to see a zip encrypted file containing the
421200	430960	exfiltrated data. So, I'm going to hit enter. So, it is going to create a B64 encoded certificate.
430960	436240	This is going to be the public key. And then it's identifying...
437860	449220	So, then it's going to install the 7-zip module onto the machine. However, let's see if this has
449220	456100	already installed the certificate on the machine. Not as of now, but let's give it some time and
456100	463360	then you'll see another certificate being installed in here on the machine. So, once that
463360	472140	is done, it's going to start encrypting the files. So, right now it is zipping the files. So, if you
472140	479080	look at this, it has already created the certificate. It is creating files and now the files
479080	486120	are already zipped and email has been sent to an attacker on the Pokemail. So, if we go here and
486120	496440	refresh it, you know, it has created the still.zip file. It is running some enumeration on the files
496440	505780	on what all files the ransomware needs to encrypt. And then it's going to start uploading the files
505780	512560	to the Google Drive. So, once it's going to upload the large files, it's going to delete it from the
512560	521060	temporary folder. And then you'll see that it is going to start encrypting the files. If you look
521060	527940	at here, you will see that the files have already been encrypted and we have successfully deployed
528800	536040	ransomware onto the machine. So, once this is done, you know, it gives you a notification
536040	546340	on the infected machine that, you know, they have been ransomed and the files are encrypted.
546600	554060	So, you know, as of now I have put 30 seconds for the proof of concept, but then you can set this
554060	563520	timer for, you know, however long you want, right? And so once this is going to be done,
563520	571980	it's going to close the UI and then it's going to change the desktop of the infected machine.
571980	583380	Right now, if you see, if you have a quick look at the folder where we had sensitive files,
583380	589260	the files have been changed with .firoti extension. The file type is again changed
589260	599650	with .firoti. And then once you see here, the background gets changed as well with
602440	610620	the .firoti background. Okay, so that's been done as well. And if you look at it here, right,
610620	616400	you have received emails containing the private key for the certificates.
616400	626580	All the certificates is already deleted from the infected machine. And then if you try to open the
627060	637520	tools folder again and try to access the files, you'll see that, you know, it's no longer accessible.
637520	643760	If you open it, you know, there is just chunk characters in it and it's been encrypted
644720	656120	with .firoti. So that's what the ransomware does. And so the next step is to actually go ahead and
656120	664400	download the encryption keys. So I'm going to download the backup 1.zip file.
665180	675460	And if I go back to inbox, I'm going to download the other file as well. So I'm going to copy this.
675480	690240	I'm going to backup this as well. You know, so once downloaded, you can go to your
691060	698160	Google Drive and you'll see that still .zip file is already in there. And if you try to open this,
698160	704040	you'll see that you've got the same two files in there. The most important file .txt and the
704040	714740	sensitive passwords .txt. These files were actually on the infected host in .txt format,
714740	721280	which is now converted to .firoti. Okay. So if you try to open this, you won't be able to open
721280	727960	this. The reason is, but however, let's download this. So it is scanning for wireless. And now
727960	734580	once it's going to download, let's go to the download folder. Oh, it's not done already yet.
734580	743240	So let's go to the download folder and see if we can open this. So if we can try to open this,
743240	753600	it requires the password. And this password for these files are actually inside the poke mail,
753600	762580	right? So and in the backup.zip file. So if you try to open the backup.zip file and look at the
762580	768920	sys.txt file, that's the private key for the zip encrypted file, which is on the Google Drive.
768920	777780	So, but however, it requires the password. This password is encrypted using this initialization
777780	785700	vector over here, which is using the symmetric key, right? So this is the symmetric key
786800	794940	for the very first file, which is sys.txt, right? So this initialization vector as an attacker,
794940	801380	you are the only one who holds this. And since this is running inside the memory,
802200	808840	and as you rotate your infrastructure, no one else would be able to gain access to this.
808900	815740	So let's verify and put this as a password in there. And sure enough, this is the
817360	825540	the password for the stolen file, right? So this is the password for the, sorry,
825540	831420	certificates using which the files have been encrypted. So when you want to send this
831420	839380	decryption key, this is what you're going to send it to the user. Okay, so that's how the attack
839380	851640	works. And if you look at it, there is going to be a firoti.txt file on the desktop,
852340	857780	such as this. And if you try to open it, it's going to give you the same note, which you saw
857780	864280	it in your pop-up window, right? That your files have been encrypted, they're asking for 0.10
864280	871700	Bitcoin. If you don't pay it, they are going to, you know, release your files,
871700	881100	sensitive files to the internet. So the same can be done with the phishing emails, right?
881100	891900	So if we go to, let's go to Gmail and see how this attack can be done via phishing emails.
891900	898520	So one thing I'm going to show you here is how do you bypass antivirus? Because that's not the
898520	904460	scope of the project. We are purely looking at the ransomware and how you can create a proof
904460	915500	of concept and make your incident response team work for it to see their behavior and identify
915500	921160	the gaps, right? So supposing you receive emails like this with a subject line,
921160	928000	important promotion list for 2020, right? And supposing you receive this from your
932120	939380	colleague whose email is compromised using various other means. And since you trust that
939900	947680	your colleague and internal email addresses, you think this is an important file to work with,
947680	956360	okay? So once downloaded, the files look like this, okay? And this looks very legit.
956360	966440	An attacker can generate this kind of data and use someone to, you know,
967160	972520	download files and run it, okay? So once you have downloaded this,
972520	976650	there is a note here saying that click on the chart to display the insights.
977040	984440	Suddenly you'll see that, you know, the data is good. However, the issue is the chart is not
984440	992880	getting loaded properly. So let's look at the macros and what an attacker has done in here.
993860	1001340	So the macro looks like this, okay? So it's going to download the test.patch file from the GitHub
1001820	1007340	and then it's going to run the demo.patch file. It's going to save it in the temporary folder
1007340	1018700	and then it's going to run it, okay? So let's see what's in the GitHub and how it's going to pull
1018700	1024440	this stuff. So right now I'm in the test.patch file. This is what it is getting pulled.
1024740	1031540	So once things are getting pulled, it's going to run a ransomware which can be downloaded
1031540	1035980	on the machine itself, right? Like the way we are downloading this patch file.
1036360	1047160	So let's try to run this and see if it is actually working. So since it says that, you know,
1047160	1052900	click on the chart to display the insight. And what I've done is on click event for this chart
1052900	1060320	is going to call the macro and it's going to run it. So let's see if this is working. So once
1061120	1074840	I click on this, right, it has open.cmd and it's going to pull the file from the internet
1074840	1083940	into the temporary directory of this machine. So let's go to tmp directory and the demo file
1083940	1091360	has already been downloaded, okay? So if you look at the timing, it's 11.16 and just now the file
1091360	1098940	has been downloaded. It is creating the sys.txt file. The ransomware is running in the background.
1098940	1108700	You can confirm this by the way this CMD has opened. But if you don't want the CMD file to pop
1108700	1117980	up, you can hide that as well. See, it is creating different files. It has created backup.zip file
1117980	1125960	and it's going to perform the same attack again. And what it's going to do this time,
1125960	1133840	it's going to repeat exactly the same steps on the machine but without even a user realizing
1133840	1139480	that something is happening on the account, right? So if you see that still.zip file has already
1139480	1147860	been created. A zip file has been created. Let's see if there is actually the certificate
1148580	1154900	created on the machine. Yes, cert.csscer has been created just now.
1155040	1163060	But you can verify the same stuff by actually downloading, by looking at the personal
1163060	1169980	certificate store. So this store, it is going to create a self-signed certificate on the user
1169980	1178060	machine even though we have a USC of always notify, right? So if you double-click on the
1178060	1185100	certificate, you know that we have got a private key which is getting sent to an attacker via
1185100	1197680	poke mail, okay? So once the attack is going to be successful, it's going to delete this
1198480	1205880	self-signed certificate and the private key from the machine and then the user won't have a chance
1205880	1214820	to encrypt their files, okay? So that's how the attack vector works even with the phishing.
1215800	1225900	And let's go to our... oh, so the attack has already been finished. It is refreshing the
1225900	1234700	window and that's why the windows got closed. And then when you... you can confirm this by
1234700	1243640	going into the same tools folder and see if the files are encrypted already. So the files are
1243640	1253000	encrypted and then the certificate is going to get deleted. So if you keep refreshing it,
1253000	1259900	if you refresh it, the certificate is already deleted and that's how the attack works through
1259900	1265180	phishing. And that's how the ransomware gets sprayed from one machine to the other.
1265340	1272880	I hope you like this demo and you have learned something new out of it.
1275200	1281700	So let's jump back to the presentation and see some mitigation strategies now.
1281700	1282520	Now...