WEBVTT 00:02.050 --> 00:11.290 All right, so now what you're seeing on the screen is the setup steps for the Ferothy ransomware. 00:11.410 --> 00:17.090 In the first screen what you are seeing is, it's the folder with the name tools. 00:17.090 --> 00:19.970 That's where we have got most important files. 00:20.170 --> 00:25.950 So when I look at it, I've got two files in there for this proof of concept. 00:26.850 --> 00:32.650 One of the name is most important file and the second one being the sensitive passwords. 00:32.770 --> 00:37.190 So let's open one of the text files. 00:37.430 --> 00:46.670 Looking at the text file, it seems that there is some text in there for the demo purposes, but it's in plain text right now. 00:46.770 --> 00:57.870 So let's close this file and let's look at the second file, which is sensitive password files, which contains some dummy passwords in there in plain text. 00:57.870 --> 01:01.410 Okay, so I'm going to close these files now. 01:01.410 --> 01:11.370 So now you know that these are the important files on the machine, which we are going to encrypt through Ferothy. 01:11.390 --> 01:23.650 Okay, what I've got on the right is the C drive of the machine in which we are going to infect it with ransomware. 01:24.150 --> 01:29.190 And what I'm going to show here is this is the folder structure. 01:29.330 --> 01:37.550 And remember that right now we have configured our ransomware to encrypt files in the tools folder. 01:37.650 --> 01:51.290 However, this can be customized to encrypt the full folder of the complete C drive or the whole document folder or pictures or whatever you like. 01:51.450 --> 02:00.370 Okay, so let's keep it open and see how things are changing when you run the ransomware on the infected machine. 02:00.630 --> 02:17.190 The third folder I have opened here is the folder that is where all the certificates and the symmetric keys are going to get dropped and then it's going to get exfiltrated out to the attacker. 02:17.930 --> 02:23.190 In the fourth window, I have got browser open. 02:23.410 --> 02:28.070 In the first tab, I've got the Google Drive. 02:28.070 --> 02:33.870 Right now, if you look at this Google Drive, there is only one folder and a file. 02:33.870 --> 02:37.170 However, there is no other thing available here. 02:37.490 --> 02:47.730 So, for the exfiltration purposes, when you have big files, it's going to get exfiltrated to Google Drive. 02:47.730 --> 02:55.590 So, I tried it with this test MP4 file, which is 126 MB and it works perfect. 02:56.150 --> 03:10.030 So, what is going to happen is these files over here is going to get copied into the Google Drive when you run the ransomware. 03:10.350 --> 03:23.450 And remember that we have distributed our attacks infrastructure in a way that we are not relying on one service. 03:24.970 --> 03:31.000 So, the symmetric keys are going to come to poke mail. 03:32.130 --> 03:33.910 And how do you set up poke mail? 03:33.910 --> 03:36.350 I'm going to show you in a moment. 03:36.350 --> 03:46.630 But before that, let's look at what sort of USC controls we have on the infected machine. 03:46.730 --> 03:51.580 So, let's look at the USC settings. 03:51.580 --> 03:57.740 It seems that the highest level of USC is always notified. 03:58.980 --> 04:07.980 Whenever the app tries to install a software or make any changes to the computer, this is going to notify the user. 04:07.980 --> 04:11.100 So, this is currently set on always notified. 04:11.660 --> 04:23.400 Let's minimize this and look at the current certificate store, which is the local store on the box. 04:23.400 --> 04:30.420 So, the current store has got only one certificate in here. 04:30.420 --> 04:43.320 However, when the ransomware is going to get deployed, you will see one of the other certificates is going to get installed and then it's going to get removed afterwards. 04:43.780 --> 04:50.260 Once you exfiltrate and encrypt these files inside the tools folder. 04:50.480 --> 04:52.820 Let's minimize this now. 04:53.340 --> 05:02.600 So, let's set up our ransomware with the email address where you wanted to exfiltrate the keys for the certificate. 05:03.080 --> 05:07.760 Right now, I've chosen the Statue of Liberty as a location. 05:07.760 --> 05:19.880 So, I'm going to click on this and then get the geographic coordinates and I'm going to paste it in here. 05:20.080 --> 05:25.920 So, this geographic coordinates is for the Statue of Liberty. 05:25.980 --> 05:28.560 I'm going to set this as my location. 05:28.920 --> 05:41.900 So, once I set this as a location, you'll see that it has created a unique location for me and then it has generated a random looking email account for me. 05:42.280 --> 05:49.020 And then it has got one email in it as of now. 05:49.280 --> 06:02.580 So, you have to copy this email and then put it inside your ransomware file and have to make changes in the email address parameter. 06:02.580 --> 06:04.820 So, I'm going to do that now. 06:05.440 --> 06:17.640 So, I've modified the email address for one in here and the other place where you want to make changes is email one parameter over here. 06:17.660 --> 06:22.480 So, after you make those changes, save the file. 06:22.480 --> 06:27.920 So, I'm going to save this file and I'm going to minimize this for now. 06:27.920 --> 06:34.100 And I have got... I've opened a PowerShell file and I'm going to run the ransomware. 06:35.100 --> 06:40.960 To run the ransomware, all you need to do is just run one single PowerShell file. 06:41.280 --> 06:49.240 Once this is going to run, you will start seeing files going to get dropped inside the temporary folder. 06:49.540 --> 07:03.240 And then in Gmail Drive, you are going to see a zip encrypted file containing the exfiltrated data. 07:03.240 --> 07:07.020 So, I'm going to hit enter. 07:07.020 --> 07:10.960 So, it is going to create a B64 encoded certificate. 07:10.960 --> 07:13.400 This is going to be the public key. 07:13.520 --> 07:16.240 And then it's identifying... 07:17.860 --> 07:27.060 So , then it's going to install the 7-zip module onto the machine. 07:27.060 --> 07:32.800 However, let's see if this has already installed the certificate on the machine. 07:32.980 --> 07:42.060 Not as of now, but let's give it some time and then you'll see another certificate being installed in here on the machine. 07:42.360 --> 07:49.120 So, once that is done, it's going to start encrypting the files. 07:49.120 --> 07:51.920 So, right now it is zipping the files. 07:51.920 --> 07:55.720 So, if you look at this, it has already created the certificate. 07:55.720 --> 08:04.560 It is creating files and now the files are already zipped and email has been sent to an attacker on the Pokemail. 08:04.560 --> 08:11.740 So, if we go here and refresh it, you know, it has created the still.zip file. 08:11.740 --> 08:21.900 It is running some enumeration on the files on what all files the ransomware needs to encrypt. 08:22.000 --> 08:27.380 And then it's going to start uploading the files to the Google Drive. 08:27.380 --> 08:34.020 So, once it's going to upload the large files, it's going to delete it from the temporary folder. 08:35.540 --> 08:40.580 And then you'll see that it is going to start encrypting the files. 08:40.580 --> 08:50.760 If you look at here, you will see that the files have already been encrypted and we have successfully deployed ransomware onto the machine. 08:50.840 --> 09:06.340 So, once this is done, you know, it gives you a notification on the infected machine that, you know, they have been ransomed and the files are encrypted. 09:06.600 --> 09:21.920 So, you know, as of now I have put 30 seconds for the proof of concept, but then you can set this timer for, you know, however long you want, right? 09:21.920 --> 09:31.980 And so once this is going to be done, it's going to close the UI and then it's going to change the desktop of the infected machine. 09:31.980 --> 09:47.220 Right now, if you see, if you have a quick look at the folder where we had sensitive files, the files have been changed with .firoti extension. 09:47.220 --> 09:50.820 The file type is again changed with .firoti. 09:50.960 --> 10:05.060 And then once you see here, the background gets changed as well with the .firoti background. 10:05.060 --> 10:07.720 Okay, so that's been done as well. 10:08.080 --> 10:16.400 And if you look at it here, right, you have received emails containing the private key for the certificates. 10:16.400 --> 10:22.020 All the certificates is already deleted from the infected machine. 10:22.460 --> 10:37.520 And then if you try to open the tools folder again and try to access the files, you'll see that, you know, it's no longer accessible. 10:37.520 --> 10:46.680 If you open it, you know, there is just chunk characters in it and it's been encrypted with .firoti. 10:47.060 --> 10:50.560 So that's what the ransomware does. 10:51.020 --> 11:01.100 And so the next step is to actually go ahead and download the encryption keys. 11:01.100 --> 11:04.400 So I'm going to download the backup 1.zip file. 11:05.180 --> 11:11.320 And if I go back to inbox, I'm going to download the other file as well. 11:11.320 --> 11:15.460 So I'm going to copy this. 11:15.480 --> 11:20.340 I'm going to backup this as well. 11:22.780 --> 11:36.200 You know, so once downloaded, you can go to your Google Drive and you'll see that still .zip file is already in there. 11:36.200 --> 11:41.660 And if you try to open this, you'll see that you've got the same two files in there. 11:41.660 --> 11:46.000 The most important file .txt and the sensitive passwords .txt. 11:46.000 --> 11:57.260 These files were actually on the infected host in .txt format, which is now converted to .firoti. 11:57.480 --> 11:57.960 Okay. 11:57.960 --> 12:01.920 So if you try to open this, you won't be able to open this. 12:01.920 --> 12:05.240 The reason is, but however, let's download this. 12:05.760 --> 12:07.600 So it is scanning for wireless. 12:07.600 --> 12:12.500 And now once it's going to download, let's go to the download folder. 12:12.980 --> 12:14.580 Oh, it's not done already yet. 12:14.580 --> 12:20.820 So let's go to the download folder and see if we can open this. 12:20.820 --> 12:25.740 So if we can try to open this, it requires the password. 12:26.780 --> 12:34.440 And this password for these files are actually inside the poke mail, right? 12:34.440 --> 12:38.400 So and in the backup.zip file. 12:38.400 --> 12:48.920 So if you try to open the backup.zip file and look at the sys.txt file, that's the private key for the zip encrypted file, which is on the Google Drive. 12:48.920 --> 12:52.740 So, but however, it requires the password. 12:52.740 --> 13:02.500 This password is encrypted using this initialization vector over here, which is using the symmetric key, right? 13:02.500 --> 13:11.980 So this is the symmetric key for the very first file, which is sys.txt, right? 13:11.980 --> 13:18.540 So this initialization vector as an attacker, you are the only one who holds this. 13:19.100 --> 13:28.840 And since this is running inside the memory, and as you rotate your infrastructure, no one else would be able to gain access to this. 13:28.900 --> 13:34.020 So let's verify and put this as a password in there. 13:34.020 --> 13:42.480 And sure enough, this is the the password for the stolen file, right? 13:42.480 --> 13:48.920 So this is the password for the, sorry, certificates using which the files have been encrypted. 13:48.920 --> 13:55.540 So when you want to send this decryption key, this is what you're going to send it to the user. 13:55.740 --> 14:00.440 Okay, so that's how the attack works. 14:01.240 --> 14:13.460 And if you look at it, there is going to be a firoti.txt file on the desktop, such as this. 14:13.460 --> 14:20.380 And if you try to open it, it's going to give you the same note, which you saw it in your pop-up window, right? 14:20.380 --> 14:25.360 That your files have been encrypted, they're asking for 0.10 Bitcoin. 14:25.860 --> 14:33.740 If you don't pay it, they are going to, you know, release your files, sensitive files to the internet. 14:34.060 --> 14:41.100 So the same can be done with the phishing emails, right? 14:41.100 --> 14:51.900 So if we go to, let's go to Gmail and see how this attack can be done via phishing emails. 14:51.900 --> 14:57.720 So one thing I'm going to show you here is how do you bypass antivirus? 14:57.720 --> 15:00.380 Because that's not the scope of the project. 15:00.660 --> 15:16.880 We are purely looking at the ransomware and how you can create a proof of concept and make your incident response team work for it to see their behavior and identify the gaps, right? 15:16.880 --> 15:24.820 So supposing you receive emails like this with a subject line, important promotion list for 2020, right? 15:25.000 --> 15:28.000 And supposing you receive this from your 15:32.120 --> 15:38.120 colleague whose email is compromised using various other means. 15:38.120 --> 15:48.260 And since you trust that your colleague and internal email addresses, you think this is an important file to work with, okay? 15:48.260 --> 15:54.280 So once downloaded, the files look like this, okay? 15:54.280 --> 15:56.360 And this looks very legit. 15:56.360 --> 16:10.400 An attacker can generate this kind of data and use someone to, you know, download files and run it, okay? 16:10.400 --> 16:16.650 So once you have downloaded this, there is a note here saying that click on the chart to display the insights. 16:17.040 --> 16:20.860 Suddenly you'll see that, you know, the data is good. 16:20.860 --> 16:26.200 However, the issue is the chart is not getting loaded properly. 16:26.200 --> 16:32.880 So let's look at the macros and what an attacker has done in here. 16:33.860 --> 16:37.000 So the macro looks like this, okay? 16:37.000 --> 16:45.120 So it's going to download the test.patch file from the GitHub and then it's going to run the demo.patch file. 16:45.120 --> 16:51.100 It's going to save it in the temporary folder and then it's going to run it, okay? 16:51.100 --> 16:59.880 So let's see what's in the GitHub and how it's going to pull this stuff. 16:59.880 --> 17:02.140 So right now I'm in the test.patch file. 17:02.140 --> 17:04.440 This is what it is getting pulled. 17:04.740 --> 17:13.440 So once things are getting pulled, it's going to run a ransomware which can be downloaded on the machine itself, right? 17:13.440 --> 17:15.980 Like the way we are downloading this patch file. 17:16.360 --> 17:24.560 So let's try to run this and see if it is actually working. 17:24.740 --> 17:28.940 So since it says that, you know, click on the chart to display the insight. 17:28.940 --> 17:36.080 And what I've done is on click event for this chart is going to call the macro and it's going to run it. 17:36.080 --> 17:39.180 So let's see if this is working. 17:39.180 --> 17:59.980 So once I click on this, right, it has open.cmd and it's going to pull the file from the internet into the temporary directory of this machine. 17:59.980 --> 18:06.320 So let's go to tmp directory and the demo file has already been downloaded, okay? 18:06.320 --> 18:12.920 So if you look at the timing, it's 11.16 and just now the file has been downloaded. 18:12.920 --> 18:15.900 It is creating the sys.txt file. 18:16.240 --> 18:18.940 The ransomware is running in the background. 18:18.940 --> 18:25.660 You can confirm this by the way this CMD has opened. 18:25.660 --> 18:31.940 But if you don't want the CMD file to pop up, you can hide that as well. 18:32.700 --> 18:35.620 See, it is creating different files. 18:35.620 --> 18:42.460 It has created backup.zip file and it's going to perform the same attack again. 18:43.340 --> 18:57.280 And what it's going to do this time, it's going to repeat exactly the same steps on the machine but without even a user realizing that something is happening on the account, right? 18:57.280 --> 19:00.980 So if you see that still.zip file has already been created. 19:02.600 --> 19:04.780 A zip file has been created. 19:04.780 --> 19:10.640 Let's see if there is actually the certificate created on the machine. 19:10.640 --> 19:14.900 Yes, cert.csscer has been created just now. 19:15.040 --> 19:24.560 But you can verify the same stuff by actually downloading, by looking at the personal certificate store. 19:24.560 --> 19:36.380 So this store, it is going to create a self-signed certificate on the user machine even though we have a USC of always notify, right? 19:36.380 --> 19:46.960 So if you double-click on the certificate, you know that we have got a private key which is getting sent to an attacker via poke mail, okay? 19:46.960 --> 20:08.620 So once the attack is going to be successful, it's going to delete this self-signed certificate and the private key from the machine and then the user won't have a chance to encrypt their files, okay? 20:08.620 --> 20:14.820 So that's how the attack vector works even with the phishing. 20:15.800 --> 20:24.300 And let's go to our... oh, so the attack has already been finished. 20:24.300 --> 20:31.680 It is refreshing the window and that's why the windows got closed. 20:32.340 --> 20:42.200 And then when you... you can confirm this by going into the same tools folder and see if the files are encrypted already. 20:42.200 --> 20:51.180 So the files are encrypted and then the certificate is going to get deleted. 20:51.180 --> 21:00.880 So if you keep refreshing it, if you refresh it, the certificate is already deleted and that's how the attack works through phishing. 21:00.880 --> 21:05.180 And that's how the ransomware gets sprayed from one machine to the other. 21:05.340 --> 21:12.880 I hope you like this demo and you have learned something new out of it. 21:15.200 --> 21:21.700 So let's jump back to the presentation and see some mitigation strategies now. 21:21.700 --> 21:22.520 Now...