1
00:00:02,480 --> 00:00:03,919
okay

2
00:00:03,919 --> 00:00:06,960
welcome to uh project obsidian

3
00:00:06,960 --> 00:00:09,519
kill chain one walkthrough uh this will

4
00:00:09,519 --> 00:00:12,080
be an endpoint forensics

5
00:00:12,080 --> 00:00:14,240
walkthrough of the

6
00:00:14,240 --> 00:00:17,279
kill chain one uh attack simulation for

7
00:00:17,279 --> 00:00:18,800
project obsidian

8
00:00:18,800 --> 00:00:22,400
before we get into talking about uh the

9
00:00:22,400 --> 00:00:24,320
kill chain and the artifacts that we're

10
00:00:24,320 --> 00:00:26,240
gonna look at i'd like to give a little

11
00:00:26,240 --> 00:00:28,720
bit of background about project obsidian

12
00:00:28,720 --> 00:00:31,279
and a little bit of clarity on

13
00:00:31,279 --> 00:00:33,120
what this particular presentation will

14
00:00:33,120 --> 00:00:34,160
be

15
00:00:34,160 --> 00:00:35,920
so project obsidian

16
00:00:35,920 --> 00:00:38,239
is a project uh prior to project

17
00:00:38,239 --> 00:00:40,640
obsidian it was called uh project

18
00:00:40,640 --> 00:00:42,879
capstone it's been several years in the

19
00:00:42,879 --> 00:00:44,640
making we've been putting this

20
00:00:44,640 --> 00:00:47,200
particular the obsidian project together

21
00:00:47,200 --> 00:00:48,399
for about

22
00:00:48,399 --> 00:00:49,760
10 months

23
00:00:49,760 --> 00:00:52,160
and project obsidian is a way of

24
00:00:52,160 --> 00:00:54,559
holistically looking at

25
00:00:54,559 --> 00:00:56,480
an attack so

26
00:00:56,480 --> 00:00:57,520
the

27
00:00:57,520 --> 00:01:01,120
uh engineering team for project obsidian

28
00:01:01,120 --> 00:01:03,840
put together uh a

29
00:01:03,840 --> 00:01:07,439
company in the a a fake company

30
00:01:07,439 --> 00:01:09,280
in aws

31
00:01:09,280 --> 00:01:12,799
we staffed it with uh employees with

32
00:01:12,799 --> 00:01:15,119
with uh fake employees

33
00:01:15,119 --> 00:01:16,159
and then

34
00:01:16,159 --> 00:01:18,640
ran through an attack scenario

35
00:01:18,640 --> 00:01:22,560
the red team attacked the environment um

36
00:01:22,560 --> 00:01:24,479
and you'll see that it

37
00:01:24,479 --> 00:01:26,640
it's very it's a very close simulation

38
00:01:26,640 --> 00:01:29,200
to what an attack would look like uh and

39
00:01:29,200 --> 00:01:30,479
then

40
00:01:30,479 --> 00:01:33,119
the additional obsidian teams

41
00:01:33,119 --> 00:01:35,600
incident response forensics

42
00:01:35,600 --> 00:01:37,840
malware reverse engineering cyber threat

43
00:01:37,840 --> 00:01:39,920
intelligence and cyber threat hunting

44
00:01:39,920 --> 00:01:42,399
all looked at this environment and

45
00:01:42,399 --> 00:01:44,960
created

46
00:01:45,920 --> 00:01:48,079
education on

47
00:01:48,079 --> 00:01:50,479
how each of these teams would approach

48
00:01:50,479 --> 00:01:53,439
an attack this particular walkthrough

49
00:01:53,439 --> 00:01:54,880
that we're going to look at

50
00:01:54,880 --> 00:01:55,840
is

51
00:01:55,840 --> 00:01:58,000
endpoint forensics now the forensics

52
00:01:58,000 --> 00:01:58,880
team

53
00:01:58,880 --> 00:02:01,280
looked at

54
00:02:01,280 --> 00:02:03,840
their the sim they looked at network

55
00:02:03,840 --> 00:02:07,200
detection and also at endpoint forensics

56
00:02:07,200 --> 00:02:09,280
this is for kill chain one there were

57
00:02:09,280 --> 00:02:11,120
three kill chains kill chain one kill

58
00:02:11,120 --> 00:02:14,879
chain two and kill chain three so this

59
00:02:14,879 --> 00:02:17,360
presentation is very targeted it's the

60
00:02:17,360 --> 00:02:20,319
kill chain one endpoint forensics just

61
00:02:20,319 --> 00:02:21,840
looking at the forensics on the

62
00:02:21,840 --> 00:02:23,200
endpoints

63
00:02:23,200 --> 00:02:25,840
to do this we used velociraptor

64
00:02:25,840 --> 00:02:28,160
velociraptor is a forensics collection

65
00:02:28,160 --> 00:02:31,200
tool so we ran velociraptor on the

66
00:02:31,200 --> 00:02:32,959
machines in the environment

67
00:02:32,959 --> 00:02:35,440
and then analyzed those machines

68
00:02:35,440 --> 00:02:37,519
we built a timeline

69
00:02:37,519 --> 00:02:38,959
for the

70
00:02:38,959 --> 00:02:39,920
uh

71
00:02:39,920 --> 00:02:43,360
series of of events and attack uh

72
00:02:43,360 --> 00:02:44,959
attacks

73
00:02:44,959 --> 00:02:47,200
and then we looked at

74
00:02:47,200 --> 00:02:50,560
the artifacts um going to do a demo of

75
00:02:50,560 --> 00:02:52,000
the tools

76
00:02:52,000 --> 00:02:53,440
at the end

77
00:02:53,440 --> 00:02:56,000
but it's important to realize that this

78
00:02:56,000 --> 00:02:59,440
really isn't a presentation to do to

79
00:02:59,440 --> 00:03:01,680
look at just timelining

80
00:03:01,680 --> 00:03:04,239
in fact timelining is not the focus of

81
00:03:04,239 --> 00:03:06,080
this presentation we're going to be

82
00:03:06,080 --> 00:03:09,120
looking at the artifacts that we

83
00:03:09,120 --> 00:03:11,840
extracted how you would

84
00:03:11,840 --> 00:03:14,400
parse and analyze those artifacts and

85
00:03:14,400 --> 00:03:16,000
the conclusions that you would draw from

86
00:03:16,000 --> 00:03:16,840
them

87
00:03:16,840 --> 00:03:19,040
so getting started i want to get the

88
00:03:19,040 --> 00:03:20,640
timeline

89
00:03:20,640 --> 00:03:23,599
understood we're looking at uh

90
00:03:23,599 --> 00:03:26,720
there'll be three screens here starting

91
00:03:26,720 --> 00:03:29,440
with february 12th the attack actually

92
00:03:29,440 --> 00:03:32,000
started a little bit before this but to

93
00:03:32,000 --> 00:03:34,000
keep the scope small

94
00:03:34,000 --> 00:03:35,360
we're going to be looking at february

95
00:03:35,360 --> 00:03:37,920
12th uh first we see

96
00:03:37,920 --> 00:03:38,799
that

97
00:03:38,799 --> 00:03:41,680
uh malicious email was sent in the

98
00:03:41,680 --> 00:03:43,200
environment

99
00:03:43,200 --> 00:03:44,959
and we're looking at

100
00:03:44,959 --> 00:03:48,000
an employee called karen mutants uh who

101
00:03:48,000 --> 00:03:49,519
opened that

102
00:03:49,519 --> 00:03:51,760
email and executed the malicious

103
00:03:51,760 --> 00:03:54,640
attachment which then uh executed

104
00:03:54,640 --> 00:03:57,599
malicious powershell in the environment

105
00:03:57,599 --> 00:03:59,519
moving further into the end of the

106
00:03:59,519 --> 00:04:02,000
timeline we'll see

107
00:04:02,000 --> 00:04:05,360
that the actor once they gained

108
00:04:05,360 --> 00:04:07,840
access to the network uh or access to

109
00:04:07,840 --> 00:04:09,360
the system

110
00:04:09,360 --> 00:04:12,640
moved laterally and dropped

111
00:04:12,640 --> 00:04:17,680
additional malware on the on the machine

112
00:04:17,680 --> 00:04:20,959
finally we'll see that uh we looked at a

113
00:04:20,959 --> 00:04:23,199
number of workstations workstation one

114
00:04:23,199 --> 00:04:24,800
and workstation two are we're gonna

115
00:04:24,800 --> 00:04:26,639
cover here but we also looked at

116
00:04:26,639 --> 00:04:28,960
workstation 3 and we didn't find

117
00:04:28,960 --> 00:04:31,280
anything so it's an important point i

118
00:04:31,280 --> 00:04:32,479
wanted to highlight it in this

119
00:04:32,479 --> 00:04:34,240
presentation

120
00:04:34,240 --> 00:04:35,680
that you may

121
00:04:35,680 --> 00:04:38,800
initially suspect an endpoint you may do

122
00:04:38,800 --> 00:04:40,960
a full analysis on it and not find

123
00:04:40,960 --> 00:04:44,880
anything there and and that's okay

124
00:04:44,880 --> 00:04:48,320
so getting into the artifacts and and

125
00:04:48,320 --> 00:04:50,240
the conclusions we can draw from them

126
00:04:50,240 --> 00:04:53,680
the first thing that we find is that a

127
00:04:53,680 --> 00:04:56,880
malicious power shell uh script was

128
00:04:56,880 --> 00:04:59,199
executed in the environment we see this

129
00:04:59,199 --> 00:05:01,520
in uh powershell

130
00:05:01,520 --> 00:05:05,120
event viewer log and it jumps out at us

131
00:05:05,120 --> 00:05:08,000
because it's using this you know it's

132
00:05:08,000 --> 00:05:10,080
using a hidden

133
00:05:10,080 --> 00:05:11,280
execution

134
00:05:11,280 --> 00:05:12,080
and

135
00:05:12,080 --> 00:05:15,039
the powershell script is

136
00:05:15,039 --> 00:05:19,919
obfuscated so we're going to grab that

137
00:05:19,919 --> 00:05:21,520
data from

138
00:05:21,520 --> 00:05:22,720
this

139
00:05:22,720 --> 00:05:24,560
event blog

140
00:05:24,560 --> 00:05:27,919
and we'll throw it into

141
00:05:27,919 --> 00:05:31,120
into cyber chat cyber chef is a great

142
00:05:31,120 --> 00:05:32,080
tool

143
00:05:32,080 --> 00:05:33,240
for

144
00:05:33,240 --> 00:05:36,080
de-obfuscating and analyzing data in

145
00:05:36,080 --> 00:05:36,840
this

146
00:05:36,840 --> 00:05:39,840
case the data went through several

147
00:05:39,840 --> 00:05:42,160
iterations of the obfuscation and and

148
00:05:42,160 --> 00:05:43,520
we'll do a demo of that a little bit

149
00:05:43,520 --> 00:05:44,400
later

150
00:05:44,400 --> 00:05:45,440
uh

151
00:05:45,440 --> 00:05:46,560
where

152
00:05:46,560 --> 00:05:49,199
we finally came to the conclusion

153
00:05:49,199 --> 00:05:52,160
uh that this was in the bottom you'll

154
00:05:52,160 --> 00:05:52,880
see

155
00:05:52,880 --> 00:05:55,360
the the bottom right you'll see

156
00:05:55,360 --> 00:05:56,720
the

157
00:05:56,720 --> 00:05:59,120
actual

158
00:05:59,120 --> 00:06:00,240
uh

159
00:06:00,240 --> 00:06:03,840
c2 server where malware was downloaded

160
00:06:03,840 --> 00:06:07,600
from that is malwarelove.xyz

161
00:06:07,600 --> 00:06:11,600
and if we do an nslookup on that domain

162
00:06:11,600 --> 00:06:15,360
it resolves to 3.13219216.

163
00:06:15,360 --> 00:06:17,680
now why is this important and why is

164
00:06:17,680 --> 00:06:18,960
this one of the first steps we're going

165
00:06:18,960 --> 00:06:20,639
to do

166
00:06:20,639 --> 00:06:23,600
well that's because now we have

167
00:06:23,600 --> 00:06:26,240
at least some indication

168
00:06:26,240 --> 00:06:27,199
of the

169
00:06:27,199 --> 00:06:29,919
attacker's activity we can now take

170
00:06:29,919 --> 00:06:32,400
these indicators of compromise we can

171
00:06:32,400 --> 00:06:35,039
scan our entire environment for these

172
00:06:35,039 --> 00:06:38,240
indicators we can add them to

173
00:06:38,240 --> 00:06:42,080
our ids systems we can add them to our

174
00:06:42,080 --> 00:06:45,039
endpoint detection systems and we can

175
00:06:45,039 --> 00:06:49,199
monitor not only to see if there's

176
00:06:49,199 --> 00:06:51,280
been further activity in the environment

177
00:06:51,280 --> 00:06:54,720
but we can alert uh if this actor moves

178
00:06:54,720 --> 00:06:57,360
anywhere else in the environment so this

179
00:06:57,360 --> 00:06:59,759
is a very important first step when we

180
00:06:59,759 --> 00:07:00,960
are

181
00:07:00,960 --> 00:07:02,960
looking at

182
00:07:02,960 --> 00:07:05,440
an endpoint and discovering what

183
00:07:05,440 --> 00:07:07,280
happened on that endpoint

184
00:07:07,280 --> 00:07:08,479
the next thing we're going to look at

185
00:07:08,479 --> 00:07:12,800
here is the malicious email itself so

186
00:07:12,800 --> 00:07:15,039
at this point we've learned

187
00:07:15,039 --> 00:07:18,160
from the incident response folks that a

188
00:07:18,160 --> 00:07:20,400
malicious email was sent to several

189
00:07:20,400 --> 00:07:23,120
people in the environment

190
00:07:23,120 --> 00:07:24,160
that

191
00:07:24,160 --> 00:07:27,440
email had an attachment which we can see

192
00:07:27,440 --> 00:07:30,560
is a base64 encoded by attachment

193
00:07:30,560 --> 00:07:33,199
attachment we can also throw that into

194
00:07:33,199 --> 00:07:35,120
cyberchef

195
00:07:35,120 --> 00:07:39,039
and decode that and save it this will be

196
00:07:39,039 --> 00:07:40,400
our malicious

197
00:07:40,400 --> 00:07:42,880
document that we can send to the malware

198
00:07:42,880 --> 00:07:45,199
reverse engineering folks and they can

199
00:07:45,199 --> 00:07:47,520
tell us more about what this document

200
00:07:47,520 --> 00:07:49,120
does and

201
00:07:49,120 --> 00:07:52,560
maybe produce more iocs from it

202
00:07:52,560 --> 00:07:54,240
the next thing that we're going to find

203
00:07:54,240 --> 00:07:57,680
in the environment is that

204
00:07:57,680 --> 00:07:58,960
the

205
00:07:58,960 --> 00:08:01,759
uh the person that received this email

206
00:08:01,759 --> 00:08:02,720
uh

207
00:08:02,720 --> 00:08:06,720
also enabled macros and uh we see this

208
00:08:06,720 --> 00:08:11,759
in their registry uh this is a sysmon uh

209
00:08:11,759 --> 00:08:14,720
a sysmon log entry showing this but if

210
00:08:14,720 --> 00:08:17,919
you looked in the user's uh

211
00:08:17,919 --> 00:08:19,280
uh

212
00:08:19,280 --> 00:08:21,599
registry you would see

213
00:08:21,599 --> 00:08:24,720
that they had enabled macros uh this is

214
00:08:24,720 --> 00:08:27,599
another look at it and uh i'm i bring

215
00:08:27,599 --> 00:08:30,240
this up because what we're gonna do is

216
00:08:30,240 --> 00:08:32,399
we're gonna take a lot of this data and

217
00:08:32,399 --> 00:08:34,240
put it into

218
00:08:34,240 --> 00:08:37,440
an easy to read format we use a couple

219
00:08:37,440 --> 00:08:38,799
of tools for that

220
00:08:38,799 --> 00:08:40,799
chainsaw is the tool that we're going to

221
00:08:40,799 --> 00:08:41,599
run

222
00:08:41,599 --> 00:08:44,399
to look at the event viewer logs

223
00:08:44,399 --> 00:08:46,240
chainsaw uses

224
00:08:46,240 --> 00:08:48,959
sigma rules and it will present what it

225
00:08:48,959 --> 00:08:52,800
finds in the event logs that are you

226
00:08:52,800 --> 00:08:54,800
know worth investigating

227
00:08:54,800 --> 00:08:56,880
we take that data

228
00:08:56,880 --> 00:08:59,360
which come which can be produced in

229
00:08:59,360 --> 00:09:02,399
comma separated values we take that data

230
00:09:02,399 --> 00:09:04,160
and we throw it into

231
00:09:04,160 --> 00:09:07,839
a reporting tool called ach report and

232
00:09:07,839 --> 00:09:10,800
that gives us kind of a nice view

233
00:09:10,800 --> 00:09:13,760
a little bit easier to look at than just

234
00:09:13,760 --> 00:09:17,839
uh all the data loaded up into excel

235
00:09:17,839 --> 00:09:18,959
the next thing we find in the

236
00:09:18,959 --> 00:09:20,880
environment is since we've run

237
00:09:20,880 --> 00:09:23,760
velociraptor and gathered all of this

238
00:09:23,760 --> 00:09:25,200
evidence

239
00:09:25,200 --> 00:09:27,440
velociraptor collected

240
00:09:27,440 --> 00:09:29,360
the network connections and enhanced

241
00:09:29,360 --> 00:09:32,480
them so we see that there was indeed a

242
00:09:32,480 --> 00:09:34,959
power shell execution

243
00:09:34,959 --> 00:09:37,440
we identified that it was process id

244
00:09:37,440 --> 00:09:39,040
7036

245
00:09:39,040 --> 00:09:43,240
um endpoint 172.16.50.131

246
00:09:44,000 --> 00:09:45,760
reaching out to

247
00:09:45,760 --> 00:09:46,959
our

248
00:09:46,959 --> 00:09:50,880
c2 server 3.13219

249
00:09:50,880 --> 00:09:54,080
and we can corroborate that by looking

250
00:09:54,080 --> 00:09:56,560
at the memory itself so one of the other

251
00:09:56,560 --> 00:09:58,000
things we did

252
00:09:58,000 --> 00:10:00,640
when we collected this endpoint was we

253
00:10:00,640 --> 00:10:02,320
collected a

254
00:10:02,320 --> 00:10:04,959
snapshot of the memory and then running

255
00:10:04,959 --> 00:10:07,600
volatility against that memory

256
00:10:07,600 --> 00:10:10,160
collection we can see

257
00:10:10,160 --> 00:10:13,120
not only that velociraptor found this

258
00:10:13,120 --> 00:10:14,880
network connection but we can actually

259
00:10:14,880 --> 00:10:17,040
see it in memory

260
00:10:17,040 --> 00:10:18,240
the next thing we're going to look at

261
00:10:18,240 --> 00:10:20,079
since we now know

262
00:10:20,079 --> 00:10:21,600
that uh

263
00:10:21,600 --> 00:10:24,320
process id 7036

264
00:10:24,320 --> 00:10:25,279
is

265
00:10:25,279 --> 00:10:28,160
one of our attackers processes

266
00:10:28,160 --> 00:10:29,839
we can look at the command line right so

267
00:10:29,839 --> 00:10:32,000
we're going to use volatility and we're

268
00:10:32,000 --> 00:10:34,240
going to list out all the command lines

269
00:10:34,240 --> 00:10:36,880
that we'll run on this machine and

270
00:10:36,880 --> 00:10:40,720
and filter it by process id 7036 and

271
00:10:40,720 --> 00:10:44,839
sure enough we find process id 7036 was

272
00:10:44,839 --> 00:10:47,519
powershell and it has

273
00:10:47,519 --> 00:10:50,000
this you know clearly

274
00:10:50,000 --> 00:10:52,320
malicious uh

275
00:10:52,320 --> 00:10:54,000
powershell script that was run

276
00:10:54,000 --> 00:10:56,079
obfuscated we can then take that we

277
00:10:56,079 --> 00:10:58,640
won't actually do that here but i'll

278
00:10:58,640 --> 00:11:01,760
leave that for the exercise of uh

279
00:11:01,760 --> 00:11:04,399
of the the watcher

280
00:11:04,399 --> 00:11:05,600
to

281
00:11:05,600 --> 00:11:08,959
to extract this data throw it into uh

282
00:11:08,959 --> 00:11:12,880
cyber chef and decode it

283
00:11:13,040 --> 00:11:14,480
one of the additional things that we're

284
00:11:14,480 --> 00:11:15,839
going to do when we're looking in the

285
00:11:15,839 --> 00:11:18,079
environment is we're going to ask some

286
00:11:18,079 --> 00:11:20,640
common questions right and in this case

287
00:11:20,640 --> 00:11:22,640
we ask the common question

288
00:11:22,640 --> 00:11:25,200
hey are there any executables in temp

289
00:11:25,200 --> 00:11:26,800
directories it's a common thing that

290
00:11:26,800 --> 00:11:29,519
attackers do and in this environment we

291
00:11:29,519 --> 00:11:33,600
find uh you know a a gold mine of of

292
00:11:33,600 --> 00:11:36,720
attacker activity we find a metasploit

293
00:11:36,720 --> 00:11:39,760
uh a covenant uh which is a post

294
00:11:39,760 --> 00:11:42,720
exploitation framework a covenant agent

295
00:11:42,720 --> 00:11:46,640
and pink castle which is a tool used to

296
00:11:46,640 --> 00:11:50,000
look at active directory

297
00:11:50,560 --> 00:11:51,920
the next thing we're going to see since

298
00:11:51,920 --> 00:11:53,760
we know from this screen that

299
00:11:53,760 --> 00:11:55,440
cleanup.exe

300
00:11:55,440 --> 00:11:57,760
is is malicious we're going to look and

301
00:11:57,760 --> 00:11:58,800
see

302
00:11:58,800 --> 00:12:02,079
do we find any evidence of persistence

303
00:12:02,079 --> 00:12:04,000
and of course in

304
00:12:04,000 --> 00:12:08,000
our telemetry using the velociraptor

305
00:12:08,000 --> 00:12:10,399
auto runs

306
00:12:10,399 --> 00:12:13,440
artifact we see that sure enough

307
00:12:13,440 --> 00:12:16,480
a sched a task was scheduled

308
00:12:16,480 --> 00:12:18,720
running cleanup.exe

309
00:12:18,720 --> 00:12:20,880
and

310
00:12:20,880 --> 00:12:25,120
in a task called daily magnum tempus i.t

311
00:12:25,120 --> 00:12:27,600
cleanup

312
00:12:28,000 --> 00:12:30,720
additionally looking through the data

313
00:12:30,720 --> 00:12:34,079
we see evidence of enumeration

314
00:12:34,079 --> 00:12:37,200
in the environment and

315
00:12:37,200 --> 00:12:39,760
and for for lateral movement right so

316
00:12:39,760 --> 00:12:43,360
this is coming from the sysmond data uh

317
00:12:43,360 --> 00:12:46,079
extracted sysmon data you see the event

318
00:12:46,079 --> 00:12:49,279
ideas one this comes from running

319
00:12:49,279 --> 00:12:52,320
chainsaw against the event logs and then

320
00:12:52,320 --> 00:12:55,120
taking that chainsaw data and displaying

321
00:12:55,120 --> 00:12:57,200
it in in a in a format that's a little

322
00:12:57,200 --> 00:13:00,000
bit easier to read

323
00:13:00,000 --> 00:13:02,480
so now that we've got a pretty good idea

324
00:13:02,480 --> 00:13:04,800
of the kinds of data that we're

325
00:13:04,800 --> 00:13:06,560
we're going to see in this environment

326
00:13:06,560 --> 00:13:08,560
i'd like to walk through

327
00:13:08,560 --> 00:13:11,519
a short demonstration of some of the

328
00:13:11,519 --> 00:13:12,720
actual

329
00:13:12,720 --> 00:13:13,760
tools

330
00:13:13,760 --> 00:13:18,000
that uh that we use to do this

331
00:13:18,000 --> 00:13:20,399
so here we see as you

332
00:13:20,399 --> 00:13:24,160
we saw earlier uh cybershaft right and

333
00:13:24,160 --> 00:13:28,160
from cyber chef what we're gonna do here

334
00:13:28,160 --> 00:13:28,959
is

335
00:13:28,959 --> 00:13:30,800
look at

336
00:13:30,800 --> 00:13:32,959
this powershell event log right and i've

337
00:13:32,959 --> 00:13:34,399
highlighted here

338
00:13:34,399 --> 00:13:36,639
i'm going to grab

339
00:13:36,639 --> 00:13:39,120
i'm going to copy this data from the

340
00:13:39,120 --> 00:13:41,279
powershell event log

341
00:13:41,279 --> 00:13:45,399
and i'll put it into cybershelf

342
00:13:49,519 --> 00:13:52,240
and i've already loaded the recipe up

343
00:13:52,240 --> 00:13:54,399
and we're going to make all of this data

344
00:13:54,399 --> 00:13:56,639
available including the recipe but i've

345
00:13:56,639 --> 00:13:59,279
already loaded the recipe up rather than

346
00:13:59,279 --> 00:14:00,959
then walk through

347
00:14:00,959 --> 00:14:03,279
you know each piece of the recipe i'm

348
00:14:03,279 --> 00:14:04,880
just going to turn

349
00:14:04,880 --> 00:14:07,360
the different pieces on to show you how

350
00:14:07,360 --> 00:14:09,760
we would decode this

351
00:14:09,760 --> 00:14:12,000
and you can take time in your

352
00:14:12,000 --> 00:14:14,720
environment to do the same thing but

353
00:14:14,720 --> 00:14:16,079
first thing that we see this is

354
00:14:16,079 --> 00:14:19,199
obviously base64 encoded so we're going

355
00:14:19,199 --> 00:14:20,000
to

356
00:14:20,000 --> 00:14:23,440
base64 decode it and and looking at the

357
00:14:23,440 --> 00:14:26,480
output we see that it is

358
00:14:26,480 --> 00:14:29,440
uh unicode right so let's remove

359
00:14:29,440 --> 00:14:31,680
the null bytes the unicode null bytes

360
00:14:31,680 --> 00:14:35,360
get a nice better picture and within

361
00:14:35,360 --> 00:14:37,040
this

362
00:14:37,040 --> 00:14:38,480
decoded

363
00:14:38,480 --> 00:14:41,839
data we see there is more base64

364
00:14:41,839 --> 00:14:45,360
decoding but it's in the middle of the

365
00:14:45,360 --> 00:14:49,440
execution so we want to extract out

366
00:14:49,440 --> 00:14:50,399
the

367
00:14:50,399 --> 00:14:53,040
just the base64 so we're going to use a

368
00:14:53,040 --> 00:14:55,199
regular expression

369
00:14:55,199 --> 00:14:58,480
that extracts out just the base64 data

370
00:14:58,480 --> 00:14:59,680
now

371
00:14:59,680 --> 00:15:02,320
after we've done that we can now base64

372
00:15:02,320 --> 00:15:04,000
decode it again

373
00:15:04,000 --> 00:15:08,240
and we're going to see what looks like

374
00:15:08,240 --> 00:15:10,720
an archive of some sort right we're

375
00:15:10,720 --> 00:15:14,079
going to inflate that archive right it's

376
00:15:14,079 --> 00:15:16,719
it's uh

377
00:15:16,800 --> 00:15:18,560
uh it's uh

378
00:15:18,560 --> 00:15:19,680
um

379
00:15:19,680 --> 00:15:22,240
i think uh zip encoded i'm not entirely

380
00:15:22,240 --> 00:15:23,680
sure which encoding

381
00:15:23,680 --> 00:15:26,639
uh but again we're going to see more

382
00:15:26,639 --> 00:15:28,720
obfuscation right so this is common

383
00:15:28,720 --> 00:15:30,079
you're going to see obfuscation with an

384
00:15:30,079 --> 00:15:32,160
obvious station obviously

385
00:15:32,160 --> 00:15:34,240
so the first thing we do to make this

386
00:15:34,240 --> 00:15:36,399
easier to read is remove

387
00:15:36,399 --> 00:15:38,880
all of the spaces right

388
00:15:38,880 --> 00:15:41,199
after we've removed the spaces we can

389
00:15:41,199 --> 00:15:43,759
then use another regular expression

390
00:15:43,759 --> 00:15:46,639
to extract out just

391
00:15:46,639 --> 00:15:48,320
the data that we're looking for and

392
00:15:48,320 --> 00:15:50,720
remove all of the

393
00:15:50,720 --> 00:15:53,279
all of the execution piece right so

394
00:15:53,279 --> 00:15:55,680
another regular expression

395
00:15:55,680 --> 00:15:57,600
now we've got

396
00:15:57,600 --> 00:16:00,560
the data in decimal

397
00:16:00,560 --> 00:16:04,399
so we're going to take that decimal

398
00:16:04,399 --> 00:16:06,480
and turn it into

399
00:16:06,480 --> 00:16:09,920
uh ascii right now that it's in ascii

400
00:16:09,920 --> 00:16:11,440
you we can see that it's further

401
00:16:11,440 --> 00:16:15,040
obfuscated with these plus signs right

402
00:16:15,040 --> 00:16:16,720
uh further

403
00:16:16,720 --> 00:16:17,920
uh

404
00:16:17,920 --> 00:16:20,880
activity by the attacker to hide so

405
00:16:20,880 --> 00:16:23,519
let's get rid of the plus signs

406
00:16:23,519 --> 00:16:26,639
and we get now a better picture of what

407
00:16:26,639 --> 00:16:29,199
the actual malware looks like and we'll

408
00:16:29,199 --> 00:16:32,160
run the beautifier and we see what we

409
00:16:32,160 --> 00:16:34,480
had seen in our earlier slide

410
00:16:34,480 --> 00:16:35,360
of

411
00:16:35,360 --> 00:16:36,560
this

412
00:16:36,560 --> 00:16:40,160
code reaching out to its c2 server to

413
00:16:40,160 --> 00:16:41,360
download

414
00:16:41,360 --> 00:16:43,839
malware

415
00:16:43,920 --> 00:16:46,240
the next thing we're going to look at

416
00:16:46,240 --> 00:16:47,360
is

417
00:16:47,360 --> 00:16:50,680
the actual

418
00:16:51,839 --> 00:16:54,720
email that was sent

419
00:16:54,720 --> 00:16:56,720
to

420
00:16:56,720 --> 00:16:58,880
amanda nunces

421
00:16:58,880 --> 00:16:59,680
and

422
00:16:59,680 --> 00:17:02,480
there's really not a lot to learn here

423
00:17:02,480 --> 00:17:05,679
other than we can see in the base64

424
00:17:05,679 --> 00:17:07,119
encoding

425
00:17:07,119 --> 00:17:09,280
the attachment

426
00:17:09,280 --> 00:17:11,679
and we can then copy and paste that

427
00:17:11,679 --> 00:17:14,160
again into cybershot uh which i'm not

428
00:17:14,160 --> 00:17:16,160
going to do but we could copy and paste

429
00:17:16,160 --> 00:17:17,199
that into

430
00:17:17,199 --> 00:17:18,640
chef

431
00:17:18,640 --> 00:17:20,959
and and that provide

432
00:17:20,959 --> 00:17:24,160
that maldoc to our reverse engineers

433
00:17:24,160 --> 00:17:26,799
the next thing i'd like to do is look at

434
00:17:26,799 --> 00:17:28,799
some of the other things that we talked

435
00:17:28,799 --> 00:17:31,440
about right so one of the things we

436
00:17:31,440 --> 00:17:33,280
talked about

437
00:17:33,280 --> 00:17:35,520
is on workstation one

438
00:17:35,520 --> 00:17:39,520
that the trust records now this is

439
00:17:39,520 --> 00:17:42,640
something called ach report it's simply

440
00:17:42,640 --> 00:17:46,400
a tool that runs a lot of other tools

441
00:17:46,400 --> 00:17:50,000
and then presents the data in a common

442
00:17:50,000 --> 00:17:52,240
easy to read format

443
00:17:52,240 --> 00:17:53,440
so

444
00:17:53,440 --> 00:17:55,120
this makes it a little bit easier for me

445
00:17:55,120 --> 00:17:56,640
to present the data

446
00:17:56,640 --> 00:17:59,200
this tool doesn't do the extraction it's

447
00:17:59,200 --> 00:18:02,000
really just a reporting tool so we're

448
00:18:02,000 --> 00:18:03,280
going to look

449
00:18:03,280 --> 00:18:06,720
at the enablement

450
00:18:10,320 --> 00:18:12,559
of trust record the enable of the

451
00:18:12,559 --> 00:18:15,280
enablement of macros

452
00:18:15,280 --> 00:18:16,240
on

453
00:18:16,240 --> 00:18:19,520
workstation one and again what we see is

454
00:18:19,520 --> 00:18:21,760
that this is actually

455
00:18:21,760 --> 00:18:24,880
chainsaw output when we run chainsaw

456
00:18:24,880 --> 00:18:29,840
against our event logs we see that

457
00:18:30,799 --> 00:18:33,600
that chainsaw detected

458
00:18:33,600 --> 00:18:36,159
that this

459
00:18:36,640 --> 00:18:39,120
registry key was changed

460
00:18:39,120 --> 00:18:39,919
and

461
00:18:39,919 --> 00:18:42,480
it flags it as a windows registry trust

462
00:18:42,480 --> 00:18:45,679
record modification so again important

463
00:18:45,679 --> 00:18:48,160
to remember the tools here uh you're

464
00:18:48,160 --> 00:18:50,880
extracting the event logs

465
00:18:50,880 --> 00:18:53,520
we're running chainsaw against them and

466
00:18:53,520 --> 00:18:55,520
then we're just presenting that data in

467
00:18:55,520 --> 00:18:58,720
a little bit easier to view format

468
00:18:58,720 --> 00:19:00,559
on workstation 2

469
00:19:00,559 --> 00:19:02,240
a couple of things we're also going to

470
00:19:02,240 --> 00:19:03,840
look at again

471
00:19:03,840 --> 00:19:06,080
this is just looking at

472
00:19:06,080 --> 00:19:07,760
some of the data we've already presented

473
00:19:07,760 --> 00:19:09,919
but i wanted to show it from the

474
00:19:09,919 --> 00:19:12,880
perspective of using the tooling

475
00:19:12,880 --> 00:19:16,480
we're going to look at

476
00:19:16,960 --> 00:19:21,960
files that ran out of temp directories

477
00:19:24,880 --> 00:19:28,080
so in this case what we see what we have

478
00:19:28,080 --> 00:19:29,840
here is

479
00:19:29,840 --> 00:19:33,039
this tool ach report

480
00:19:33,039 --> 00:19:35,200
took the master file table we've

481
00:19:35,200 --> 00:19:38,160
extracted the master file table from

482
00:19:38,160 --> 00:19:40,640
this endpoint we ran it through a

483
00:19:40,640 --> 00:19:43,520
program called mft dump

484
00:19:43,520 --> 00:19:44,320
that

485
00:19:44,320 --> 00:19:46,799
that program mft dump

486
00:19:46,799 --> 00:19:49,200
takes the master file table

487
00:19:49,200 --> 00:19:50,960
and and

488
00:19:50,960 --> 00:19:54,400
parses it into comma separated values

489
00:19:54,400 --> 00:19:57,440
then what we did was we simply searched

490
00:19:57,440 --> 00:20:01,440
in that comma separated file and asked

491
00:20:01,440 --> 00:20:03,840
are there any files that are run out of

492
00:20:03,840 --> 00:20:05,280
temp directories

493
00:20:05,280 --> 00:20:07,200
and this is a common question that we

494
00:20:07,200 --> 00:20:08,000
ask

495
00:20:08,000 --> 00:20:08,880
and

496
00:20:08,880 --> 00:20:10,000
we see

497
00:20:10,000 --> 00:20:12,080
again interpreter

498
00:20:12,080 --> 00:20:13,200
cleanup

499
00:20:13,200 --> 00:20:17,520
and p.exe right these three

500
00:20:17,520 --> 00:20:19,600
indications of

501
00:20:19,600 --> 00:20:22,400
matthews these three pieces of malware

502
00:20:22,400 --> 00:20:24,320
right and in particular

503
00:20:24,320 --> 00:20:28,240
we noticed cleanup the post exploitation

504
00:20:28,240 --> 00:20:29,600
tool

505
00:20:29,600 --> 00:20:31,919
we're going to look at cleanup look for

506
00:20:31,919 --> 00:20:35,720
occurrences of cleanup

507
00:20:36,000 --> 00:20:38,880
and again we see the same thing we saw

508
00:20:38,880 --> 00:20:40,000
earlier

509
00:20:40,000 --> 00:20:42,240
in the presentation

510
00:20:42,240 --> 00:20:46,320
that cleanup was added as a task

511
00:20:46,320 --> 00:20:49,600
for persistence uh the last thing we're

512
00:20:49,600 --> 00:20:52,080
going to look at in the environment

513
00:20:52,080 --> 00:20:53,280
is

514
00:20:53,280 --> 00:20:53,700
the

515
00:20:53,700 --> 00:20:55,039
[Music]

516
00:20:55,039 --> 00:20:56,799
lateral movement

517
00:20:56,799 --> 00:20:58,080
and

518
00:20:58,080 --> 00:21:00,159
i'm just going to choose

519
00:21:00,159 --> 00:21:02,400
local group uh

520
00:21:02,400 --> 00:21:04,960
you can search for a number of things

521
00:21:04,960 --> 00:21:08,240
but here we're seeing

522
00:21:08,240 --> 00:21:11,440
that sysmon identified

523
00:21:11,440 --> 00:21:13,200
process id one

524
00:21:13,200 --> 00:21:14,720
of

525
00:21:14,720 --> 00:21:18,159
the actor running who am i

526
00:21:18,159 --> 00:21:20,720
running net.exe to enumerate the

527
00:21:20,720 --> 00:21:22,159
administrators

528
00:21:22,159 --> 00:21:25,280
uh looking at uh

529
00:21:25,280 --> 00:21:29,440
at the domain settings um and so

530
00:21:29,440 --> 00:21:30,960
this is again

531
00:21:30,960 --> 00:21:32,559
uh from

532
00:21:32,559 --> 00:21:36,080
the sysmon logs but this is chainsaw

533
00:21:36,080 --> 00:21:38,240
chainsaw has

534
00:21:38,240 --> 00:21:39,440
has

535
00:21:39,440 --> 00:21:43,039
we've pointed chainsaw at the event logs

536
00:21:43,039 --> 00:21:46,880
and chainsaw identified this activity as

537
00:21:46,880 --> 00:21:48,559
net.exe

538
00:21:48,559 --> 00:21:51,200
execution

539
00:21:52,720 --> 00:21:54,960
okay

540
00:21:55,120 --> 00:21:59,158
going back to our presentation

541
00:22:01,039 --> 00:22:03,440
wrapping it up

542
00:22:03,440 --> 00:22:06,799
here is a list of the tools that we used

543
00:22:06,799 --> 00:22:09,760
to do this

544
00:22:09,760 --> 00:22:11,440
investigation

545
00:22:11,440 --> 00:22:14,240
velociraptor to gather the data with

546
00:22:14,240 --> 00:22:17,760
pmem to collect the memory volatility to

547
00:22:17,760 --> 00:22:18,170
view

548
00:22:18,170 --> 00:22:19,280
[Music]

549
00:22:19,280 --> 00:22:21,200
the data

550
00:22:21,200 --> 00:22:22,960
and

551
00:22:22,960 --> 00:22:25,200
cyber chef sysmon

552
00:22:25,200 --> 00:22:26,400
auto runs

553
00:22:26,400 --> 00:22:30,159
mft dump chainsaw and ach report and

554
00:22:30,159 --> 00:22:33,600
before i before i end the presentation

555
00:22:33,600 --> 00:22:37,039
um let's go back a second and look at

556
00:22:37,039 --> 00:22:40,080
that memory right

557
00:22:40,080 --> 00:22:42,240
one thing i did not demo that i think is

558
00:22:42,240 --> 00:22:45,960
is worth seeing

559
00:22:55,280 --> 00:22:59,120
and i've just created a very small

560
00:22:59,120 --> 00:23:01,840
batch file

561
00:23:01,840 --> 00:23:03,760
to show volatility running right the

562
00:23:03,760 --> 00:23:05,120
first thing we're going to do is look at

563
00:23:05,120 --> 00:23:06,400
the memory

564
00:23:06,400 --> 00:23:08,640
we're looking for process id

565
00:23:08,640 --> 00:23:11,640
7036

566
00:23:13,120 --> 00:23:14,960
and this is again what we saw in the

567
00:23:14,960 --> 00:23:17,520
presentation uh just wanted to give

568
00:23:17,520 --> 00:23:20,799
everyone watching this this video a feel

569
00:23:20,799 --> 00:23:22,640
for what this looks like

570
00:23:22,640 --> 00:23:24,720
again you can run these commands

571
00:23:24,720 --> 00:23:27,520
manually or wrap them into a batch file

572
00:23:27,520 --> 00:23:29,200
and all we're doing is running the

573
00:23:29,200 --> 00:23:32,240
netscan plugin for volatility

574
00:23:32,240 --> 00:23:36,559
and filtering on process id 7036

575
00:23:36,559 --> 00:23:39,120
and when this is done we'll run the

576
00:23:39,120 --> 00:23:40,880
second command

577
00:23:40,880 --> 00:23:44,559
which will look at the command lines

578
00:23:44,559 --> 00:23:49,320
and filter for process id 7036

579
00:23:51,919 --> 00:23:54,240
okay

580
00:23:54,240 --> 00:23:56,480
our second command in volatility that

581
00:23:56,480 --> 00:23:58,880
we're going to run is looking for the

582
00:23:58,880 --> 00:24:00,480
command line

583
00:24:00,480 --> 00:24:02,080
and not looking at all the command lines

584
00:24:02,080 --> 00:24:04,960
if we just ran command line.command line

585
00:24:04,960 --> 00:24:06,640
we would see all the command lines but

586
00:24:06,640 --> 00:24:08,400
we're really interested in just

587
00:24:08,400 --> 00:24:12,559
filtering on process id 7036 powershell

588
00:24:12,559 --> 00:24:16,480
execution and now that we have this data

589
00:24:16,480 --> 00:24:19,520
we can extract that data

590
00:24:19,520 --> 00:24:22,559
and throw it into uh powershell i mean

591
00:24:22,559 --> 00:24:25,200
i'm sorry into cybershot

592
00:24:25,200 --> 00:24:28,440
all right

593
00:24:34,720 --> 00:24:38,400
and again the list of tools that we used

594
00:24:38,400 --> 00:24:41,120
and an invitation uh if you want to

595
00:24:41,120 --> 00:24:44,080
learn more about bluetooth village

596
00:24:44,080 --> 00:24:48,000
please visit us at bluetoothvillage.org

597
00:24:48,000 --> 00:24:50,880
you can join the conversation with us

598
00:24:50,880 --> 00:24:52,080
on twitter

599
00:24:52,080 --> 00:24:53,760
um or

600
00:24:53,760 --> 00:24:55,760
what's even better is to join our

601
00:24:55,760 --> 00:24:57,760
discord um

602
00:24:57,760 --> 00:25:00,960
joining our discord we have several

603
00:25:00,960 --> 00:25:03,600
channels dedicated to lots of different

604
00:25:03,600 --> 00:25:06,720
bluetooth topics including forensics

605
00:25:06,720 --> 00:25:09,200
we're going to make all of the data that

606
00:25:09,200 --> 00:25:12,159
i've presented not only just this data

607
00:25:12,159 --> 00:25:12,880
but

608
00:25:12,880 --> 00:25:16,000
the other kill chains the sim data uh

609
00:25:16,000 --> 00:25:17,360
that we have there will be a walk

610
00:25:17,360 --> 00:25:20,480
through on the sim and uh

611
00:25:20,480 --> 00:25:21,440
and

612
00:25:21,440 --> 00:25:22,720
ids

613
00:25:22,720 --> 00:25:24,559
um

614
00:25:24,559 --> 00:25:27,360
walkthroughs uh we're going to be pres

615
00:25:27,360 --> 00:25:29,840
making all of that data available to the

616
00:25:29,840 --> 00:25:31,120
community

617
00:25:31,120 --> 00:25:33,120
you can use your tools

618
00:25:33,120 --> 00:25:34,159
to

619
00:25:34,159 --> 00:25:35,840
look through the data

620
00:25:35,840 --> 00:25:38,480
you can

621
00:25:38,480 --> 00:25:40,960
use that data for

622
00:25:40,960 --> 00:25:43,440
learning more in other words

623
00:25:43,440 --> 00:25:45,360
you may find something that interests

624
00:25:45,360 --> 00:25:48,000
you that we did not investigate you're

625
00:25:48,000 --> 00:25:49,600
welcome to investigate it join the

626
00:25:49,600 --> 00:25:50,880
conversation

627
00:25:50,880 --> 00:25:51,760
um

628
00:25:51,760 --> 00:25:55,600
and as happens in the security community

629
00:25:55,600 --> 00:25:59,600
new tools are released all the time

630
00:25:59,600 --> 00:26:02,000
having this data available to you allows

631
00:26:02,000 --> 00:26:04,159
you to take those that data

632
00:26:04,159 --> 00:26:07,440
and test it against new tools test it

633
00:26:07,440 --> 00:26:10,960
against your existing tools and see if

634
00:26:10,960 --> 00:26:13,520
your tools find the same data hopefully

635
00:26:13,520 --> 00:26:15,440
they do

636
00:26:15,440 --> 00:26:18,799
or if you see other things that

637
00:26:18,799 --> 00:26:21,360
maybe the tools that we use didn't

638
00:26:21,360 --> 00:26:22,559
didn't find

639
00:26:22,559 --> 00:26:23,520
so

640
00:26:23,520 --> 00:26:25,279
this will all be made available to the

641
00:26:25,279 --> 00:26:28,320
community please come join us on the

642
00:26:28,320 --> 00:26:31,520
blue team village discord

643
00:26:32,720 --> 00:26:36,159
and that concludes uh this presentation

644
00:26:36,159 --> 00:26:39,840
of the kill chain one walkthrough