There have been recent articles and blog posts arguing that the API approach is better than the proxy approach when it comes to selecting a cloud access security broker (CASB). The argument doesn’t really make sense at all. Both surely have their advantages and disadvantages, but each covers unique use cases and while you could certainly select a CASB that supports one versus the other, why not choose a CASB that offers both so you have the option to combine the two and address expanded use cases?
Pitting one against the other is like comparing a spoon vs. a fork. A spoon was designed to hold softer food in addition to liquid so you can place it in your mouth and eat a meal. Spoons come in various sizes depending on the application. In a similar fashion, an API deployment method is primarily focused on a set of specific use cases that includes being able to inspect content in sanctioned cloud apps and support for out-of-band policies such as restrict access, revoke shares, quarantine, and encrypt.
A fork on the other hand, was designed primarily to grab and hold solid foods for eating. That is a job that the spoon cannot do. In a similar fashion, a proxy deployment method is primarily focused on a specific set of use cases around providing real-time visibility and control over cloud traffic and depending on the type of proxy, you can cover both sanctioned and unsanctioned cloud apps in real-time. Real-time and covering unsanctioned cloud apps is not possible with an API deployment method. In addition to use cases, there is the comparison of effort to deploy and use. You can argue that a fork requires a bit more care versus a spoon. You might not give that fork to a toddler for example, but a spoon would be less risky with trade-off of course that they might have a hard time eating their vegetables with that spoon. Similarly, a proxy requires and inline deployment and a forward-proxy specifically requires extra configuration and care. The effort can be worth it given the use cases.
Let’s get back to my original argument that why choose one versus the other? Choose a CASB that covers both an API method of deployment and multiple proxy methods of deployment. You can choose only one or combine them to expand your use case coverage. Should we start calling API + Proxy a spork?
Here is a table that compares use case coverage for API vs Proxy to help you make the decision which one to choose or perhaps choose both.
Bob Gilbert, Vice President/Product Marketing, Netskope
The Hancitor downloader has been relatively quiet since a major campaign back in June 2016. But over the past week, while performing research using Palo Alto Networks AutoFocus, we noticed a large uptick in the delivery of the Hancitor malware family as they shifted away from H1N1 to distribute Pony and Vawtrak executables. In parallel, we received reports from other firms and security researchers seeing similar activity, which pushed us to look into this further.
Figure 1 AutoFocus view of new sessions of Hancitor since July 2016
The delivery method for these documents remained consistent to other common malicious e-mail campaigns. Lures contained subjects related to recent invoices, or other matters requiring the victim’s attention, such as an overdue bill. These lures were expected, until we started digging into the actual documents attached and saw an interesting method within the Visual Basic (VB) macros in the attached documents used for dropping the malware.
This blog will review in detail the dropping technique, which isn’t technically new, but this was the first time we’ve seen it used in this way. The end goal is to identify where the binary was embedded, but we’ll cover the macro and the embedded shellcode throughout this post.
The Word Document
For this section, we’ll be looking at the file with a SHA256 hash of ‘03aef51be133425a0e5978ab2529890854ecf1b98a7cf8289c142a62de7acd1a’, which is a typical MS Office OLE2 Word Document with your standard ploy to ‘Enable Content’ and run the malicious macro.
Figure 2 The ploy used by the malicious document
Opening the Visual Basic editor up, we can see two forms and a module for this particular sample.
Figure 3 VBProject components
The Malicious Macro
Visual Basic can directly execute Microsoft Windows API calls, which allows it perform a number of interesting functions — exactly what this VB code is doing.
Figure 4 Microsoft Windows API calls within VB code
As we can see, the macro includes logic to determine the architecture of the system it’s running on and has the ability to execute correctly on either 32-bit or 64-bit platforms. The primary calls of interest for us will be VirtualAlloc(), RtlMoveMemory(), and CallWindowProcA().
When we originally started looking at this sample, we were mainly interested in where the payload was being stored, so we began debugging the macro to understand how it functions. The payload in question is base64-encoded and embedded within a form in the VBProject as a value of the ‘Text’ field on the ‘choline’ TextBox.
As a side note, what is really interesting is that the authors went through the trouble to actually write their own base64 decoder purely in VB. We’ll leave that as an exercise for the reader to dig into that but it’s a good overview of how base-N encoding works; the entire ‘maria’ module within this macro is the base64 decoder.
The macro base64 decodes the payload into a local byte-array and then we come to our first API call, VirtualAlloc().
Figure 5 Memory page being allocated
The call commits specific pages of memory with read, write, and executable (RWX) permissions at 0x59B0000.
Figure 6 New memory page with RWX permissions
Afterwards, the VB macro continues to setup the next call to RtlMoveMemory and then calls it with the location of the memory from the previous call and our base64 decoded byte array.
Figure 7 Base64-decoded byte array
We can quickly validate by dumping that region of memory in our WINWORD.EXE process and comparing transferred bytes.
Figure 8 Confirming bytes match from dumped memory
Now that our code has been copied to in executable memory, the macro sets up the last API call for CallWindowProcA(). The first value supplied to this call is our memory offset +2214, which is a function pointer within this code, and the second is a string of the path to our file for a handle. These actions redirect code execution to shellcode.
Figure 9 Passing execution to the shellcode
The Shellcode
If we attach to WINWORD.EXE and break on the offset of our memory location +2214 (0x8A6), the entry point of the shellcode, we can validate program execution shifts to this code path.
Figure 10 Validating shellcode is executing
From here, the shellcode gets the address for LdrLoadDLL() function, which is similar to LoadLibraryEx(), by enumerating the Process Environment Block (PEB) and then begins to hunt for the functions it will use within kernel32.dll.
The values for the functions it’s looking for, along with other values, are embedded into the shellcode and built on the stack for later usage.
Figure 11 Embedded data in shellcode
Following these sets of encoded names, we can see the shellcode is interested in the following syscalls: CloseHandle(), ReadFile(), GetFileSize(), VirtualFree(), VirtualAlloc(), and CreateFileA(). For each API call, it looks up the address of the function and stores it on the stack.
Next, the shellcode calls CreateFileA() on the Word document and receives a handle back, which it passes to GetFileSize() for the file size, that is then subsequently passed to VirtualAlloc() to create a section of memory for the file contents (0x2270000). Finally, it reads in the file to that memory location and closes the handle.
Figure 12 Egg hunting by the shellcode
Once it has the copy loaded into memory, it begins a process of hunting through memory for the magic bytes 0x504F4C41, which we can see is located at 0x022836F3 in our new memory page.
Figure 13 Egg located
Now that we’ve found what’s likely to be our binary, the last step is to just decode it. Looking at the shellcode, we can see that it will add 0x3 to each byte starting at 0x22836FF, in our example, and then XOR it by 0x13, as shown below.
Figure 14 XOR decrypting
Once the counter reaches 0x13AAC (80556), it begins a series of sub-routines to manipulate each byte and decrypt the binary. If we set a breakpoint after the decryption routine and check our memory location, we can see that the binary is decoded and can now be dumped for further analysis. The MZ and PE headers can be seen in the following dumped memory.
Figure 15 Decoded binary
For this particular campaign run with this dropper, it places the binary in the %TMP% directory before launching it, which then ends up writing itself to ‘%SYSTEMROOT%/system32/WinHost.exe’.
At this point, the Hancitor downloader has been fully loaded on the victim’s machine, where it will proceed to perform additional malicious activities.
Conclusion
Macro-based techniques are quite common, but the technique being used here with the macro dropper is an interesting variation. From the encoded shellcode within the macro and using native API calls within VB code to pass execution to carving out and decrypting the embedded malware from the Word document, it’s a new use of Hancitor that we’ll be following closely. .
Palo Alto Networks customers are protected from the dropper detailed throughout this blog and its contained Hancitor payload. You can continue to track this threat through the AutoFocus Hancitor tag. Additionally, all Hancitor downloader samples are identified as malicious in WildFire. Domains used by Hancitor are also categorized as malicious.
Acknowledgements
For more analysis of the Hancitor payload, please see this write-up by Minerva Labs.
Indicators of Compromise
Below are some of the most common observed e-mail subjects and file names seen in the latest campaign this week from over 380,000 sessions. Patterns substituted with regex or representation.
Email Subjects
<domain> invoice for <month>
levi.com invoice for august
<domain> bill
<domain> deal
<domain> receipt
<domain> contract
<domain> invoice
metlife.com bill
metlife.com deal
metlife.com receipt
metlife.com contract
metlife.com invoice
This post is the first in a series by Unit 42 covering the cybercrime underground. Cybercrime persists as an epidemic that continues to worsen every year, with associated impacts and losses steadily growing. In this series, we’ll explore actors, motivations, and the current threat landscape.
Some of what contributes to the growth of the cybercrime underground is the convenience, speed, and anonymity the Internet provides to enable online crimes. Advances in the sophistication of cyberattacks over the past decade closely correlate with two major evolutions:
Lowered Cost of Entry: The ease and availability of tools and training to conduct such attacks, allowing individuals with lower skillsets to successfully thrive in the cybercrime industry.
Increased Business Acumen: The refinement of full attack lifecycle processes and support structures that rival some of the most innovative legitimate business models, enabling more efficient and effective operations coupled with robust commodity markets.
With the ever-changing cybercrime threat landscape, it is important to understand its current state, observe trends, and anticipate likely paths of evolution. Before we go any further, let’s establish some definitions related to the cybercrime underground.
Definitions
Cybercrime: Any crime that involves the use of computers to victimize an individual or organization for financial gain.
Indexed Web: All Internet search engine accessible and indexed sites. This is the web that most of the world knows and uses every day, and includes commercial / retail, social media, news, consumer service, and other publicly known sites.
Deep Web: Sites that make indexing by Internet search engines problematic, due to access control, dynamic content, or other prerequisite mechanisms (e.g., encryption or specialized software). In general, these sites are not accessible to standard web search engine crawlers that perform indexing. This class of sites is also sometimes referred to as the Invisible Web, Hidden Web, or Deepnet.
Dark Web: A subset of Deep Web sites that requires special software (e.g., TOR) to reach. Related infrastructure hosts criminal content such as stolen information and access to premium malware and exploits, and supports other categories of activity, such as illegal pornography, drug trade, prostitution, human trafficking, and terrorist operations. A number of these sites are transient, only up for a short
time or constantly changing addresses in an attempt to minimize the risk of exposure to government agencies, law enforcement and security researchers.
Cybercrime underground: Online forums where information, tools (malware, exploits), and services are bought and sold in support of cybercrime objectives. Composite sites exist on the Indexed Web, Deep Web, and Dark Web in varying contexts.
Figure 1 High level chart connecting the different attributes of cybercrime
Impacts
Cybercrime has broad impacts to both organizations and individuals. The losses from cybercrime can range from theft of intellectual property to costs incurred due to a result of a breach. A high level overview of the impacts can be broken down into direct and indirect losses:
Direct Losses
Loss of control over owned or entrusted:
PII data
Financial information
Electronic Health Records (EHRs)
Intellectual property
Trade secrets
Direct financial fraud
Service disruptions or restriction of access to data (e.g., ransomware).
Indirect Losses
Costs supporting recovery from a breach, such as incident response, investigation services, and remediation
Reputational damage
Legal and regulatory penalties related to the loss of records (e.g., PII, health, financial, etc.)
Near term business revenue loss
Longer term financial and economic consequences
Products, Services and Actor Roles
The cybercrime underground maintains its own economy of commoditized products and services. Related financial transactions have boomed with the broad adoption and accessibility of anonymous cryptocurrencies such as Bitcoin, which is commonly used by malicious actors amongst themselves as well as for accepting payments from victims (e.g., ransomware).
Products can be broken down into two main categories: information and resources. Sellers of these products benefit from the quick payouts of discrete (and sometimes one-time) transactions. Buyers benefit from what is often a professional level product that can be applied immediately to malicious actor operations “out of the box.” Information products include commodities such as:
Stolen personally identifiable information (PII): Including everything from mass email lists used by spammers to full identity theft packages to commit financial fraud
Exfiltrated organizational information: Including intellectual capital / property, non-public internal data, and internal operational details
Harvested authentication credentials: Stolen username and password combinations continue to present a significant risk these days, especially when those credentials are re-used across multiple sites
Pilfered financial / payment data: Unauthorized withdrawals from accounts or charges against credit lines continue to plague account holders
Resource products include elements such as:
Access to feature-rich malware: Malware across varying capabilities (e.g., information stealers, remote administration tools – RATs, ransomware, purpose built utilities) that demonstrate consistent results and avoid source code leakage can generate significant revenue for associated authors and distributors
Purchase of system or software exploits: While many white hats elect to support bug bounty initiatives by vendors, there remains a lucrative underground market for reliable, un-patched exploits
Transfer of control for previously compromised machines: This usually applies to always-on servers that can then be used as attack platforms or sold for the information they store, although the service model for this element is more popular these days
Malicious actor training: Guidebooks or tutorials on effective tool usage or specific Tactics, Techniques, and Procedures (TTPs)
Services can be thought of as “lease” versions of the resource-based – and even some of the information-based – products described above, where access to a product is promised at a set rate for an agreed upon period of time. Providing services appeals to many actors due to the recurrent cost model and opportunity to collect higher profits over a longer period of service. Malicious actors using these services benefit from assurances on availability and performance (e.g., timely feature, exploitation, and evasion updates). Such services include the following:
Distributed Denial of Service (DDoS): Botnet powered attacks that affect the availability of targeted servers and capabilities
Exploit Kits (EKs): Typically, monthly rate for access to the exploit toolkit allowing for customized end payloads
Infrastructure rental: Hosting services for attack platforms; malware update, configuration, and command and control (C2); and other attack lifecycle functions. Of special note: BulletProof Hosting Services (BPHSs) providers play a critical role in the cybercrime world as they allow cyber criminals to thrive and operate their malicious services without the risk of easily being taken down by law enforcement. Some of the key reasons that BPHS providers have been successful in their operations include: the appearance of legitimate businesses, strategic geographic distribution of servers in countries with accommodating cyber laws, high redundancy to minimize the risk of operational disruption, and professional level support services
Money laundering: Transfer (“money muling”) of illegally obtained funds through accounts and mechanisms in money haven countries remains a key service
As a high-level, malicious actor motivation, cybercrime is simply an extension of traditional criminal activity, focused on the theft of personal and account information and/or establishment of leverage over a target to achieve illicit monetary gain. The cybercrime ecosystem relies on a number of key roles that are also shared across other top-level motivations. A description of these roles can be found in Part 2 of a prior Unit 42 blog series: Adversaries and Their Motivations.
Coming Up…
Subsequent posts in this blog series will focus on different aspects of the cybercrime underground, including associated tools, services, techniques, and actors.
In case you were off enjoying a well-deserved summer holiday and are, like I am, a firm believer in disconnecting from the world while on holiday, you might have missed the recent hacker document dump of the U.S. Democratic National Committee (DNC) emails. Personal note: if you did find a place remote enough to not hear about this, please send me the coordinates as I want to visit there ASAP.
Information security professionals have long operated under the mantra ‘prevention is ideal, but detection is a must.’ Many professionals have extended that mantra to include the concept of ‘response’ to detection. Usually response is considered in terms of technical tools to speed remediation and improve prevention of future attacks. The DNC hack, like many other hacks before it, highlights the financial value of knowing what was in the data that was exposed.
When it comes to evaluating the monetary value of knowing what data is exposed, ransomware is the ultimate capitalistic exercise. Hackers attempt to determine the right balance of 1) The organization’s tolerance to data loss, including the safeguards the organization may have in place; 2) The value the organization places on the data; and 3) The value they place on public knowledge of a data loss incident. The ransomer’s goal is simple, set a price point that the organization is most likely to pay.
While ransomware is foremost in many of my conversations with C-level executives, the danger of an insider threat is also a recurring topic of conversation. In the past six months I’ve been asked for help with the following:
“Our top designer went to work for our biggest competitor, what data did they take with them?”
“We had a friendly merger with another firm but their top 6 engineers left shortly after the merger, did they take any data with them?”
“One of our senior execs laptops was stolen; do we have any government mandated reporting requirements?”
All of these are questions ultimately seek to assign a dollar value to knowing what data was exposed and what information was in that data.
A well-designed modern endpoint backup solution can help you know the value of your data and remediate those threats by:
Performing point-in-time restores to before ransomware hits.
Showing you what data was copied to USB devices or personal cloud accounts before an employee leaves your organization.
Helping you determine what data was on a stolen device and the extent of your exposure.
Making it easy for employees to restore their data after a viral ransomware incident.
Never paying a ransom.
For years, those of us in the backup space have defined our value proposition as: Knowing what data was on a device that crashed/was lost/was stolen. Modern endpoint backup extends visibility to the data on a device that was compromised by an insider or a hacker.
