Ransomware artifacts

I recently read through this FalconFeeds article on Qilin ransomware; being in DFIR consulting for as long as I have, and given how may ransomware incidents I’ve responded to or dug into, articles with titles like this attract my attention. I do not presume to know everything, and in fact, I’m very interested in the insights others provide based on their own investigations. As such, articles like this grab my attention. 

As I read through the article, however, I become somewhat confused. Consider this quote from article:

On closer examination, it is likely that the individual behind the Stack Overflow post was an infected victim rather than an attacker. This assessment is supported by the fact that another IP address 107[.]167[.]93[.]118 was observed with the same machine name (WIN-8OA3CCQAE4D) and identical configuration details. Such consistency across multiple, unrelated systems strongly indicates that the exploit automatically renames compromised hosts, leaving behind a uniform system identifier that inadvertently exposed itself in public forums. [emphasis added]

Okay, this statement is interesting. At work/day job, for example, we’ve observed this workstation name a number of times, with different IP addresses. Again, these have been observed at different times, so the thinking is that either a threat actor used different means to connect to the Internet, or the workstation with the NetBIOS name/machineID is a virtual machine shared by several individuals. I think what really threw me was the statement “…the exploit…”; while the word “exploit” is mentioned several times in the article, there’s nothing that clearly delineates what that exploit is, nor how it was discovered or defined.

Later in the blog post, we see the section illustrated in Figure 1.

Figure 1: Blog excerpt

If I read the blog post correctly, the author’s findings include the fact that the target victim is sent an LNK file by the threat actor; this is illustrated in Figure 2.

Figure 2: Blog excerpt

As anyone who’s followed my work for any amount of time is aware, I’m very interested in LNK files, and not just from the perspective of parsing them, but more so, using the embedded metadata (or lack thereof, as the case may be) to develop threat intelligence. As JP/CERT pointed out a long time ago, there’s a lot that an LNK file sent to a target can tell us about the developer’s workstation, including the machine ID/NetBIOS name. So far, to my knowledge, the only folks to make full use of LNK metadata to develop threat intelligence is Mandiant, in their Nov 2018 write-up on APT29 (see fig. 5 & 6).

That being said, we know that many methods/APIs for creating LNK files automatically include the workstation name where the file is created in the LNK metadata. Since this affiliate is known (see Figure 2) to gain initial access to victim endpoints by sending a malicious LNK file, we know that the LNK file itself is not created on the target endpoint; as such, there is no reason to assume that there’s an “exploit” that changes the name of impacted endpoint. 

While this is not something I’ve ever seen, nor heard of (again, I’ll be the first to tell you that I don’t know everything…), that doesn’t mean that it’s impossible. This definitely could happen, but the evidence presented doesn’t hold up in the face of artifact knowledge and experience.

Using information from the FalconFeed article, I was able to locate and download a copy of the LNK file (MD5: 30fc1856c9e766a507015231a80879a8) and run it through my own LNK parser, and I got the following output:

From the above output, and looking back to the Mandiant article, we can see a great deal about the developer’s endpoint, including the workstation name “win-8oa3ccqae4d”. We can also see a great deal of information that can likely be applied to the campaign, and by extension, be used to flesh out and provide context to both intrusion and threat intelligence.

However, it seems clear that the author of the FalconFeeds article is missing some knowledge of Windows artifacts and file structures. Running an LNK file through ANY.RUN is a method to use, but it should not be the only method that’s used to develop information from that artifact. This also supports my thoughts CTI teams would benefit from a deep digital analysis skill sets, to develop and interpret artifacts from various systems and endpoints in a more thorough, correct manner. 

Source: Read More