WMI worm...(robbering folder) hack

WMIGhost / Wimmie - WMI malware

5 minutes read

WMIGhost / Wimmie sample is from theZoo

SHA256: a6ff8dfe654da70390cd71626cdca8a6f6a0d7980cd7d82269373737b04fd206

The sample has .dll extension but there are no exports and according to characteristics, it’s not dll file, I’ve changed the extension to .exe

We can use the report from hybrid-analysis.

There is no protection, let’s dive in deep.

From the beginning, it decrypts text using XOR with 0x63 and 0xE9:

Decrypted text:

Raw format- Gist link

Much more readable: Gist Link

NOTE: you can use my script to extract decrypted text from the executable: Gist link.

The malware uses CoCreateInstance function to get access to COM functionality.

The Microsoft Component Object Model (COM) is an interface standard that makes it possible for different software components to call each other’s code without knowledge of specifics about each other.

MS Script Control is provided in msscript.ocx. It is a very handy tool to run VBScript/JScript without relying on CScript.exe or WScript.exe.

Seems like malware uses Script Control via COM to execute decrypted function without CScript.exe or WScript.exe.

call dword ptr[ecx+20h] calls some function from msscript.ocx, but I have no idea which function, there are no symbols, but I think it chooses javascript to execute the script:

(Click here to view a larger version)

After this at 00401AB7 there is another call to function from msscript.ocx:

I think this function is used to execute the script because it causes creation of new process scrcons.exe

According to TrendMicro’s great paper:

Based on our analysis of using JS, the application wscript.exe is responsible for executing the malicious code. However, in the case of WMI implementation, such a script is executed by the WMI Standard Event Consumer - scripting application, which can be found in the WMI folder in %system32%/ wbem/scrcons.exe. This makes the script hard to detect since it uses a not-so-common WMI application—scrcons.exe—rather than the traditional JS application—wscript.exe.

Yes, the sample uses WMI and executes the script using scrcons.exe.

After creation of the new process, it also creates httpcom.log file and writes infection date:

Before exit it tries to delete instell.exe without success:

That’s executable, let’s look at the script:

(Click here to view a larger version)

It creates instance of ActiveScriptEventConsumer under root\subscription namespace, executes Javascript script every 0x6e3 milliseconds , you can get the script from the Gist or get using WMI Explorer, it’s under ROOT\subscription namespace, the class is ActiveScriptEventConsumer, the name of the instance is ProbeScriptFint, the script is a value of the ScriptText property.

(Click here to view a larger version)

WMI classes stored in namespace: subscription allow permanent and general access to WMI services.

new MAIN().Fire() causes executing of MAIN routine:

CleanObjects terminates execution of the script:

Parses URLs from the argument and sends information about infected PC:

Receives commands and sends results:

If you prefer you can dive deeper into the script, it’s not obfuscated and is easy to analyze.

That’s all… WMIGhost / Wimmie is a very interesting malware, it uses WMI to achieve persistence and get system related information, the script is not on the disk.

We can get information about WMI Database Entries using Autoruns:

Maybe I overlook something related to WMIGhost, due to my limited knowledge, if you find something interesting please contact me.

I’m new to reversing malware and any kind of feedback is helpful for me.

Twitter: @_qaz_qaz

Resources:

Understanding WMI Malware

https://secrary.com/ReversingMalware/WMIGhost/