Saturday, May 11, 2019
WMI worm...(robbering folder) hack
WMIGhost / Wimmie - WMI malware
5 minutes read
WMIGhost / Wimmie sample is from theZoo
SHA256:
a6ff8dfe654da70390cd71626cdca8a6f6a0d7980cd7d82269373737b04fd206
The sample has
.dll extension but there are no exports and according to characteristics, it’s not dll file, I’ve changed the extension to .exe
We can use the report from hybrid-analysis.
There is no protection, let’s dive in deep.
From the beginning, it decrypts text using
XOR with 0x63 and 0xE9:
Decrypted text:
Raw format- Gist link
Much more readable: Gist Link
NOTE: you can use my script to extract decrypted text from the executable: Gist link.
The malware uses
CoCreateInstance function to get access to COM functionality.
The Microsoft Component Object Model (COM) is an interface standard that makes it possible for different software components to call each other’s code without knowledge of specifics about each other.
MS Script Control is provided in msscript.ocx. It is a very handy tool to run VBScript/JScript without relying on CScript.exe or WScript.exe.
Seems like malware uses
Script Control via COM to execute decrypted function without CScript.exe or WScript.exe.call dword ptr[ecx+20h] calls some function from msscript.ocx, but I have no idea which function, there are no symbols, but I think it chooses javascript to execute the script:
(Click here to view a larger version)
After this at
00401AB7 there is another call to function from msscript.ocx:
I think this function is used to execute the script because it causes creation of new process
scrcons.exe
According to
TrendMicro’s great paper:Based on our analysis of using JS, the application wscript.exe is responsible for executing the malicious code. However, in the case of WMI implementation, such a script is executed by the WMI Standard Event Consumer - scripting application, which can be found in the WMI folder in %system32%/ wbem/scrcons.exe. This makes the script hard to detect since it uses a not-so-common WMI application—scrcons.exe—rather than the traditional JS application—wscript.exe.
Yes, the sample uses
WMI and executes the script using scrcons.exe.
After creation of the new process, it also creates
httpcom.log file and writes infection date:
Before exit it tries to delete
instell.exe without success:
That’s executable, let’s look at the script:
(Click here to view a larger version)
It creates instance of
ActiveScriptEventConsumer under root\subscription namespace, executes Javascript script every 0x6e3 milliseconds , you can get the script from the Gist or get using WMI Explorer, it’s under ROOT\subscription namespace, the class is ActiveScriptEventConsumer, the name of the instance is ProbeScriptFint, the script is a value of the ScriptText property.
(Click here to view a larger version)
WMI classes stored in namespace:
subscription allow permanent and general access to WMI services.new MAIN().Fire() causes executing of MAIN routine:
CleanObjects terminates execution of the script:
Parses URLs from the argument and sends information about infected PC:
Receives commands and sends results:
If you prefer you can dive deeper into the script, it’s not obfuscated and is easy to analyze.
That’s all… WMIGhost / Wimmie is a very interesting malware, it uses
WMI to achieve persistence and get system related information, the script is not on the disk.
We can get information about
WMI Database Entries using Autoruns:
Maybe I overlook something related to
WMIGhost, due to my limited knowledge, if you find something interesting please contact me.
I’m new to reversing malware and any kind of feedback is helpful for me.
Twitter: @_qaz_qaz
Resources:
"hello world" Hi tribe, yeah you probably right, sure, if I reset BIOS, give it a bios passwd, and instal windows the rpc backdoor will be blocked..but the point is, this a windows certify software, not a copy, so for sure, they would use another entrancy...on the other hand, the other radio frequency besides the wireless, comes on the clock, you can only modify the data for 2047 limit., the reason why microsoft complies with this...is national security...internet can not go faster than this, I mean drag and drop attack, either you are china or russia servers...so, I actually saw a guy going there, and modfiying the hardware, just for the instructions...last year, I concluded that the only way in blocking their surveillance was by staying online, sending morse code, trought the radio protocol...that's kind of odd...in the sense that morse code, is so damm easly break, but here the point is not encryption, but radio gaps on the "client-server" side. Anyway, LOL...Isaac once said to me, in a beautiful sunny morning...call me in urgency if you actually start lunching missiles ! ;)
Subscribe to:
Posts (Atom)
Satellite hacking Intel 1 (BACK@WAR CyberArmy friends let´s start Satellite GPS navigation hack IT WILL HV A PRICE)
https://stackoverflow.com/questions/63010812/how-to-access-http-port-5001-from-public-internet
