Years Old Infection Discovered After Installing the eSentire MDR for Endpoint Agent

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• Suspicious PowerShell commands executed by an unknown Windows service.
• The activity was identified after an eSentire MDR for Endpoint agent was installed on the device.
• TRU team members discovered that the PowerShell script was part of a multi-stage execution chain using a known, but rarely seen, persistence technique.
• In the first stage, a malicious Windows service executes a PowerShell script (PNRP.ps1), which reads encoded folder names and uses them to re-assemble and execute a second PowerShell command in memory:

Figure 1 PowerShell script which re-assembles folder names into a working script.

Figure 2 Directory listing showing encoded folder names used by PNRP.ps1 to form a new PowerShell command.

Figure 3 CyberChef recipe demonstrating the decoding process.

The antivirus coverage for the initial PowerShell script residing on disk is minimal since the malicious content is loaded dynamically from directory filenames during runtime:

Figure 4 VirusTotal results for the first stage PowerShell script.

• During the second stage, the PowerShell command re-assembled in Stage 1 attempts to contact an external domain to retrieve and execute malware from a remote source. Additionally, the script will add path exclusions for Microsoft Defender to evade detection:
  

Figure 5 The final re-assembled PowerShell command. Executes code from a remote source and disables AV protections.

• The behavior matches reporting by Minerva Labs earlier in the year.
• Filesystem metadata indicates that the infection originated as early as August 2019, meaning the persistence mechanism went undiscovered for over two years.
• Analysts were unable to identify additional artifacts from the machine or from command and control servers due to the age of the infection.
  • Our findings closely align with behavior outlined by Minerva, suggesting the infection stemmed from pirated software, which installed cryptominers, adware, and remote access trojans.

How did we find it?

Our Machine Learning PowerShell classifier identified the persistence mechanism utilized by the threat actors after our endpoint agent was installed on the system.

What did we do?

• Isolated the host and notified the customer of the persistence mechanism.
• Investigated available telemetry to identify other signs of compromise.

What can you learn from this TRU positive?

• The threat attempted to evade detection by hiding encoded PowerShell script fragments in directory names.
  • This technique may work against file-based detection, but is not effective at evading behavioral detection techniques.

Figure 6 The multi-stage PowerShell execution from the endpoint perspective. Note the final command is easily readable.

• The source is believed to be an unauthorized operating system image. Software from unauthorized sources can’t be trusted and may arrive with embedded malware.

Recommendations from our Threat Response Unit (TRU) Team:

• Only download software from trusted sources and avoid pirated or freeware applications.
  • Consider limiting user permissions to prevent installation of unauthorized software.
• Use a modern endpoint detection and response product to protect systems and limit compromise.

Ask Yourself…

• Do you have visibility into potentially malicious software installed by your users?
• How can you detect advanced persistence techniques such as those demonstrated above?
• Could you trace an infection to its source and remove deeply embedded malware?

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.

Want to learn more? Connect with an eSentire Security Specialist.