Cyberdefenders – 3CX Supply Chain Lab writeup

Instructions:

• Uncompress the lab (pass: cyberdefenders.org)

Scenario:

A large multinational corporation heavily relies on the 3CX software for telephone communication, making it a critical component of their business operations. After a recent update to the 3CX Desktop App, antivirus alerts flag sporadic instances of the software being wiped from some workstations while others remain unaffected. Dismissing this as a false positive, the IT team overlooks the alerts, only to notice degraded performance and strange network traffic to unknown servers. Employees report issues with the 3CX app, and the IT security team identifies unusual communication patterns linked to recent software updates.

As the threat intelligence analyst, it's your responsibility to examine this possible supply chain attack. Your objectives are to uncover how the attackers compromised the 3CX app, identify the potential threat actor involved, and assess the overall extent of the incident. 

Tools:

#1 Answer: 2

Understanding the scope of the attack and identifying which versions exhibit malicious behavior is crucial for making informed decisions if these compromised versions are present in the organization. How many versions of 3CX running on Windows have been flagged as malware?

We performed an advanced search on Google using the following term: site:https://www.3cx.com/community "3CX" + "malware", which led us to an entry on the official 3CX forum (Solved – 3CX desktop marked as Malware by SentinelOne). In said entry, the following is specifically mentioned:

"The version is 18.10.461, 18.11.1213, each downloaded update msi is also marked."

From this information, we conclude that two versions of 3CX have been identified as malicious: 18.10.461 and 18.11.1213.

#2 Answer: 2023-03-13 06:33:26 UTC

Determining the age of the malware can help assess the extent of the compromise and track the evolution of malware families and variants. What's the UTC creation time of the .msi malware?

Obtaining the evidence

We execute the command md5sum to obtain the MD5 hash of the malicious file. The command and result were as follows:

md5sum 3CXDesktopApp-18.12.416.msi
0eeb1c0133eb4d571178b2d9d14ce3e9 3CXDesktopApp-18.12.416.msi

Using this MD5 hash, we search the VirusTotal database to trace the history of the file. From the information obtained, we verify that the malicious file was created on March 13, 2023 at 06:33:26 UTC.

#3 Answer: ffmpeg.dll d3dcompiler_47.dll

Executable files (.exe) are frequently used as primary or secondary malware payloads, while dynamic link libraries (.dll) often load malicious code or enhance malware functionality. Analyzing files deposited by the Microsoft Software Installer (.msi) is crucial for identifying malicious files and investigating their full potential. Which malicious DLLs were dropped by the .msi file?

Obtaining the evidence
We use VirusTotal to examine the DLLs used by the malicious file.

From this investigation, we confirmed that the following malicious DLLs were deposited by the .msi file:

• ffmpeg.dll (_ffmpeg.dll_cd92cfbf_289b_424b_89a1_5894463050db)
• d3dcompiler_47.dll (_d3dcompiler_47.dll_a673e78c_fc6a_4133_b2d9_b6447cfbc1c3)

#4 Answer: T1574.002

Recognizing the persistence techniques used in this incident is essential for current mitigation strategies and future defense improvements. What is the MITRE sub-technique ID employed by the .msi files to load the malicious DLL?

Obtaining the evidence
We access the "Behavior" tab in the VirusTotal console.

In the section «MITRE ATT&CK Tactics and Techniques», we identified the techniques used by the malware, where the use of the sub-technique was shown T1574.002.

#5 Answer: trojan

Recognizing the malware type (threat category) is essential to your investigation, as it can offer valuable insight into the possible malicious actions you'll be examining. What is the malware family of the two malicious DLLs?

Obtaining the evidence

Through the VirusTotal console, in the main window, it was verified that the type of malware is a Trojans.

Additional information provided by the platform:

• Popular threat label: trojan.samscissors/dllhijack
• Threat categories: trojan, PUA (Potentially Unwanted Application), dropper
• Family labels: samscissors, dllhijack, deefface
•  

#6 Answer: T1497

As a threat intelligence analyst conducting dynamic analysis, it's vital to understand how malware can evade detection in virtualized environments or analysis systems. This knowledge will help you effectively mitigate or address these evasive tactics. What is the MITRE ID for the virtualization/sandbox evasion techniques used by the two malicious DLLs?

Obtaining the evidence

In the VirusTotal console, we go to the section MITER ATT&CK Tactics and Techniques > Defense Evasion.

We confirm that the identifier corresponding to the virtualization/sandbox evasion technique is T1497.

Additional information:

Techniques used:

• Virtualization/Sandbox Evasion
• T1497
• May sleep (evasive loops) to hinder dynamic analysis
• Sample may be VM or Sandbox-aware, try analysis on a native machine

#7 Answer: Vmware

When conducting malware analysis and reverse engineering, understanding anti-analysis techniques is vital to avoid wasting time. Which hypervisor is targeted by the anti-analysis techniques in the ffmpeg.dll file?

Obtaining the evidence

The anti-analysis technique used by malware 3CX is identified as T1497 in the frame MITER ATT&CK, which focuses on virtualization and sandbox evasion.

As we can see other malware such as "S0268 Bisonal" runs on Vmware

In the same way, according to the analysis of the documentation of InfoSec Institute, malware uses various techniques to detect whether it is running in a virtualized or scanning environment.

#8 Answer: RC4

Identifying the cryptographic method used in malware is crucial for understanding the techniques employed to bypass defense mechanisms and execute its functions fully. What encryption algorithm is used by the ffmpeg.dll file?

Obtaining the evidence

In the analysis published on the blog of Huntress (link), it is mentioned that:

After retrieving d3dcompiler_47.dll, the ffmpeg.dll binary locates and unravels this secondary payload by decrypting an RC4 stream with the key 3jB(2bsG#@c7. According to other threat intelligence, this static key is known to be attributed to DPRK threat actors.

Similarly, the blog of Forescout Vedere Labs (link) analyzes the following:

Forescout Vedere Labs analyzed an MSI installer obtained directly from the vendor’s website that includes both the malicious DLLs and the 3CXDesktopApp executable. The initial attack is a DLL sideloading with multiple components involved. The 3CXDesktopApp package contains the following files of interest:
exe – 3CXDesktopApp application, which serves as a shellcode loader
dll – A malicious loader DLL used to load and execute malicious shellcode from d3dcompiler_47.dll
dll – A DLL with an appended payload

As in a regular update, the MSI installer launches the executable Update.exe, which in turn launches 3CXDesktopApp.exe. 3CXDesktopApp.exe loads ffmpeg.dll and then hollows out a portion of the 3CXDeskttopApp.exe binary to inject code from d3dcompiler_47.dll.
After the contents of d3dcompiler_47.dll have been read into the heap space, the code decrypts the malicious shellcode appended in the file, using RC4 and the key 3jB(2bsG#@c7 – as shown below.

#8 Answer: Lazarus

As an analyst, you've recognized some TTPs involved in the incident, but identifying the APT group responsible will help you search for their usual TTPs and uncover other potential malicious activities. Which group is responsible for this attack?

Obtaining the evidence

In the previous question (#7), the analysis of the blog Forescout Vedere Labs (link) indicates that:

The trojanized version of 3CXDesktopApp was observed as the first stage in a multi-step attack, which indicates that the threat is sophisticated. The threat actors behind the attack have also acquired a code signing certificate from 3CX that they have used to sign the malicious binaries. This further complicates the situation by making victims trust the malicious executable and by making it harder for security tools to detect the threat.

Based on the malicious code being used, the current campaign has been linked to North Korean APT Lazarus Group. Lazarus Group has been active since 2009 and was responsible for attacks such as the 2009 Sony breach and WannaCry. The group is also known as Labyrinth Chollima, Hidden Cobra, Guardians of Peace, ZINC and Nickel Academy.

:wq!