The University of South Florida: Subdomain Injected with EITest Script That Points to Both Rig-V and Rig-E EK. Dropped CryptoMix (CryptFile2) Ransomware.

IOCs:

• 131.247.120.45 – etc.usf.edu – Compromised subdomain on usf.edu
• 217.107.37.39 – red.wellnesswatchersmd.net – Rig-V EK
• 93.115.38.112 – d4sna.rithiperdien.top – Rig-E EK
• 5.39.84.236 – GET /validator_os/master_valid_os/ms_statistic_os_key.php?info=SCmvxag30Y35DIy7JTzxsJSTLJzUe67VbrPhiiCr4iIe
• 5.39.84.236 – POST /validator_os/master_valid_os/microsoft_osINFO.php – POSTs files to webserver

Traffic:

Hashes:

SHA256: 36fecf334a7be0e9c33c7a745c09e5daf775438e4018cc7de26e5d056ff9ec0f
File name: RigV UA check page.html

SHA256: ef89449250ff7e297300bd1bf1c5ca1c4de691b8d23727e481b24121985f69ad
File name: RigV Landing Page.html

SHA256: 65e938972896e4ffb6c4de3f8314e1a2acd8da5f86fee94f34d35a5d334723e6
File name: RigV Flash Exploit.swf

SHA256: 9f93a612da234591aa2645277aa0672ad53cfebe2697bdcf5e38e0920e270d35
File name: OTTYUADAF

SHA256: 820eada2932ea457bcb098f657034c8c8c727b18449a924653f323d4a0559c11
File name: Spy Security SoftWare_91bf6e5_aed68d54.exe
Hybrid-Analysis Submission

Infection Chain:

The infection chain started off with me browsing the Educational Technology Clearinghouse – University of South Florida website. Injected in the source code of the page was the EITest script shown below:

The URL contained within the script redirected the host to a Rig-V html document containing a script that checks the user-agent being used (browser). It should be noted that the EITest script being injected on etc.usf.edu was also pointing to Rig-E EK, however, I didn’t get a successful infection.

Here is traffic from the failed Rig-E attempts:

Below is the GET request for the Rig-V UA check page and the response from the server:

Click on the picture to enlarge

The script above is designed to identify the browser being used. If the user-agent is IE and you’re not a bot then the script instructs the host to make a POST request for a landing page. For a more detailed analysis of this script please click HERE.

Further down the infection chain we see a POST request for the landing page, a GET request for a Flash exploit, and a request for the payload.

Landing page

Flash exploit

Payload

The payload is dropped in %temp% and created in ProgramData (Spy Security SoftWare_91bf6e5_aed68d54.exe):

Downloaded twice

The malware uses persistence by creating values in the registry (Run and RunOnce keys):

We also see the malware using vssadmin.exe to delete the Shadow Volume Copies (A-Z), backups (wbadmin delete catalog -quiet), reading system information (computer name and GUID) using Windows Management Instrumentation Commandline (WMIC), and using bcdedit.exe in an attempt suppress failures during boot (used to hide system changes):

Analyzed processes from Hybrid-Analysis report

Continuing the investigation  we can look at the callback traffic. This includes a GET request for a file located at the C2:

The response from the server is 401 Unauthorized with the string os_valid: TRUE. Following this we see two POST requests to the C2.

The first POST request contains the value for the “id_number” (personal identification ID), “key_os” (decoding the hex dump shows it contains an RSA1 key), and an empty status value.

The second POST request contains the same information however this time we see the status = DoneWorkEnd.

After the user’s files have been encrypted the filenames are appended with .email[supl0@post.com]id[personal identification ID] and the file extension is changed to .lesli.

Lastly we see the ransom notes (INSTRUCTION RESTORE FILE.txt) created in various folders as well as one dropped on the Desktop. As noted with previous CryptoMix infections (see malware-traffic-analysis write up) the bottom of the ransom note says “^_- Lesli Spying On You -_-“:

Image of CryptoMix ransom note

My recommendations would be to block the Rig EK IPs at your firewall(s) and to disable vssadmin.exe. To read more about why and how you should disable vssadmin.exe click HERE.

Until next time!

• Category: Exploit Kit
• Tag: CryptFile2, CryptoMix, EITest, IOCs, Ransomware, Rig-E, Rig-V

Published by malwarebreakdown

Just a normal person who spends their free time infecting systems with malware. View all posts by malwarebreakdown