Full Report
Key Takeaways The DFIR Report Services Contact us today for pricing or a demo! Table of Contents: Summary Analysts Adversary Infrastructure Capability Victim Indicators Summary In this report, we delve into … Read More
Analysis Summary
# Tool/Technique: Batch Scripts and Associated C2/Proxy Tools
## Overview
This summary details the observation of an open directory in early December 2023 containing numerous batch scripts used by threat actors for system compromise, defense evasion, data destruction, and maintaining command and control (C2). These scripts orchestrated disabling security measures, wiping logs/backups, and installing/removing remote monitoring tools, leveraging C2 frameworks like Sliver and PoshC2, and the proxy tool Ngrok.
## Technical Details
- Type: Malware/Attack Payload Delivery Mechanism (Batch Scripts) complemented by Tools (Sliver, PoshC2, Ngrok, SystemBC)
- Platform: Primarily Windows (implied by batch scripts, UAC, Defender, Event Logs), potentially Linux (mentioned in passing).
- Capabilities: Defense evasion, service disruption, data destruction, C2 communication facilitation.
- First Seen: Open directory discovered early December 2023; associated C2 infrastructure traced back to September 2023.
## MITRE ATT&CK Mapping
The observed actions map to several tactics:
- **TA0005 - Defense Evasion**
- T1562 - Impair Defenses
- T1562.001 - Disable or Modify Tools
- T1562.002 - Disable Windows Event Logging
- T1070 - Indicator Removal
- T1070.001 - Clear Windows Event Logs
- **TA0011 - Command and Control**
- T1090 - Proxy
- T1071 - Application Layer Protocol
- T1071.001 - Web Protocols
- **TA0003 - Persistence**
- T1547.001 - Registry Run Keys / Startup Folder (Implied by management scripts)
- **TA0004 - Privilege Escalation**
- T1546.008 - Event Triggered Execution (Accessibility Features used for this purpose is listed)
- **TA0008 - Lateral Movement**
- T1219 - Remote Access Software (Management/Removal of Atera)
- **TA0009 - Collection**
- T1033 - System Owner/User Discovery
- **TA0010 - Exfiltration**
- T1573 - Encrypted Channel
- T1573.002 - Asymmetric Cryptography
## Functionality
### Core Capabilities
- **Defense Evasion:** Scripts actively disable Windows Defender (`defendermalwar.bat`), scheduled tasks, and uninstall tools like Malwarebytes (`defendermalwar.bat`).
- **Service Disruption:** Stopping and disabling critical services, including those related to SQL, Hyper-V, and Exchange servers (`disable.bat`, `hyp.bat`).
- **Data Destruction/Covering Tracks:** Erasing system backups/shadow copies (`backup.bat`, `delbackup.bat`, `shadow.bat`, `shadowGuru.bat`) and wiping Windows event logs (`clearlog.bat`).
- **Remote Management/C2 Staging:** Scripts manage the installation/removal of Atera remote monitoring agents (`atera_del.bat`, `atera_del2.bat`).
### Advanced Features
- **UAC and Registry Modification:** Using `cmd.cmd` to disable User Account Control (UAC) and modify registry settings, likely aiding persistence or escalation.
- **C2 Framework Usage:** Direct utilization of established C2 frameworks: Sliver (`WILD_PRIDE.exe`) and PoshC2 (infrastructure tracked).
- **Proxy Services:** Use of Ngrok for establishing proxy connections to facilitate C2 communication.
- **Malware Deployment:** Deployment of SystemBC malware via `VmManagedSetup.exe`.
## Indicators of Compromise
IOCs provided include file hashes and specific executable/script names. (Note: Network Indicators are defanged per instruction).
- **File Hashes (Sample selection):**
- `60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659e4d386` (ON.bat)
- `a5748047ebbe34d7821a2a040e4ca54e` (Posh\_v2\_dropper\_x64.exe)
- `c8903eb5763c670a15049d74d764188c` (setup\_uncnow.msi - Atera Remote Admin related)
- `7ee103ee99b95c07cc4a024e4d0fdc03` (VmManagedSetup.exe - SystemBC proxy malware)
- `6b44d99b258c275ee7fcf230da177f3e` (WILD\_PRIDE.exe - Sliver C2)
- `4cf52cee2001cd10528f429fb6d9fd07` (shadow.bat)
- **File Names:** `atera_del.bat`, `clearlog.bat`, `defendermalwar.bat`, `Posh_v2_dropper_x64.exe`, `VmManagedSetup.exe`, `WILD_PRIDE.exe`, `shadowGuru.bat`.
- **Registry Keys:** Management implied, particularly in relation to UAC modification and potential persistence via Run Keys (T1547.001).
- **Network Indicators:** Infrastructure previously associated with **p0shc2** (C2) activity. Observed IPs: `94[.]198[.]53[.]143` and `185[.]234[.]216[.]64:8000`. Ngrok service used for proxying.
- **Behavioral Indicators:** Stopping critical services (SQL, Hyper-V, Exchange), deleting volume shadow copies, disabling security products (Defender, Malwarebytes), and executing cleanup scripts (`LOGOFALL.bat` logs off users).
## Associated Threat Actors
The report does not explicitly name a specific APT group, but the infrastructure shows long-term usage by "the threat actors" between September 2023 and August 2024. The toolkit uses common, publicly available, or widely redistributed C2 frameworks (PoshC2, Sliver).
## Detection Methods
- **Signature-based detection:** File hashes identified above can be used for IoC signature creation.
- **Behavioral detection:** Monitoring for creation/execution of numerous batch scripts performing overlapping tasks (service stopping, log clearing, UAC modification). Rules were developed to target these specific actions, resulting in 10 new Sigma rules.
- **YARA rules:** Not explicitly provided in the summary, but likely derived for the executables (Sliver, SystemBC).
## Mitigation Strategies
- **Prevention measures:** Strict inbound/outbound firewall rules limiting connections to known malicious IPs/ports or restricting protocols not required for business operations. Implementation of application allow-listing to prevent unrecognized executables (like the C2 payloads) from running.
- **Hardening recommendations:** Disable unnecessary services (SQL, Hyper-V, Exchange components if not in use). Implement application control to prevent unauthorized manipulation of Windows Defender, Event Logs, and Volume Shadow Copies via scripts. Restrict the use of proxy tools like Ngrok in the environment. Regular auditing of scheduled tasks and registry run keys.
## Related Tools/Techniques
- **Command and Control Frameworks:** Sliver, PoshC2.
- **Proxy Tools:** Ngrok.
- **Malware:** SystemBC (delivered via `VmManagedSetup.exe`).
- **Techniques:** T1090 (Proxy), T1547.001 (Persistence via Registry Run Keys, implied by post-exploitation staging).