The Malware typically is spread through a couple of vectors such as exploit kits and spam campaigns that include malicious attachments. This most recent campaign involves a series of popular sites that are serving malicious ads that infect machines with CryptoWall.

Infection Cycle:

Md5: ba92a58928b82ba662e7abb4ff4014a9

The Trojan adds the following files to the system:

C:58324545832454.exe [Executable file]

%Appdata%5832454.exe [Executable file]

The Trojan adds the following keys to the Windows registry to ensure persistence upon reboot:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun5832454

C:Documents and SettingsAdministratorApplication Data5832454.exe

HKCUSoftwareMicrosoftWindowsCurrentVersionRun583245

C:58324545832454.exe

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell FoldersAppData

C:Documents and SettingsAdministratorApplication Data

The Trojan it has SeDebugPrivilege Enabled for Thread injection and uses Injected Svchost.exe to set %Appdata% value in the Windows Registry.

The CryptoWall is signed by DigiCert Timestamp Responder, the signature show it was signed on Sunday as you can see on following:

Hopefully the issuer revoked the Certificate after malware was identified on Sunday.

After malware encrypted all your personal documents and files its shows you following web page:

Command and Control (C&C) Traffic

CryptoWall has the C&C communication over port 80. Uses requests to statically defined IP/Domains are made on a regular basis. These requests such as the following:

Drive-by Download advertising campaign

The Malware uses Drive-by downloads were detected as coming from following websites:

• hindustantimes[.]com
• bollywoodhungama[.]com
• one[.]co[.]il
• codingforums[.]com
• mawdoo[.]com

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• Cryptowall.I

Infection cycle:

Once the trojan is executed, the trojan it is copied into a DLL at: %WinDir%System32wbemraswmi.dll

It then creates a batch file on the user’s desktop called “dd.bat” and writes the following code:

Upon execution of the batch file, the dll is run. It also sends a ping request to the IP 137.0.0.1. This IP belongs to US Air Force group known as 754th Electronic Systems Group.

Another batch file “d.bat” is created on the user’s desktop and deletes the executable.

The dll’s function GetMain is called, it creates a service to deletes its previous instance.

We found that the malware tries to communicate its command and control server:

It then constructs a request and sends it to the command and control server.

This request in XOR encrypted with key “6”. Once it is decrypted, it resolves to: U n Admintest D F A FE C SYSTEMU q

At the time of research, the remote server was not available to analyze the behavior of the malware.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: Miras.A (Trojan)

A typical SQL injection occurs when user input is not filtered for escape characters and is then passed into a SQL statement. The following line of code illustrates this vulnerability:

 statement = "SELECT * FROM users WHERE name ='" + userName + "';" 

This SQL code is designed to pull up the records of the specified username from its table of users. However, if the “userName” variable is crafted in a specific way by a malicious user, the SQL statement may do more than the code author intended. For example, setting the “userName” variable as:

 ' or '1'='1 

renders the following SQL statements by the parent language:

 SELECT * FROM users WHERE name = '' OR '1'='1'; 

If this code were to be used in an authentication procedure then this example could be used to force the selection of a valid username because the evaluation of ‘1’=’1′ is always true.

Dell SonicWALL Threat Research Team has developed multiple IPS signatures to protect their customers. These signatures include but are not limited to:

• 10504 ManageEngine Password Manager SQL Injection
• 10417 Nagios Core Config Manager SQL Injection
• 10416 SolusLabs SolusVM SQL Injection
• 10365 Advantech WebAccess DBVisitor.dll SQL Injection
• 10346 lighttpd Host Header SQL Injection
• 10246 SQL Injection Attack 23
• 9584 MyBB birthdayprivacy SQL Injection
• 9547 F5 BIG-IP SQL Injection

According to NVD (National Vulnerability Database), multiple SQL Injection vulnerabilities have been discovered for various applications every year. The following figure shows the SQL Injection related vulnerabilities found in different years. The SQL Injection vulnerability counts topped at 2008 and declined in the following years:

The statistics we observed shows the attack attempts addressing SQL Injection topped at 2010:

Although the SQL Injection attacks recently are much less than the peak time in 2010, it is still active and the following shows the geography graph of the attacks attempts happened in year 2014.

Figure 1: Sample email with the malicious attachment

Infection Cycle:

The Trojan uses the following naming conventions with a .scr or .exe file extension:

• statmnt_yyyy-mm-dd_*random digits*.scr
• infraction_yyyy-mm-dd_*random digits*.exe
• order_yyyy-mm-dd_*random digits*.scr
• runout_yyyy-mm-dd_*random digits*.scr
• termnate_yyyy-mm-dd_*random digits*.exe
• sale_yyyy-mm-dd_*random digits*.exe

Once executed it drops the following files:

• “%TEMP%/sale__*random digits*.rtf (a harmless document file)

It then displays the contents of this document by executing the following commands:

• PROGRAM FILESMICROSOFTOFFICE11WORDVIEW.EXE [“PROGRA~1MICROS~2OFFICE11WORDVIEW.EXE” /n /dde]

Figure 2: Example contents of the harmless word document

To verify internet connectivity, the Trojan performs the following DNS queries:

Figure 3: DNS query to microsoft.com

The Trojan then establishes a connection to different remote servers and sends out encrypted data:

Figure 4: Trojan connects to remote server sazlar.de

Figure 5: Example of encrypted data sent

Based on the following strings found in the main binary file, this Trojan is capable of downloading additional malware to the victim’s machine:

Figure 6: Hardcoded strings found in the main executable

These additional malware components were found to be variants of Zbot and are detected as:

• Mine.exe [Detected as GAV: Zbot.AAD (Trojan)]

And in a true Zbot fashion, this new malware component was found to post encrypted data and send DNS queries to randomized domain names:

Figure 7: ZBot generated DNS queries to random domains

Overall, this Trojan is capable of downloading additional malware into the victim’s machine. It can also send sensitive information out to a remote server.