Operation of SMB Vulnerability, Fileless WannaMine

A distribution method of CoinMiner has become more diversified. In early 2019, AhnLab ASEC Analysis Team introduced CoinMiner that exploits SMB vulnerability(MS17-010 EternalBlue) for distribution.

Recently, it was confirmed that a fileless CoinMiner malware named “WannaMine” exploits not only SMB vulnerabilities for distribution, but also Windows Management Instrumentation (WMI), ADMIN$ shared folders, remote service registration and operation through SMB.

Figure 1 describes the overall process of WannaMine.

Figure 1. Process of WannaMine (To be translated)

When the “sysupdater0.bat” file is executed on the first infected PC, there are different methods per OS version. If it is Windows XP, it downloads VB script file(*.vbs) from outside and runs via “cscript.exe” since PowerShell is not available. In case of Windows Vista or other advanced OS, it downloads PowerShell script(*.ps1) and executes via “powershell.exe”. Despite their difference in script type(*.vbs, *.ps1), they share the internal features and damage the system by executing encoded CoinMiner, Mimikatz hacking tools, and EternalBlue shellcode(MS17-010) that are inside the downloaded script.

Distributions are attempted via port 135 and port 445. In case of port 135, the WMI command is used to operate the “cmd.exe” of the remote system to download and run external files. As for port 445, there are a total of three methods: ▲To distribute via SMB vulnerabilities(MS17-010) ▲To distribute via ADMIN$ shared folders ▲To register remote services through SMB.

Figure 2. Details of sysupdater0.bat

If the first infected PC is Windows Vista or others with higher version, the externally downloaded PowerShell script operates in a fileless form using the ‘DownloadString’ function.

1. Features of the downloaded PowerShell script (in3.ps1, in6.ps1)

The in3.ps1 script (for x86) contains Mimikatz for stealing Windows account information, EternalBlue shellcode for distributing SMB vulnerability(MS17-010), CoinMiner and others encrypted as BASE64. Then, these are registered in the WMI class of the infected PC(systemcore_Updater4) and run by a PowerShell command.

After registering payloads to the WMI class property, malicious PowerShell scripts utilize the WMI’s Event Filter and Consumer for persistence of system before distribution to the network and CoinMiner process execution take place.

2. Registering WMI Event Filter

Malware registers itself to Registry Run or RunOnce key and it is a widely known technique to reside in infected PC. However, in case of WannaMine, a malicious PowerShell script continues its operation even when the PC is rebooted. This is enabled by connecting registered Event Filter and Consumer via “FilterToConsumerBinding” after setting them up.

Figure 3. WMI Event Filter registered by WannaMine

If the WQL query is registered as Event Filter, the PowerShell command below is executed 4-5 minutes after the system reboot.

The feature of encoded script is delivered by a partial encoding of in3.ps1(for x86). It carries out behaviors such as CoinMiner distribution, CoinMiner execution on the infected PC and termination of PowerShell process communicating with the certain port.

3. Termination of PowerShell process communicating with the certain port

If any of the ports currently open in the system is communicating with port 3333, port 5555 or port 7777, a process gets terminated.

4. Change power saving mode settings of Infected PC

In addition, it changes the system’s power settings to keep it on during coin mining.

5. Distribution method

WannaMine checks network adapter settings of the infected PC and conducts distribution to random IPs based on the current IP address and the subnet mask. Different distribution methods are used considering the connection of RPC DCOM(port 135) and SMB(port 445) to the remote PC.

1)    RPC DCOM (Port 135)

(1)   Use WMI to run remote process

The attacker uses the Mimikatz hacking tool before network distribution to acquire the NTLM hash value. It enables to perform remote commands without client’s local administrator privilege.

The string in the $cmd variable differs per OS version of remote PC: $cmds for Vista or higher version, and $cmdvbs for XP or lower version.

Figure 4. Packet upon running Invoke-WmiMethod command(RemoteCreateInstance)

Figure 5. Executing $cmdps command from remote PC

2)    SMB (port 445)

(1)   Creating service through SMB protocol

NTLM hash is required just like RPC DCOM(port 135) to run service on a remote PC. If there is no NTLM hash, local administrator privilege of the remote PC is required.

Figure 6. Packet related to service creation using SMB (Creating service “OAAUXMKLQWJDQPJFTIGT”)

Figure 7. Remote PC creating service “OAAUXMKLQWJDQPJFTIGT”

(2)   Creating task scheduler through shared folders

(3)   SMB vulnerabilities (MS17-010) distribution

Figure 8 and Figure 9 below show the captured packets attempting to access EternalBlue vulnerability on a remote PC. If EternalBlue vulnerability is successfully exploited, a malicious fileless PowerShell script is downloaded and executed based on the OS of remote PC

Figure 8. Sending EternalBlue packet

Figure 9. ShellCode within the EternalBlue packet

In addition to EternalBlue vulnerability, distribution methods such as WMI, ADMIN$ shared folders, remote service registration are proper features provided by the system. Since the attackers utilized these to distribute CoinMiner, it is difficult to determine whether it’s malicious or not solely with network packet. Users should therefore consider changing the default port to prevent attackers from exploiting the SMB and WMI protocols, or deactivate these services if they are deemed unnecessary.

AhnLab detects and prevents the behaviors under the following aliases when abnormal behaviors occur in the PC affected by SMB or WMI protocol.

The Miner which carries out the final malicious behavior, operates after being injected to powershell.exe or schtask.exe; it is the 2.14.1 Miner with XMRig version.  

[File Detection]

BAT/Downloader (2019.08.25.00)

VBS/Downloader (2019.08.25.00)

Script/Powershell (2019.08.25.00)

Trojan/Win32.CoinMiner (2019.04.11.07, 2019.08.25.00)

[Behavior Detection]

(1)   In case of distributing via RPC DCOM (Port 135)

–       Malware/MDP.Behavior.M2330 // wmiprvse.exe blocks the execution of PowerShell script

(2)   Creating service via SMB protocol (port 445)

–       Malware/MDP.Behavior.M2324 // Blocks service registration by the download feature of external script file

[V3 IPS Block]

–       Detects EternalBlue vulnerability packets