Bear Hunting: Tracking Down COZY BEAR Backdoors

As a follow-up to the CrowdStrike blog entry "Bears in the Midst" on June 15, 2016, we will walk through the methods leveraged by CrowdStrike to recover a COZY BEAR WMI backdoor. The recovery of the backdoor illuminates additional indicators organizations can leverage to further scope potential COZY BEAR activity in their networks. The most effective means of identifying a COZY BEAR WMI implant is to query Event Filters, Event Consumers, and Filter To Consumer Bindings within Windows Management Instrumentation (WMI). This can be collected enterprise-wide by leveraging the following PowerShell script and redirecting the output to a file.

Note: HOSTS.TXT file can contain IP addresses or hostnames associated with the systems in your enterprise. When examining the output of the script, it is essential to identify known-good entries. Many legitimate entries will include references to “SCM Event Log Filter” and/or “BVTFilter”, however most other entries should be closely scrutinized. Table 1 below contains an example of a known-good Event Filter, Event Consumer, and Filter To Consumer Binding for the SCM Event Filter. Table 1. Legitimate WMI Event Information Below we will dive into two types of nefarious examples CrowdStrike has observed during our investigations, one for a SEADADDY implant and another for a bootstrap to a WMI class created by the adversary.

SEADADDY Implant

Table 2. WMI Event Information for SEADADDY Backdoor The persistence mechanism put in place for SEADADDY pointed us directly to the binary, C:\Windows\pagemgr.exe, found in the Event Consumer.

Bootstrap to Malicious WMI Class

Table 3. WMI Event Information for Bootstrap to Malicious WMI Class The Event Consumer for the bootstrap to the malicious WMI class contains a Base64 encoded PowerShell command. The full Base64 encoded string is below.

Decoding the Base64 encoded string gives us the following:

Focusing on the final line of the above code, two strings are passed, each containing ‘Wmi’, to the ‘sWP’ function along with keys for decryption. During its investigations, CrowdStrike has observed the decryption keys were unique and specific for the malicious WMI class created. Following the code in the ‘sWP’ function, we can see an interesting entry:

From TechNet, “ is described as a type accelerator for ManagementClass. This has a string constructor that takes a local or absolute WMI path to a WMI class and returns an object that is bound to that class,” essentially a shortcut to a WMI class definition. In this instance, the adversary created a WMI class and associated property, each named ‘Wmi’ to store malicious code. This malicious WMI class and associated property were created earlier in the adversary kill chain. Below is a screenshot for querying the class definition on an affected system leveraging the strings passed to the original function. We have an encoded and encrypted output. So what’s the easiest way to get access to the code? You could: 1. Parse OBJECTS.DATA of the affected system and attempt to piece together the Base64 encoded strings in the file for later decryption 2. Create your own decryption routine based on the keys in the bootstrap code 3. Modify one line in the current bootstrap, leverage the adversary’s decryption routine, and get the output. The last option being the fastest and most efficient, the following modification was made to the bootstrap and saved to a PowerShell script to be executed later:

Executing the created script in the exact way as the Event Consumer PowerShell command, save for the EncodedCommand switch, will present you with the actual backdoor in all its glory. Above, we discussed the process used by CrowdStrike analysts when recently investigating COZY BEAR backdoors. This process should help illuminate further indicators of compromise, give an organization the ability to decrypt captured network traffic, and further demonstrate the inherent complexity of a custom backdoor being leveraged by nation-state adversaries. Happy Hunting!