SOC153 - Suspicious Powershell Script Executed

Summary

TRUE POSITIVE

Malicious script payload_1[.]ps1 was downloaded and executed on host Tony, reaching out to the IP addresses: 161[.]22[.]46[.]148 and 91[.]236[.]116[.]163. C2 Domain identified as kionagranada[.]com. Host has been contained to prevent spread and gather forensic evidence.

Alert

An alert for a suspicious powershell script being executed on one of our endpoints has come in. The script payload_1[.]ps1 has been executed on our host Tony with the AV/EDR only detecting the execution, but taking no further action.

SIEM Alert

Investigation

Initial Triage & Verification

Looking into the logs we can sort by the source IP of the host Tony and see the activity that took place around the time of the alert. The first log around the timeframe shows the script was downloaded using the chrome browser on the host Tony from the URL hxxps://files-ld[.]s3[.]us-east-2[.]amazonaws[.]com/payload_1[.]ps1

Log of the downloaded file

Immediately after the download, a PowerShell command bypassed the execution policy protection and ran the downloaded script.

Log of script execution

Checking the hash of the script against VirusTotal, it shows that this script is labelled as a Trojan.Powershell/Boxter. This confirms that this is a true positive event and we will isolate the host Tony from the network using our AV/EDR platform.

VirusTotal report of the downloaded script

Command & Control Activity

After isolating the host and looking further into the logs we can see a DNS query was spawned by powershell querying a domain named kionagranada[.]com.

DNS query

This is followed by a firewall log of a successful connection to the returned address, potentially being a C2 connection for the malware. The parent process for the log is explorer[.]exe, suggesting the malware was executed by a human present at the host Tony.

Successful connection to possible C2 server

Following the successful connection to the C2 server, a remote script from the C2 domain was retrieved and executed.

Execution of a secondary action from the potential C2 domain

Following that, another suspicious request was sent to the URL: hxxp://91[.]236[.]116[.]163/INDEX.PHP?ID=90059C37-1320-41A4-B58D-2B75A9850D2F&SUBID=9G6CLLE6

Potential connection to another/alternate C2 IP

A thorough review of available logs did not identify any evidence of lateral movement or further spread to other devices on the network. However, given that the malware was able to execute code on the host, it is possible that it had the capability to interfere with logging or telemetry, meaning the absence of evidence should not be treated as conclusive. Continued monitoring across the network is recommended, and any additional signs of lateral movement should be escalated immediately. The host should be forensically investigated for signs of logging or telemetry tampering as well as other IOC’s.

IP Analysis

Checking against both VirusTotal and AbuseIPDB, the IPs associated with the attackers do not show any current malicious activity. Given the confirmed malicious activity observed in this incident, both IPs should be submitted to threat intel platforms.

Recommendations

• Investigate the host Tony for any traces of persistence
• Investigate devices on the network and network traffic to determine if the malware was spread and monitor for continued malicious activity
• Identify who had access to the host Tony and determine if they are complicit in the breach
• Further investigate the malware payload_1.ps1 and determine its purpose/intent
• Block IPs 161[.]22[.]46[.]148 and 91[.]236[.]116[.]163 as well as domain kionagranada[.]com in the firewall/proxy and report these IOC’s as malicious to threat intel platforms.

Appendix

Indicators of Compromise

Type	Value
Malware Name	payload_1[.]ps1
Malware Hash	db8be06ba6d2d3595dd0c86654a48cfc4c0c5408fdd3f4e1eaf342ac7a2479d0
Attacker IP Address	161[.]22[.]46[.]148, 91[.]236[.]116[.]163
Attacker Domain	kionagranada[.]com