SQL Injection Attackers Reshape a Victim’s Environment with Persistence and Malware
Summary
Huntress details an incident in which attackers exploited SQL injection to access an endpoint, establish remote persistence, install BadIIS modules and an XMRig miner, and evade detection.
Key points
- Attackers gained endpoint access by exploiting an SQL injection flaw in a web page hosted alongside IIS.
- They used PowerShell to run reconnaissance, including tasklist /svc, and sent the results to 334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com.
- The attackers enabled Remote Desktop Services, created an administrator account named adminweb2$, and disabled Windows Defender.
- They installed BadIIS modules HttpFastCgiModule.dll and HttpCgiModule.dll, associated with SEO fraud techniques.
- They downloaded an XMRig cryptocurrency miner, concealed related files with Windows attributes, and configured persistence using nssm.exe.
- Huntress recommends identifying and fixing the initial access route, maintaining an accurate asset inventory, reducing attack surface, and monitoring applications and endpoints.
Article Details
- Attack Vectors
- The actor gained access by exploiting SQL injection in a web page on an endpoint running IIS; the article says user input was not properly validated.
- After access, the actor used base64-encoded PowerShell to download scripts and payloads.
- The actor enabled Terminal Services, created the adminweb2$ account, added it to the local Administrators group, and used it to authenticate remotely.
- Defensive Notes
- Determine and remediate the root cause of an incident so the original access path cannot be reused.
- Maintain an accurate inventory of systems, applications, and versions; reduce the attack surface; remove unauthorized applications; restrict access and use MFA; and keep active applications updated and monitored.
- Monitor post-compromise activity, including new accounts, remote-access changes, endpoint activity, and modifications that may hide files or reduce security visibility.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com | The actor sent the output of tasklist /svc to this domain in an HTTP POST. |
| DOMAIN | pub-c4c8e8c336c3429d97195076bf3bb6eb[.]r2[.]dev | The actor downloaded the qdcjoke1.2.ps1 script from this domain. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe actor enabled Terminal Services and used it to authenticate to the endpoint.T1059.001 · PowerShellThe actor used PowerShell to download scripts and send tasklist /svc output.T1136.001 · Local AccountThe actor created the local account adminweb2$.T1190 · Exploit Public-Facing ApplicationThe actor gained access by exploiting SQL injection in a web page.T1505.004 · IIS ComponentsThe actor installed BadIIS modules on the IIS web server.T1543.003 · Windows ServiceThe actor used nssm.exe to create persistence for the cryptocurrency miner as a Windows service.T1562.001 · Disable or Modify ToolsThe actor disabled Windows Defender.T1564.001 · Hidden Files and DirectoriesThe actor set files associated with the miner to hidden and other attributes to cloak them.
People
Malware
BadIISexceptionally broad range of post-compromise modifications across an organization, including installing BadIIS modules, adding new users accounts, and more.XMRigAs seen in Figure 2 above, the threat actor also downloaded the XMRig cryptocurrency miner (xmr-1.zip) to the endpoint, before making several more moves:
Vendors
Products
CnCrypt ProtectFinally, the threat actor added CnCrypt Protect, as shown in Figure 3, likely to assist further in defense evasion.Internet Information Services (IIS)outlined by Cisco Talos researchers, BadIIS is a family of malicious modules for Microsoft's Internet Information Services (IIS) web server, which are used to launch large-scale SEO fraud through various functionsMicrosoft Remote Desktop Servicesout a series of steps to help set up persistent access to the victim's environment. They enabled Terminal Services (now renamed to Remote Desktop Services) on the endpoint, then created a new user account namedMicrosoft SQL ServerThe June 26 incident started with the Huntress SOC detecting and reporting malicious activity via a Microsoft SQL Server (MSSQL) instance (sqlservr.exe). Digging deeper into the investigation, Huntress analystsMicrosoft Windowsenvironment to hide their tracks or work in some persistence. That might look like enabling the built-in Windows Guest account. It might be running Windows CLI commands like tasklist /svc to sniff out what processes aWindows Defendernewly-enabled Terminal Services. The threat actor also tried to evade security tools by disabling Windows Defender – although interestingly, they did not make any attempt to target other installed security services,
Tools
appcmd.exeThe threat actor used appcmd.exe to install some of the known BadIIS modules (HttpFastCgiModule.dll and HttpCgiModule.dll), shown in Figure 1.NSSMThey then created persistence for the cryptocurrency miner using nssm.exe, the "non-sucking service manager", a freely available utility for creating a resilient Windows service from a standalone executable.