Huntress Finds NPPSPY Used to Capture Cleartext Passwords in an Exchange Intrusion
Summary
Huntress documented NPPSPY deployed during an intrusion to capture cleartext credentials via a malicious Windows network provider. The investigation details the configuration, detection opportunities, and remediation.
Key points
- Huntress found a malicious network provider named logincontroll and a DLL at C:\Windows\System32\lsass.dll on a compromised system.
- NPPSPY intercepts the Winlogon-to-mpnotify credential flow and writes usernames and cleartext passwords to a designated file.
- The designated capture file was C:\Windows\Temp\tmpCQOF.tmp; Huntress reported evidence that email credentials were collected on the compromised Exchange server.
- The team reproduced the technique in a lab and correlated its registry configuration with evidence from the compromised host.
- Detection opportunities include investigating unexplained NetworkProvider registry entries, DLLs, privileged changes, and process activity; the article cautions that filenames and DLL locations can vary.
- Huntress found that removing either the attacker-controlled DLL or its NetworkProvider registry entry stopped the credential file from being written; removing both was recommended.
Article Details
- Attack Vectors
- The threat actor registered an attacker-controlled network provider and DLL so it could intercept cleartext credentials exchanged during the Windows logon process.
- The DLL recorded usernames and passwords to a designated file. The article says the technique required a privileged user, registry changes, and bringing a DLL onto the system.
- Defensive Notes
- Inspect NetworkProvider registry entries and the DLL paths they reference; the article identifies HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order and HKLM\SYSTEM\CurrentControlSet\Services\<provider>\NetworkProvider as relevant locations.
- Use forensic tools such as RegRipper to review suspicious service entries, and monitor processes and commands with tools such as Sysmon.
- Do not rely on missing DLL signatures, version numbers, descriptions, or expected installation directories as detection criteria.
- The article reports that removing only the attacker-controlled DLL or only its NetworkProvider registry entry stopped credential-file writes in testing; remove both to stop the credential-gathering activity.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article explicitly labels the behavior as OS Credential Dumping (T1003) and describes the actor collecting usernames and passwords from the compromised system.T1556 · Modify Authentication ProcessNPPSPY altered the Windows logon authentication process by registering an attacker-controlled network provider DLL that intercepted cleartext credentials.
People
Vendors
Products
Defenderplaces advise how to deploy NPPSPY. The default DLL that Grzegorz kindly provides will get flagged by Defender, but Grzegorz’s kindness knows no bounds, and he provides the C code to compile it yourself.Microsoft Exchange ServerDLL the adversary has created. This slippery DLL simply listens for this clear text credential exchange from winlogon down to mpnotify and then saves this clear text credential exchange.Microsoft WindowsHarlan Carvey, used their forensic wizardry to point the team to find and give some attention to a ‘C:\Windows\System32\lsass.dll’. They had identified that this had been associated with a compromised account and
Tools
NPPSPYHomeBlogCleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPYRegRipperBy leveraging the services plugin for RegRipper v3.0, we will see the very suspicious service name we have already identified with our threat actor’s implementation of NPPSPY.Sysmonsecurity monitoring tools that monitor the processes and commands being run on a machine. You could use Sysmon as a free option. At Huntress, we have our Process Insights listener that makes parent-child process