Attackers Brute-Forced MSSQL, Disabled Antivirus, and Established Persistence

Jul 17, 2017 · Original article ↗

Summary

Huntress reconstructs an MSSQL breach in which attackers brute-forced credentials, used xp_cmdshell to disable antivirus and download malware, then created registry and service persistence.

Key points

Windows event logs showed more than 37,000 failed MSSQL login attempts before attackers authenticated, including attempts against the “sa” account and 20 other usernames.
After gaining database access, attackers enabled MSSQL’s xp_cmdshell feature and altered registry keys to run native commands.
Attackers used Image File Execution Options Debugger values to launch taskkill.exe in place of targeted processes, impairing antivirus.
They attempted to stop Windows Firewall and used FTP answer files to download crimeware, remote access tools, and cryptocurrency miners.
Persistence included malicious Run keys and a service that launched a UPX-packed binary at startup.
The binary reportedly could install its own persistence and contacted fyunf[.]f3322[.]net; Huntress also published associated hashes and malicious IP addresses.

Article Details

Attack Vectors: Attackers brute-forced weak MSSQL credentials, including the sa account, making more than 37,000 login attempts before authenticating.
After gaining database access, attackers enabled xp_cmdshell to run native shell commands and modified registry keys to ensure command execution.
Attackers abused Image File Execution Options (IFEO) Debugger values to run taskkill.exe instead of targeted processes, disabling antivirus applications.
Attackers attempted to disable Windows Firewall by stopping the SharedAccess service, then used FTP answer files to download malicious files.
Malicious Run keys and a service provided persistence, launching malware at login or startup.
Defensive Notes: Use strong, non-default credentials for MSSQL accounts, especially sa, and restrict remote database access.
Disable xp_cmdshell unless it is required, and apply Group Policy restrictions to limit command execution.
Monitor Windows Event Logs for repeated failed MSSQL logins and review registry changes involving IFEO Debugger values and Run keys.
Monitor for unauthorized service creation, unexpected FTP answer-file activity, antivirus process termination, and attempts to stop SharedAccess.
Huntress identified the malicious Run key and service activity; the article recommends security expertise beyond firewall and antivirus configuration.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`fyunf[.]f3322[.]net`	Domain the malware was reported to contact frequently.
IPV4	`103[.]228[.]131[.]193`	Listed in the article's malicious IP address indicators.
IPV4	`103[.]230[.]108[.]85`	Listed in the article's malicious IP address indicators.
IPV4	`107[.]179[.]126[.]94`	Listed in the article's malicious IP address indicators.
IPV4	`114[.]80[.]253[.]90`	Listed in the article's malicious IP address indicators.
IPV4	`117[.]21[.]191[.]79`	Listed in the article's malicious IP address indicators.
IPV4	`118[.]192[.]151[.]7`	Listed in the article's malicious IP address indicators.
IPV4	`118[.]193[.]231[.]203`	Listed in the article's malicious IP address indicators.
IPV4	`14[.]152[.]95[.]39`	Listed in the article's malicious IP address indicators.
IPV4	`23[.]238[.]133[.]194`	Listed in the article's malicious IP address indicators.
IPV4	`42[.]51[.]33[.]115`	IP address reported as a frequent malware callback destination.
IPV4	`49[.]4[.]135[.]126`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]135[.]223`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]142[.]141`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]142[.]187`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]142[.]195`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]142[.]49`	Listed in the article's malicious IP address indicators.
IPV4	`49[.]4[.]143[.]176`	Listed in the article's malicious IP address indicators.
IPV4	`58[.]221[.]72[.]196`	Listed in the article's malicious IP address indicators.
IPV4	`58[.]253[.]66[.]22`	Listed in the article's malicious IP address indicators.
IPV4	`59[.]33[.]252[.]251`	Listed in the article's malicious IP address indicators.
IPV4	`59[.]63[.]189[.]106`	Listed in the article's malicious IP address indicators.
SHA256	`085ba2ddcae15e2dd996b8152d6512c53958e7e6ae0bd87a5f2f7c7e4352428e`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`4187894e15916bb51bb7c7f9297e15a6ddec9839ead55148c7e62821d42a5bab`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`420bdfbd9df7773185c39a771d24b6ffa7a38c3983ce08448b55182bbe77d004`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`42a0e84845714ee18f63f80e37b26fe7c29f52cd76305db6c10d51c0534e6a53`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`477d7ad7fc262f168df18f61334ea2e0499de71ffd04f2fe23513f3d441e83e2`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`748e5d31dfd30eeb2e34423f8b7c173b1c0585a98aecd57ef955bbfdb01b74ec`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`a603f7ceb5f80069674b31879acbfd3aeb7786e43a910194270740602b939406`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`e62d433e662bff743e8d0fc554c2308db6c72fa500e64091d76e127445f337e1`	SHA-256 hash listed among the incident's indicators of compromise.
SHA256	`ed756c1cd9167690ad6a054c5b25a246289c93adb48e94f864b47d847bfd176e`	SHA-256 hash listed among the incident's indicators of compromise.