Full transcript
0:00This is a teeny tiny piece of malware.
0:03It's a key logger written in PowerShell.
0:05Granted, you might not be able to make
0:07too much sense of it right now because
0:09it's all encoded. It's B64 encoding,
0:12just a different representation of the
0:14data, but inside of my Kali Linux
0:16virtual machine, I can open up a
0:17terminal with Ctrl Alt T, F11 to full
0:20screen, and zoom in a little bit so the
0:22text is bigger for us. And if I were to
0:24use a simple command that's accessible
0:25like B 64 and -ash D to decode, we could
0:30actually redirect in this entire payload
0:32just as a string. We could use single
0:34quotes or double quotes back to our B 64
0:37blob. We could start to highlight,
0:39select, and copy this entire thing and
0:42then just paste it into the B 64
0:44command. And it will then spit out the
0:46actual PowerShell. There's a lot here,
0:49so I'll zoom out. And actually, we could
0:50redirect that to a file. Now, this is
0:52much more readable PowerShell code.
0:54There are a couple parameters defined at
0:56the top as to what it could take for
0:58arguments or options with some defaults
1:00for server address, server port, proxy
1:03address, and proxy port. Looks like
1:05they're using an onion address, a little
1:07bit clever, using some communication
1:09over tour, the onion router, or all
1:11those dark web things, and an IP address
1:14for a proxy address and the ports
1:16associated. 9050 is the usual proxy port
1:19for the onion router or tour. So that's
1:21cool. Down below though, they actually
1:24pour in a little bit of C sharp. Now
1:26this is the real power with PowerShell,
1:29right? Is that you could always call
1:30back to other managed code. This is all
1:33defined as a string. Of course, in the
1:35quotes here, you can see all the yellow
1:37text. And they use the add type
1:39commandlet to have this functionality
1:41accessible even in the rest of the
1:43PowerShell code they might use. It looks
1:45like this is a stub just to be able to
1:46make the connection to the proxy. And
1:48there are some other functions defined
1:50like cap-sc
1:53reading in some other assemblies that
1:54they use. Presumably, it's going to grab
1:56the width and height of your computer
1:58screen, take a screenshot, and then save
2:01it to a file with a random temporary
2:03name. They save that file, return it for
2:06the function value, and that's that.
2:08They have some other convenience
2:09functions to encode and decode B 64
2:12data, execute a command in memory with
2:14the invoke expression commandlet,
2:16basically eval.
2:18And some other functions to get system
2:20info. Really just retrieving different
2:22environment information like the
2:24operating system, host name, running
2:26username, and their IP address. Down
2:29beneath that though, we see the
2:30functionality for our key logger. Couple
2:32global variables for whether or not the
2:34key logger is active and what keys we
2:36have captured. And there is a start key
2:39logger function looks like this. Uses
2:41even more C syntax to kind of pull in
2:45other DLS or dynamic link libraries. Now
2:48these are wind32 API functions that they
2:51might be able to call things specific to
2:54the core of Windows maybe some methods
2:57like get async key state, get keyboard
2:59state, map virtual key to unicode. So
3:02what they do is they define these
3:04function delegates kind of like a
3:05prototype as to how you would invoke
3:08that function. They use this signature
3:10variable with the dollar sign prefix as
3:13part of a now API variable where they're
3:16using add type once again to pull in a
3:18little bit more of that power. Then it
3:20starts a job. That means it can run
3:23asynchronously. It's not going to block
3:25or wait for further things to happen,
3:27but it is going to infinitely loop with
3:29the while true condition. sleeps for
3:31about 40 milliseconds and then tries to
3:33loop through all of these asy values.
3:36Beginning with the number nine less than
3:38or beginning with the number nine, while
3:41it's less than or equal to 254, it
3:43checks the key state like each and every
3:46one of the keys on your keyboard. It
3:48basically determines it checks if based
3:50off the keyboard state that keyboard key
3:53is pressed and if it is then it ends up
3:56adding that to a key log.ext file. They
3:59hide that in your temporary directory
4:01based off the environment variable, but
4:03it is writing and logging all of the
4:06keys that are pressed. A key logger,
4:08other convenience functions to stop the
4:10key logger based off that job, checking
4:12for key log data based off of that key
4:15log.ext file, and then the functionality
4:18to make the connections where it would
4:20actually try to exfiltrate this out to
4:22their command and control like the
4:24server address that we saw in those
4:26variables. It looks like it's actually
4:27able to read some info from that C2
4:30server. So, it could provide other
4:32commands whether or not it'll exit, stop
4:34the running program, stop the key
4:36logger, or take a screenshot or even run
4:39or execute other PowerShell commands or
4:42shell commands. Then there's other rat
4:44or remote access Trojan functionality
4:46like upload and download files or of
4:49course start the key logger. There is
4:51even another cutesy persist command
4:54apparently but it doesn't do anything
4:56yet. Uh there are some notes and a
4:58comment here literal PowerShell comments
5:00implement the logic for persistence as
5:02necessary. Uh that will need to be done
5:05I guess in the future like that's a
5:06to-do. There aren't any actual
5:08persistence mechanisms implemented in
5:10this. It just runs forever
5:12asynchronously with PowerShell jobs.
5:15It'll keep trying to connect to or
5:17establish a connection with the provided
5:19arguments, server address, proxy
5:21address, and it does this over and over
5:23and over again every minute. So, tiny
5:25little sliver of malware, right? A
5:28PowerShell key logger. But let me tell
5:30you, this PowerShell malware sample
5:32actually came from another awesome
5:34online cyber security training and
5:36learning environment. This came from
5:38Let's Defend. It's their PowerShell key
5:41logger module. And while you're getting
5:42smarter and sharper in your whole cyber
5:44security career journey in the industry,
5:47they give you this prompt. Look, say
5:49you're a malware analyst investigating a
5:51suspected PowerShell malware sample.
5:53Just as we saw, the malware is designed
5:55to establish a connection with remote
5:57server, execute different commands, and
5:59potentially exfiltrate data. We want to
6:01figure out what it's doing and how it's
6:04doing it. And for your learning, Let's
6:05Defend gives you a handful of questions
6:07to check your understanding and work
6:09through this module, this challenge, and
6:11this lesson. And in case you haven't
6:13seen the news recently, Let's Defend
6:15actually joined Hack the Box, another
6:18awesome cyber security training, cyber
6:20range labs, and exercises to get better,
6:23sharper in your cyber security career.
6:25Let's Defend officially signed the
6:27agreement to be acquired by Hack the
6:29Box, but Let's Defend has always been
6:31about blue team training. They love to
6:33focus on the security operation center
6:36or the sock. So, let's defend built out
6:38a simulated security operation center
6:41and whole environment that offers that
6:42hands-on realistic training. And Hack
6:44the Box does have some blue team and
6:47defensive focused content, but they
6:49always seem to lean a little bit more
6:50towards the offensive security. So, this
6:53is pretty awesome. Big congrats to both
6:55teams. This is a community milestone. I
6:58really like how they put that. But I
6:59realized I don't think I've showcased a
7:01lot of Let's Defend before in other
7:03videos. I've never gotten a chance to
7:04show off some of the sweet stuff that
7:06they have. So, I'm here on their website
7:08and there'll be a link below in the
7:09video description if you wanted to
7:11follow along. But, they love to showcase
7:14education in a path. Give you something
7:16where you could move from one A to B,
7:19from one step and then the next and then
7:21another, and then all the things that
7:23make progress, make some momentum, and
7:25help you keep moving along in your
7:27career. Let me show you some of these
7:29paths. There are a lot of them and this
7:31is awesome. Making a career switch into
7:33cyber security. Maybe learning
7:35specifically digital forensics, incident
7:37response, security information event
7:39management, programming, AWS, Google,
7:42malware analysis, and the sock analyst
7:45learning path. I know a lot of folks
7:47probably going to see a lot of jobs in
7:49the security operations center. So,
7:51there's a lot to cover here. Learn the
7:52technical skills necessary for a career
7:54in the security operations center. and
7:57they break it down, give you the
7:58fundamentals, tell you about all the
8:00things you need to know. And then it's
8:02awesome because you'll have questions,
8:03quizzes, challenges, practice labs, and
8:06environments all along the way. And by
8:08the way, from their learn section, you
8:11could, of course, drill down into any of
8:13the specific courses or lessons or
8:16challenges or quizzes. And they have
8:18this all accessible for you. And you
8:20could easily right up at the very top,
8:22we could toggle or use any filters that
8:24we might like for any job that you're
8:26interested in, like a security analyst,
8:28like an instant responder, like a
8:29detection engineer. Like this is all to
8:32help jumpstart you on your work. If you
8:35wanted to follow along or even try some
8:37more of these on your own, different
8:38challenges, different courses, different
8:40education paths, lessons, quizzes, even
8:42some prep for different certifications,
8:44look, there's a link in the video
8:46description. And of course, Let's Defend
8:48is always offering a sweet free tier,
8:51but of course, there is an awesome Black
8:53Friday deal where they're doing 50% off,
8:55literally half off. That discount code
8:58is Black Friday with the A and I letters
9:01removed. AI removed. I like that. You
9:03can use that for VIP, VIP Plus, and I
9:06believe there is even toggling that to
9:08monthly. You could use Black Friday 35.
9:10So, you could get either a monthly or
9:12annual plan if you are a student.
9:14However, they already always offer a 50%
9:18discount for students, which is wild.
9:20They verify with your student email
9:22address and then you could get 50% off
9:24and 50% off Black Friday based off of
9:28the student discount code and the Black
9:30Friday deals. Kind of neat. I also have
9:32my own sweet little discount code. If
9:34you were going to snag an annual plan,
9:36you could use a discount code. And let
9:38me uh rightclick, change the text here.
9:40You'll be fine. John55.
9:43That one will get you 55% off an annual
9:45plan. And I believe that's active for at
9:46least I think two weeks after this video
9:48releases. So, please jump at it. And
9:50they have a full-blown security
9:51operation center like sock simulation.
9:54If you jump over to the practice tab,
9:56you can see in the monitoring section
9:57I'm in all these different alerts with
10:00their severity, with their details.
10:02Maybe we could drill down into anything
10:03that we're curious about and understand
10:05a little bit more as to what would we go
10:07triage and analyze and understand what
10:10to track down next. If you wanted to see
10:12even more telemetry, the log management
10:14section shows you all the different
10:16things that it could pull some info from
10:18and of course drill down into this. So
10:20you've got a similar interface to what
10:21you're probably going to be working with
10:23in the real security operation center,
10:25even making up different cases for
10:27specific incidents, looking at things
10:29from a specific endpoint. And this is
10:31really cool. We could actually drill
10:33down into, hey, what's happening on the
10:35SharePoint server? What's going down on
10:38any of the other boxes that we really
10:40want to see? what processes are running
10:42where and when and how. Toggle that to
10:44network action, terminal history, maybe
10:46browser history, all the things that
10:48help triage and analyze in an incident.
10:50Here I jumped over to the email security
10:53section and maybe we're getting an idea
10:55for oh some of the threats, some of the
10:56other info that could come through. And
10:58these are all things just to get you
10:59acquainted and familiar with what's the
11:01security operation center analyst like
11:03daily routine. So that could help in
11:06different interviews or different
11:08employment opportunities out there for
11:09your career. Looking at indicators of
11:11compromise, working inside of a sandbox,
11:13you could even spin up these labs, which
11:16is super cool. Well, this one spins up.
11:18In fact, you might have noticed the
11:19PowerShell key logger that we started
11:21with actually includes its own lab
11:24environment as part of the challenge.
11:26And we'll roll through a little capture
11:27here. Once that is done, then we'll spin
11:30up our own machine. So you don't have to
11:32download anything when you're walking
11:34through any of the Let's Defend
11:35material. It's all in the browser and
11:37makes it super easy to spin up. All
11:39right. So my lab has spun up and we can
11:42see we can interact with a Windows
11:43virtual machine here. I do have the
11:45challenge file or the folder on my
11:47desktop. And that was the sample
11:50sevenzip that we could go ahead and
11:51extract. Might as well extract it here.
11:53The password they told us above was
11:55infected. Just the usual malware sample
11:59standard password. And this file cha or
12:02chaw was that PowerShell key logger that
12:05we were exploring. Opening this with
12:07Notepad++.
12:08Yep. Exact same syntax that we saw
12:11previously. Wasn't B 64 encoded. I just
12:14kind of put that in so we have a little
12:15bit more cutesy fireworks for the start
12:17of the video. Whatever, you know. So,
12:19let's roll through some of the questions
12:21here. It asks, what is the proxy port
12:23used by the script? Well, we saw 9050.
12:26Correct. Excellent. That's correct. What
12:29function method is used for starting the
12:31key logger? Well, I think that was
12:32pretty simply called start key logger.
12:35Right, submit that. Correct. What is the
12:38name of the file used by the script to
12:40store the key log data? We saw that in
12:43like the temporary directory under the
12:44file name key log.ext, I believe. What
12:47is the command used by the script to
12:49achieve persistence? Uh, we saw that in
12:52like the strings that were kind of
12:54interpreted based off of what the
12:56command and control or C2 server sent
12:58us, right? It was persist. Yep. Did I
13:00get the other one above? Good. What is
13:01the command used by the script to upload
13:03data? I think that was just upload.
13:05Okay. So, small simple stuff getting us
13:08grooving here. Oh, you're very close to
13:10the right answer. What did I miss?
13:12Looking back at this syntax, I could
13:15have sworn it was upload. What am I
13:19misremembering? Oh, there's a colon at
13:21the end. That's all. Is that all it
13:23needs? Upload colon. How about that?
13:26Yeah. What is the reax or the regular
13:29expression used by the script to filter
13:32IP addresses? Oh, I remember seeing
13:35that. But we do have a get unstuck
13:37option here in case you ever needed a
13:39little bit more help. Or a hint, you
13:40could ask in the forum or in Discord or
13:42even just click the button. Oh, view the
13:44hint for this question. Focus on the
13:46script section that checks for specific
13:48IP ranges. Okay, we saw that previously,
13:52didn't we? Yeah, it was in the beginning
13:54for get system info. This function here,
13:57they use this PowerShell command get net
14:00IP address where the address family is
14:04equal to IPv4 and the address does not
14:07match this regular expression. So,
14:10special magic syntax carrot symbol for
14:13the very start of a string. Inside of
14:15parenthesis, we have a group where there
14:17are options. The first option is a 127
14:21literal characters and a backslash to
14:23escape out a dot or a period for literal
14:26representation of a dot. And then 169
14:29dot literal 254 literal dot. So it's
14:33this this is the regular expression that
14:34we're looking for. But that's to
14:36determine oh is this a local IP address
14:38or something kind of like within the
14:40network. Let's go ahead and paste that
14:42there. Good. What is the DL imported by
14:45the script to call key logging APIs? Oh,
14:47we saw that in the start key logger
14:50function just the very beginning. That
14:51was that user 32.dll like the dynamic
14:54link library, right? That is the Windows
14:58natural installed library that's part of
15:00the file system, part of your path. They
15:02could import it easily with this little
15:04header DLL import and user 32. DLL is
15:09the answer that we want. Good. How many
15:12seconds does the script wait before
15:14reestablishing connection? Wasn't it
15:15just 40? But it was like 40
15:17milliseconds, right? Am I
15:18misremembering? It tries to establish a
15:21connection, but the actual call for that
15:24is here in that main loop. Yeah. Okay.
15:26No, just 60 seconds. It's It's a minute.
15:29I was looking at like 40. I could have
15:31sworn it was milliseconds. Yeah. Okay.
15:33Different part of the code. The
15:34establish connection down here. Start
15:37sleep for 60 seconds. So 60. How about
15:40that? All right. We did it. All righty.
15:44Simple showcase today. Just a little
15:46PowerShell malware, PowerShell key
15:48logger that still ties itself back to
15:50some sweet learning, more education that
15:52you might be able to take some good
15:53advantage of during the holiday season.
15:55Hope you snag that Black Friday deal.
15:56Hope you go check out Let's Defend. Big
15:58congrats to them on the acquisition and
16:00joining up with Hack the Box. Super cool
16:02stuff. Please do give them some love.
16:03Link below in the video description.
16:05Thanks so much for watching. I'll see
16:06you in the next video.