MalwareExploits 2 CVEs

Pydomer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2021-26855ProxyLogon Pre-auth SSRF in Microsoft Exchange ServerExploited in the wild

In one notable example, the Lemon Duck operators compromised a system that already had xx.bat and a web shell. After establishing persistence on the system in a non-web shell method, the Lemon Duck operators were observed cleaning up other attackers’ presence on the system and mitigating the CVE-2021-26855 (SSRF) vulnerability using a legitimate cleanup script that they hosted on their own malicious server.

via microsoft generalmicrosoft.com

CVE-2021-27065Post-auth arbitrary file write in Microsoft Exchange Server ECP (ProxyLogon chain)Exploited in the wild

Appendix Microsoft Defender for Endpoint detection details Antivirus Microsoft Defender Antivirus detects exploitation behavior with these detections: ... Exploit:ASP/CVE-2021-27065 ... Defending against exploits and post-compromise activities Attackers exploit the on-premises Exchange Server vulnerabilities in combination to bypass authentication and gain the ability to write files and run malicious code.

via microsoft generalmicrosoft.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

Attackers exploit the on-premises Exchange Server vulnerabilities in combination to bypass authentication and gain the ability to write files and run malicious code.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

The script fetches a payload... first attempting to spread the payload over WMI using Invoke-WMIMethod

T1059.001PowerShellEvidence1

Lemon Duck... choosing to use a fileless/web shell-less option of direct PowerShell commands from w3wp... ran standard Invoke Expression commands to download a payload.

T1059.003Windows Command ShellEvidence1

The web shell writes a batch file to C:\Windows\Temp\xx.bat... this batch file performs a backup of the Security Account Manager (SAM) database and the System and Security registry hives

Persistence

1 technique

T1505.003Web ShellEvidence1

many of the unpatched systems we observed had multiple web shells on them... The DoejoCrypt attacks start with a variant of the Chopper web shell being deployed to the Exchange server post-exploitation.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

test.bat batch file... allowed them to perform a dump of the LSASS process... an additional overlapping activity... was the running of scripts to snapshot Active Directory with ntdsutil

T1003.001LSASS MemoryEvidence1

allowed them to perform a dump of the LSASS process... using the COM services DLL as a living-off-the-land binary to perform a dump of the LSASS process

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The first existing ransomware family to capitalize on the vulnerabilities was Pydomer... the operators scanned and mass-compromised unpatched Exchange Servers

Lateral Movement

2 techniques

T1021.006Windows Remote ManagementEvidence1

The file also enables Windows Remote Management and sets up an HTTP listener... and falling back to PowerShell remoting with Enter-PSSession if that fails.

T1570Lateral Tool TransferEvidence1

The script fetches a payload... and attempts to spread the payload throughout the network

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

One randomly named scheduled task connects to a C2 every hour to download a new payload... the web shell drops a new payload to C:\Windows\Help

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Today, we are sharing intelligence about what some attackers did after exploiting the vulnerable servers, ranging from ransomware to data exfiltration

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

starting to encrypt in limited numbers shortly after the patches were released... This payload is the DoejoCrypt ransomware

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 months ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

microsoft generalNews

Mar 25, 2021

Analyzing attacks taking advantage of the Exchange Server vulnerabilities | Microsoft Security Blog

Ransomware used after mass compromise of unpatched Exchange servers. Operators dropped web shells, used test.bat to dump LSASS, then delivered a Python-compiled ransomware payload via PowerShell downloader/spreader. It encrypted files with random extensions, dropped decrypt_file.TxT, and in some cases used extortion notes without encryption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

Pydomer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2021-26855ProxyLogon Pre-auth SSRF in Microsoft Exchange ServerExploited in the wild

via microsoft generalmicrosoft.com

CVE-2021-27065Post-auth arbitrary file write in Microsoft Exchange Server ECP (ProxyLogon chain)Exploited in the wild

via microsoft generalmicrosoft.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

Attackers exploit the on-premises Exchange Server vulnerabilities in combination to bypass authentication and gain the ability to write files and run malicious code.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

The script fetches a payload... first attempting to spread the payload over WMI using Invoke-WMIMethod

T1059.001PowerShellEvidence1

Lemon Duck... choosing to use a fileless/web shell-less option of direct PowerShell commands from w3wp... ran standard Invoke Expression commands to download a payload.

T1059.003Windows Command ShellEvidence1

The web shell writes a batch file to C:\Windows\Temp\xx.bat... this batch file performs a backup of the Security Account Manager (SAM) database and the System and Security registry hives

Persistence

1 technique

T1505.003Web ShellEvidence1

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

test.bat batch file... allowed them to perform a dump of the LSASS process... an additional overlapping activity... was the running of scripts to snapshot Active Directory with ntdsutil

T1003.001LSASS MemoryEvidence1

allowed them to perform a dump of the LSASS process... using the COM services DLL as a living-off-the-land binary to perform a dump of the LSASS process

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The first existing ransomware family to capitalize on the vulnerabilities was Pydomer... the operators scanned and mass-compromised unpatched Exchange Servers

Lateral Movement

2 techniques

T1021.006Windows Remote ManagementEvidence1

The file also enables Windows Remote Management and sets up an HTTP listener... and falling back to PowerShell remoting with Enter-PSSession if that fails.

T1570Lateral Tool TransferEvidence1

The script fetches a payload... and attempts to spread the payload throughout the network

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

One randomly named scheduled task connects to a C2 every hour to download a new payload... the web shell drops a new payload to C:\Windows\Help

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Today, we are sharing intelligence about what some attackers did after exploiting the vulnerable servers, ranging from ransomware to data exfiltration

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

starting to encrypt in limited numbers shortly after the patches were released... This payload is the DoejoCrypt ransomware

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 months ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

microsoft generalNews

Mar 25, 2021

Analyzing attacks taking advantage of the Exchange Server vulnerabilities | Microsoft Security Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.