{"id":6342,"date":"2017-01-23T15:50:28","date_gmt":"2017-01-23T23:50:28","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-180\/"},"modified":"2017-01-23T15:50:28","modified_gmt":"2017-01-23T23:50:28","slug":"news-180","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-180\/","title":{"rendered":"Windows 10: protection, detection, and response against recent Depriz malware attacks"},"content":{"rendered":"

A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender and Windows Defender Advanced Threat Protection Threat Intelligence teams are working on protection, detection, and response to these threats. <\/span><\/p>\n

Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names. <\/span><\/p>\n

Although the extent of damage caused by this latest attack by TERBIUM is still unknown, Windows 10 customers have a set of features available for them to enable to mitigate such attack. Windows 10 has built-in proactive security components, such as Device Guard<\/a>, that mitigate this threat; Windows Defender<\/a> customers are protected through multiple signature-based detections; and Windows Defender Advanced Threat Protection (ATP)<\/a> customers are provided extensive visibility and detection capabilities across the attack kill chain, enabling security operation teams to respond quickly. Microsoft\u2019s analysis has shown that the components and techniques used by TERBIUM in this campaign trigger multiple detections and threat intelligence alerts in Windows Defender Advanced Threat Protection<\/a>.<\/u><\/span><\/p>\n

Attack composition<\/h2>\n

Microsoft Threat Intelligence has observed that the malware used by <\/span>TERBIUM, dubbed \u201cDepriz\u201d by Microsoft, reuses several components and techniques seen in the 2012 attacks, and has been highly customized for each targeted organization. <\/span><\/p>\n

We do not see any indicators that a zero-day exploit is being used by TERBIUM.<\/p>\n

Step 1: Writing to disk<\/h3>\n

The initial infection vector TERBIUM uses is unknown. As credentials have been hard-coded in the malware TERBIUM uses, it is suspected that TERBIUM has harvested credentials or infiltrated the target organization previously. Once TERBIUM has a foothold in the organization, its infection chain starts by writing an executable file to disk that contains all the components required to carry out the data-wiping operation. These components are encoded in the executables resources as fake bitmap images.<\/p>\n

\"shamoon-depriz-implants\"<\/p>\n

Figure 1. The components of the Trojan are fake bitmap images<\/em><\/p>\n

We decoded the components as the following files:<\/p>\n