Powershell.exe outbound connections after malware removal

[Technikul]

Morning, we've got a server that is continuing to prompt powershell.exe outbound connections using Malwarebytes. From what I can tell it's occurring every 40 minutes. We believe this might be a payload from a recently cleaned Exchange server that fell victim to the Hafnium exploit. 

I ran the FRST tool and have provided the needed logs for review. Thank you in advance!

Addition.txt FRST.txt

[TwinHeadedEagle]

Hi,

Were you asked to reboot the server after MalwareBytes cleanup?

Edited March 16, 2021 by TwinHeadedEagle

[Technikul]

No I was not. we can reboot if needed though.

[TwinHeadedEagle]

Yes, please do so and then attach fresh FRST reports.

[Technikul]

Here you go!

Addition.txt FRST.txt

[TwinHeadedEagle]

Do you still have blocked powershell connections?

[Technikul]

Yes, the most recent one was 11:32 am and the server has been online for 45 minutes so far. 

[Technikul]

OH oddly enough I haven't had anymore since 11:32 am

[Technikul]

Thanks for your help. Looks like the powershell.exe outbound connections have stopped but we've now got the following

Compromised   Inbound Connection IP Address 222.186.136.150 Port: 443 File: C:\xammp\apache\bin\httpd.exe
Compromised   Inbound Connection IP Address 222.112.190.70 Port: 80 File: C:\xammp\apache\bin\httpd.exe

Trojan   Inbound Connection IP Address 209.141.60.60 Port: 443 File: C:\xammp\apache\bin\httpd.exe

And various similar reports from different IPs but same port number. This is a FileCloud server by the way. 

I've reattached the latest FRST and JSON files.

Thank you again!   

Addition.txt FRST.txt

[Technikul]

Nevermind the JSON report files didn't get uploaded.

[TwinHeadedEagle]

Ok, let's do this:

• Open FRST again
• In the search field copy and paste this 

  {73C25191-3831-490A-904A-0B477D0F92D8};{B73C93B1-3B2E-424C-8162-8EFC41C7410F}

   

• Click on Search Registry

Attach SearchReg.txt once it is done.

Edited March 17, 2021 by TwinHeadedEagle

[Technikul]

Here you go!

SearchReg.txt

[TwinHeadedEagle]

Ok, I will need an export of those keys with the following batch file. It is inside attached archive.

Run the batch file as Administrator and once done upload reg_export.txt from your Desktop.

 

taskexport.zip

Edited March 17, 2021 by TwinHeadedEagle

[Technikul]

Thanks, it didn't generate a reg_export.txt for some reason but I've got 4 separate files the batch file created. 

 

3.txt 4.txt 1.txt 2.txt

[TwinHeadedEagle]

It is fine, I've made a mistake in the batch. I will get back to your shortly.

[TwinHeadedEagle]

We will need some other reports as well
Please download MBST
https://downloads.malwarebytes.com/file/mbst

Once you start it click Advanced > Gather Logs

Upload an archive once it is done.

[Technikul]

Here you go!

 

mbst-grab-results.zip

[TwinHeadedEagle]

I am sorry we'll need another registry export
Open Command Prompt and run this command:

reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree" %USERPROFILE%\Desktop\regexport.txt

Question about this since this is a state sponsored Hafnium related indicator of compromise. Did you do any remediation manually, like scanning with other tools, doing a manual removal of the indicators of compromise or first thing you noticed is that outbound block?

[Technikul]

Yes, we used Emsisoft Emergency Kit scanner to help remediate the threats. It did remove malicious scheduled tasks "WinNet" and "Sync"(apparently) and we also used Microsoft Safety Scanner.

[Technikul]

regexport.txt

[TwinHeadedEagle]

It seems that Emsisoft didn't properly remove the task so it still keeps running. Because if was damaged MalwareBytes cannot detect it this way.

I am going to need one more export and after that we'll delete those. Open Command Prompt as Administrator:
 

reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B73C93B1-3B2E-424C-8162-8EFC41C7410F}" %USERPROFILE%\Desktop\reg_export.txt

Attach reg_export.txt

Open Command Prompt as Administrator and type one after the other:

 

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{73C25191-3831-490A-904A-0B477D0F92D8}" /F
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73C25191-3831-490A-904A-0B477D0F92D8}" /F
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B73C93B1-3B2E-424C-8162-8EFC41C7410F}" /F
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B73C93B1-3B2E-424C-8162-8EFC41C7410F}" /F

 

Edited March 17, 2021 by TwinHeadedEagle

[Technikul]

Thanks, I got access is denied for each of those lines. I did run command prompt as admin too. 

Here is the new reg_export.txt though. 

reg_export.txt

[TwinHeadedEagle]

Ok, let's do it with FRST. 

Download attached fixlist.txt and move it to the same location as FRST. Open FRST and click Fix. Fixlog.txt should be generated, attach it please.

fixlist.txt

[Technikul]

Done, would you like me to do anything else now?

[TwinHeadedEagle]

This is all. You could attach Fixlog.txt just to confirm if those registry keys were removed.