Infected Workstation with C:\Windows\System32\WindowsPowerShell\v1.0\power

[Shvanf]

Hi, we recently got hit with malware and we removed all malware successfully use malwarebytes prem on the first day but now there popups every 20m on half of workstations.

[Maurice Naggar]

Hello. My name is Maurice. I will be guiding you.

If you have Malwarebytes for Teams be sure you say so & in which case, be sure you know that MBT entitled you to have Priority support with Malwarebytes Support thru their ticket / online portal.

It is imperative to get the detection log from the last Block event.  Go to detection history.  2nd half of link.  Get the Advanced one from detection history.  And attach 

 

https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows

 

 

 

[Shvanf]

hi Maurice

please see attached as requested, thanks,

Report.docx

[TwinHeadedEagle]

Hi,

I will step in until Maurice gets back. We will need a MBST tool to be run so we can see what was removed and what possibly remains that causes those blocks to happen.

You can find the tool on this link: https://downloads.malwarebytes.com/file/mbst

Simply start it, click Advanced and Gather logs. Upload the archive here once tool finishes.

[Shvanf]

hi, please see zip logs. thanks.

mbst-grab-results.zip

[TwinHeadedEagle]

I see the problem. Did you use any other software prior to scanning with Malwarebytes or did you try to remove malware manually?

[Shvanf]

We tried multiple software and didnt work, picked up nothing. and then finally, yes, we tried manually.

[TwinHeadedEagle]

We have faced this problem before where other software (Emsisoft in last case) improperly removed the scheduled task so that MalwareBytes couldn't remove it properly.

On this machine where you run MBST on you need to remove these keys:
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5CC81276-AEF2-401B-A111-A5492B5D47C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CC81276-AEF2-401B-A111-A5492B5D47C6}

If you check under TaskCache\Tasks\{5CC81276-AEF2-401B-A111-A5492B5D47C6} you will see that there is a value named Path with \Winnet data. This belongs to malware. 

After you remove the keys above, restart the endpoint. 

Edited March 21, 2021 by TwinHeadedEagle

[Shvanf]

will try now and restart.

Unfortunately, we have around 8 more machines infected and i cant see the a value Path with \Winnet  data in the registery for these!

Would it be possible to let me know how to found the value or do you need the support logs for each device? thanks.

[TwinHeadedEagle]

You can search registry on each endpoint manually in Registry Editor.

• Open Regedit.exe 
• Ctrl + F to open search

• Make sure that you copy GUID as it needs to also be removed under \TaskCache\Plain. In my case it was {33E1EAF7-83D9-4470-95A6-6DF9639E04E6}
• It means that I would delete these keys:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{33E1EAF7-83D9-4470-95A6-6DF9639E04E6}
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{33E1EAF7-83D9-4470-95A6-6DF9639E04E6}

• Reboot every endpoint after you delete keys.

 

Let me know if you need any additional help.

[Shvanf]

hi, sorry for the delay. we tried to do the \winnet registry removal on another machine but this didnt work.

also, we have purchased new team licenses but yet to apply.

see attached gathered logs. thanks

mbst-grab-results 2.zip

[TwinHeadedEagle]

MalwareBytes was updated to detect some registry keys. Please run a scan on all endpoints and make sure you reboot each on after do a scan.

[Shvanf]

hi, am sorry to say it is still happening. couple of hours ago we had another intrusion on another machine and this time avast or malwarebyte did even blocked it. it does show in malwarebyte's notifications - see screen shot. thanks.

[Shvanf]

this time, we havnt deleted the suspicious file. see attached.

[Maurice Naggar]

If I may interject for a moment.  Instead of taking a screenshot of the Notification section.....look at my top reply & Export out the last 2 or 3 BLOCK report.

It's important to see any IP addresses & other info.

 

[TwinHeadedEagle]

@Shvanf That randomly named file on the last image is actually a legitimate Powershell executable renamed probably to avoid behavioral blockers. It is however misused/misplaced so that will be taken care of in our next update. Malicious web blocks you are getting are related to LemonDuck miner, we have a database update ongoing that should remove those as well. Database update should be completed in next couple of hours.

[Shvanf]

apologies, please see history report for last two notifications. thanks.

history1.docx history2.docx

[Maurice Naggar]

Thanks for those.

I understand that TwinheadedEagle has provided you some procedures to do.

Please be sure to do those.

[Shvanf]

just waiting for a window to restart all the machines. also, please see current 3 logs attached (just incase!). thanks

log1.txt log2.txt log3.txt

[Maurice Naggar]

Yes. All 3 are in similar IP range as before. 127.42.0.xx

[Maurice Naggar]

Be sure that you did delete the 2 registry keys related to Taskcache that were cited before by TwinHeadedEagle before 

https://forums.malwarebytes.com/topic/272004-infected-workstation-with-cwindowssystem32windowspowershellv10power/?do=findComment&comment=1446288

 

[TwinHeadedEagle]

@Shvanf Did you do as instructed to scan all endpoints and reboot after? If you did you can run MBST tool again and attach the archive for our review once again.

[Shvanf]

not yet, just waiting to get the go ahead.

[TwinHeadedEagle]

Do as scan whenever you want.

[Shvanf]

popups have stopped last night at 11:48. scan and picked up nothing. all looks good now.