Fantasy – a brand new Agrius wiper deployed by way of a provide‑chain assault

ESET researchers found a brand new wiper and its execution device, each attributed to the Agrius APT group, whereas analyzing a supply-chain assault abusing an Israeli software program developer. The group is thought for its harmful operations.

In February 2022, Agrius started concentrating on Israeli HR and IT consulting corporations, and customers of an Israeli software program suite used within the diamond trade. We imagine that Agrius operators carried out a supply-chain assault abusing the Israeli software program developer to deploy their new wiper, Fantasy, and a brand new lateral motion and Fantasy execution device, Sandals.

The Fantasy wiper is constructed on the foundations of the beforehand reported Apostle wiper however doesn’t try to masquerade as ransomware, as Apostle initially did. As an alternative, it goes proper to work wiping information. Victims have been noticed in South Africa – the place reconnaissance started a number of weeks earlier than Fantasy was deployed – Israel, and Hong Kong.

Group overview

Agrius is a more moderen Iran-aligned group concentrating on victims in Israel and the United Arab Emirates since 2020. The group initially deployed a wiper, Apostle, disguised as ransomware, however later modified Apostle into totally fledged ransomware. Agrius exploits identified vulnerabilities in internet-facing purposes to put in webshells, then conducts inside reconnaissance earlier than shifting laterally after which deploying its malicious payloads.

Marketing campaign overview

On February 20^th, 2022 at a corporation within the diamond trade in South Africa, Agrius deployed credential harvesting instruments, in all probability in preparation for this marketing campaign. Then, on March 12^th, 2022, Agrius launched the wiping assault by deploying Fantasy and Sandals, first to the sufferer in South Africa after which to victims in Israel and lastly to a sufferer in Hong Kong.

Victims in Israel embody an IT help companies firm, a diamond wholesaler, and an HR consulting agency. South African victims are from a single group within the diamond trade, with the Hong Kong sufferer being a jeweler.

The marketing campaign lasted lower than three hours and inside that timeframe ESET clients have been already protected with detections figuring out Fantasy as a wiper, and blocking its execution. We noticed the software program developer pushing out clear updates inside a matter of hours of the assault. We reached out to the software program developer to inform them a couple of potential compromise, however our enquiries went unanswered.

Making ready for departure

The primary instruments deployed by Agrius operators to sufferer techniques, by way of means unknown, have been:

• MiniDump, “a C# implementation of mimikatz/pypykatz minidump performance to get credentials from LSASS dumps”
• SecretsDump, a Python script that “performs numerous strategies to dump hashes from [a] distant machine with out executing any agent there”
• Host2IP, a customized C#/.NET device that resolves a hostname to an IP tackle.

Usernames, passwords, and hostnames collected by these instruments are required for Sandals to efficiently unfold and execute the Fantasy wiper. Agrius operators deployed MiniDump and SecretsDump to this marketing campaign’s first sufferer on February 20^th, 2022, however waited till March 12^th, 2022 to deploy Host2IP, Fantasy, and Sandals (consecutively).

Sandals: Igniting the Fantasy (wiper)

Sandals is a 32-bit Home windows executable written in C#/.NET. We selected the title as a result of Sandals is an anagram of among the command line arguments it accepts. It’s used to connect with techniques in the identical community through SMB, to jot down a batch file to disk that executes the Fantasy wiper, after which run that batch file through PsExec with this command line string:

• PsExec.exe /accepteula -d -u “<username>” -p “<password>” -s “C:<path><GUID>.bat”

The PsExec choices have the next meanings:

• -d – Don’t watch for course of to terminate (non-interactive).
• /accepteula – Suppress show of the license dialog.
• -s – Run the distant course of within the SYSTEM account.

Sandals doesn’t write the Fantasy wiper to distant techniques. We imagine that the Fantasy wiper is deployed through a supply-chain assault utilizing the software program developer’s software program replace mechanism. This evaluation is predicated on a number of elements:

• all victims have been clients of the affected software program developer;
• the Fantasy wiper was named in a similar way to official variations of the software program;
• all victims executed the Fantasy wiper inside a 2.5 hour timeframe, the place victims in South Africa have been focused first, then victims in Israel, and eventually victims in Hong Kong (we attribute the delay in concentrating on to time zone variations and a hardcoded check-in time throughout the official software program); and,
• lastly, the Fantasy wiper was written to, and executed from, %SYSTEMpercentWindowsTemp, the default temp listing for Home windows techniques.

Moreover, we imagine the victims have been already utilizing PsExec, and Agrius operators selected to make use of PsExec to mix into typical administrative exercise on the victims’ machines, and for ease of batch file execution. Desk 1 lists the command line arguments accepted by Sandals.

Desk 1. Sandals arguments and their descriptions

The batch file written to disk by Sandals is called <GUID>.bat, the place the filename is the output of the Guid.NewGuid() methodology. An instance of a Sandals batch file is proven in Determine 2.

Determine 2. Sandals batch file (high, in purple) and the decoded command line parameter (backside, in blue)

The base64 string that follows fantasy35.exe is probably going a relic of the execution necessities of Apostle (extra particulars within the Attribution to Agrius part). Nevertheless, the Fantasy wiper solely appears for an argument of 411 and ignores all different runtime enter (see the following part for extra data).

Fantasy wiper

The Fantasy wiper can be a 32-bit Home windows executable written in C#/.NET, so named for its filenames: fantasy45.exe and fantasy35.exe, respectively. Determine 3 depicts the execution circulate of the Fantasy wiper.

Determine 3. Fantasy wiper execution circulate

Initially, Fantasy creates a mutex to make sure that just one occasion is operating. It collects an inventory of mounted drives however excludes the drive the place the %WINDOWS% listing exists. Then it enters a for loop iterating over the drive checklist to construct a recursive listing itemizing, and makes use of the RNGCryptoServiceProvider.GetBytes methodology to create a cryptographically robust sequence of random values in a 4096-byte array. If a runtime argument of 411 is equipped to the wiper, the for loop overwrites the contents of each file with the aforementioned byte array utilizing a nested whereas loop. In any other case, the for loop solely overwrites information with a file extension listed within the Appendix.

Fantasy then assigns a particular timestamp (2037-01-01 00:00:00) to those file timestamp properties:

• CreationTime
• LastAccessTime
• LastWriteTime
• CreationTimeUtc
• SetLastAccessTimeUtc
• LastWriteTimeUtc

after which deletes the file. That is presumably carried out to make restoration and forensic evaluation harder.

In the course of the for loop, the Fantasy wiper counts errors throughout the present listing when making an attempt to overwrite information. If the variety of errors exceeds 50, it writes a batch file, %WINDOWSpercentTemp<GUID>.bat, that deletes the listing with the information inflicting the errors, after which self-deletes. File wiping then resumes within the subsequent listing within the goal checklist.

As soon as the for loop completes, the Fantasy wiper creates a batch file in %WINDOWSpercentTemp known as registry.bat. The batch file deletes the next registry keys:

• HKCR.EXE
• HKCR.dll
• HKCR*

Then it runs the next to aim to clear file system cache reminiscence:

• %windirpercentsystem32rundll32.exe advapi32.dll,ProcessIdleTasks

Lastly, registry.bat deletes itself (del %0).

Subsequent, the Fantasy wiper clears all Home windows occasion logs and creates one other batch file, system.bat, in %WINDOWSpercentTemp, that recursively deletes all information on %SYSTEMDRIVE%, makes an attempt to clear file system cache reminiscence, and self-deletes. Then Fantasy sleeps for 2 minutes earlier than overwriting the system’s Grasp Boot Report.

Fantasy then writes one other batch file, %WINDOWSpercentTempremover.bat, that deletes the Fantasy wiper from disk after which deletes itself. Then Fantasy wiper sleeps for 30 seconds earlier than rebooting the system with purpose code SHTDN_REASON_MAJOR_OTHER (0x00000000) — Different concern.

It’s seemingly that %SYSTEMDRIVE% restoration is feasible. Victims have been noticed to be again up and operating inside a matter of hours.

Attribution to Agrius

A lot of the code base from Apostle, initially a wiper masquerading as ransomware then up to date to precise ransomware, was instantly copied to Fantasy and plenty of different capabilities in Fantasy have been solely barely modified from Apostle, a identified Agrius device. Nevertheless, the general performance of Fantasy is that of a wiper with none try to masquerade as ransomware. Determine 4 reveals the file deletion capabilities in Fantasy and Apostle, respectively. There are just a few small tweaks between the unique perform in Apostle and the Fantasy implementation.

Determine 4. File deletion capabilities from the Fantasy wiper (high, in purple) and Apostle ransomware (backside, in inexperienced)

Determine 4. File deletion capabilities from the Fantasy wiper (high, in purple) and Apostle ransomware (backside, in inexperienced)

Determine 5 reveals that the listing itemizing perform is sort of a direct copy, with solely the perform variables getting a slight tweak between Apostle and Fantasy.

Determine 5. Listing itemizing capabilities from the Fantasy wiper (high, in purple) and Apostle ransomware (backside, in inexperienced)

Lastly, the GetSubDirectoryFileListRecursive perform in Determine 6 can be virtually an actual copy.

Determine 6. Recursive listing itemizing capabilities from the Fantasy wiper (high, in purple) and Apostle ransomware (backside, in inexperienced)

Along with the code reuse, we will see remnants of the Apostle execution circulate in Fantasy. Within the authentic evaluation of Apostle, SentinelOne notes that “Correct execution of the ransomware model requires supplying it with a base64 encoded argument containing an XML of an ‘RSAParameters’ object. This argument is handed on and saved because the Public Key used for the encryption course of and is most definitely generated on a machine owned by the risk actor.” We are able to see within the batch file in Determine 7, which Sandals creates on distant techniques to launch Fantasy, that the identical base64-encoded argument containing an XML of an RSAParameters object is handed to Fantasy at runtime. Fantasy, nonetheless, doesn’t use this runtime argument.

Determine 7. Sandals passing to Fantasy the identical RSAParameters object as was utilized by Apostle ransomware

Conclusion

Since its discovery in 2021, Agrius has been solely centered on harmful operations. To that finish, Agrius operators in all probability executed a supply-chain assault by concentrating on an Israeli software program firm’s software program updating mechanisms to deploy Fantasy, its latest wiper, to victims in Israel, Hong Kong, and South Africa. Fantasy is comparable in lots of respects to the earlier Agrius wiper, Apostle, that originally masqueraded as ransomware earlier than being rewritten to be precise ransomware. Fantasy makes no effort to disguise itself as ransomware. Agrius operators used a brand new device, Sandals, to attach remotely to techniques and execute Fantasy.

IoCs

MITRE ATT&CK strategies

This desk was constructed utilizing model 12 of the MITRE ATT&CK framework.

Appendix

File extensions (682) focused by Fantasy wiper when not concentrating on all file extensions. File extensions highlighted in yellow (68) are frequent filename extensions in Home windows. Notably absent are file extensions dll and sys.