Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71473
AVG Catches a Payload Dropped to Disk and Launched via Link File Well After Execution
SECRET//NOFORN
User #14588054 and I ran into an issue with AVG recently. IV&V discovered that a GravityTurn payload that we were dropping to disk and executing using DriftingShadows (Windows .LNK exploit on an SMB share) was being caught by AVG, but only after it had already dropped, executed, successfully beaconed and then terminated. GravityTurn itself was not caught when manually executed, and DriftingShadows could drop and run benign payloads without being flagged. Weird and not good.
We tried several simple defeats (changing the drop location, changing the extension and even including a previously removed privelege escalation) to no avail. Finally, we decided to try Process Hollowing. This worked like a charm but was complicated by the fact that Drifting Shadows for 64-bit targets is a 64-bit DLL, and process hollowing only works from 32 bit loaders using 32-bit payloads. The solution was to split the functionality into a 64-bit first stage DLLDynamic Link Library and a 32-bit loader DLL. The link file launches the 64-bit DLL, which uses rundll32 to run the 32-bit DLL. The 32-bit DLLDynamic Link Library in turn unwraps the compress/encrypted GravityTurn payload in memory and launches and hollows a 32-bit svchost.exe to host the payload.
It's awesome, and by awesome I mean totally sweet.
#getoffmylawn
#thanksSean
SECRET//NOFORN