Mal/Polazert-A Removal?

It looks like an encrypted command is being passed to powershell upon startup. I'd recommend using Microsoft Autoruns to see if you can find anything that looks out of the ordinary on the device in question. 

The following video from our TechVids team provides some guidance on what to look out for. 
- Active Malware Remediation

Sophos is stopping the execution of this command whenever it tries to run, though I do recommend trying to take a closer look into this as soon as possible. If no files are being found even when a full system scan is being run, this may indicate that the malware is hiding within the Windows WMI databank. 

What may also provide additional information is gathering a boot Process monitor log. IGuidance on how to do so can be found in the following article.
- Gather system events using Process Monitor

If you're looking for assistance with an RCA, or if you would like hands-on assistance with remediation, the Sophos MTR team would be the best team to assist you.

I took a look at Autorun and Process Explorer. Nothing looked out of the ordinary in Autoruns.

I'm mostly curious why Sophos EP isn't removing the malware and instead only telling me about it. The other product we use for threat detection didn't even see it, but now here we have Sophos showing it to me and not cleaning it up. That's just as frustrating. 

-Mike

Hi, Mj,

Based on further checking the said detection is trojan a type of malware that performs activities without the user’s knowledge. These activities commonly include establishing remote access connections, capturing keyboard input, collecting system information, downloading/uploading files, dropping other malware into the infected system, performing denial-of-service (DoS) attacks, and running/terminating processes. For our recommendation you can Isolate this device as of now while where under investigation. Also we can see that you have raise a support case for the said detection and more updates will be posted on the case as well. 

Hi, Mj,

Based on further checking the said detection is trojan a type of malware that performs activities without the user’s knowledge. These activities commonly include establishing remote access connections, capturing keyboard input, collecting system information, downloading/uploading files, dropping other malware into the infected system, performing denial-of-service (DoS) attacks, and running/terminating processes. For our recommendation you can Isolate this device as of now while where under investigation. Also we can see that you have raise a support case for the said detection and more updates will be posted on the case as well. 

Thank you GlennSen for this information, but as stated I am not looking for information on the malware. That was already established from the start.

I want to know why Sophos Intercept X with XDR has not removed the malware. Do I need to use a different vendor to clean the malware?

Isolating the device is not an option. This computer is used daily in a busy dental office. It's already been two days since I opened the support ticket. The only help I am getting is from this forum, no replies to the ticket. With no idea when Sophos will reply and no timeline on when I can expect resolution, I can not leave this computer isolated from the network and unavailable for use.

I hope you can understand the difficult situation your request puts us in and why we can't do so.

-Mike

Sophos support informed me that I will have to pay additional costs to have this malware removed. That was their final answer.

-Mike

Hmm, here is an example that might help. 

If I create a scheduled task to run powershell.exe with a command line argument that is an AMSI bypass I get an alert at the endpoint:

All there is at the client to remove is the scheduled task.  There is nothing else to delete, powershell.exe is good.

So what do we have in Sophos Central to work with to help...

The threat graph gives us a little info:

In the details of the alert, from the Events view in Central there is a little more info:

So we know the PID of the Powershell.exe process that ran and we know the parent PID.

One option at this point is to run an endpoint query for PowerShell commands run on the computer, this could be a quick way to locate it as we know the time it ran.

"List and decode PowerShell commands"

from the SophosPID I can pivot to "Process tree for a Sophos PID (Windows)"

This shows me the process tree.  I can see from this that the process that launched the PowerShell.exe process of interest was a svchost process.  From the command line I can see this svchost was running the Schedule service.

So I know now that this was probably launched from a scheduled task.

There is a query for Scheduled tasks, called "Scheduled tasks", here it is:

So I now know that there is a scheduled task called ps that runs this command.

To "clean" this computer and stop this alert, I just need to delete this scheduled task. I can do this from Live Response.

Check the tasks to be sure:

Delete the task.

I hope this helps offer some options for you to resolve the computer remotely.

The computer could also be off to discover most of this as this level of detail is in the data lake. It would of course need to be on to delete the scheduled task.

Thank you Sophos User930. This interface is new to me, but I was able to work through those steps.

I wasn't able to find a scheduled task in those queries, but I did find the PowerShell command it was running:

However, this Polazert appears to be up to other nefarious activities other than a scheduled task. See this screenshot:

The details of the PowerShell command provide the path to the files it is executing. I feel that if I remove these temp files and other files it is calling, it will remove Polazert from the system.

Do you think there is anything I am missing?

-Mike

Hi Mike,

Well the Powershell.exe process of interest is launched from Explorer.exe when op05 logs in:

Note: The other csc.exe and cvtres.exe is part of the .NET code in the PS command being "compiled" as the script runs. No need to worry about these for a minute, as soon as you can prevent the Powershell process from running, these will not get launched.

The main thing is to know how Explorer.exe is launching this process as this is the "persistence".

The first query I would run to try and find this Powershell.exe process start-up location is:

"Applications in the startup section of the registry"

This covers your standard "run" keys, "runonce" keys and start-up folders.  There might be multiple pages so you could always export the data to a CSV and view it in Excel.  The Export link is at the top right of the results.

An entry here would generate a child process of Explorer so it's a good place to start.

Can you see the Powershell.exe entry?

If so, we can use Live Reponse to delete the startup entry.

The previous suggestion to run Autoruns is a good one.  You can potentially do this over Live Response using the command line version of Autoruns.

See: Autoruns for Windows - Windows Sysinternals | Microsoft Docs for info on possible switches, but as a starting point, in the remote command prompt from Live Response you can run:

powershell

This will get you a PowerShell prompt rather than just CMD.

Then create a new working directory called C:\Autoruns by running:

New-Item -Path "c:\" -Name "Autoruns" -ItemType "directory"

Enter the directory using CD:

cd \Autoruns\

You can download Autoruns on the command line using the Invoke-WebRequest cmdlet:

Invoke-WebRequest live.sysinternals.com/autorunsc64.exe -UseBasicParsing -OutFile autorunsc64.exe

The URL got converted to a link so above is an image of the command.

This should put the file in C:\autoruns\autorunsc64.exe

You can run it with the command:

&"./autorunsc64.exe" /accepteula

By default this will print some standard start-up locations back to the screen.

You can use the /a switch to expand the search. You may want to log this to a file:

&"./autorunsc64.exe" /a * > all.txt

You can then run:

more all.txt

to step through the file or run:

Select-String .\all.txt -Pattern "powershell.exe"

to see if you can see a line containing Powershell.exe for example.

Beyond this, if I had the computer in front of me, I would probably disconnect it from the network.  Run Process Monitor Process Monitor - Windows Sysinternals | Microsoft Docs and capture a boot trace.

Then open the boot trace, find where Powershell.exe is launched by Explorer. The Process Tree view will help locate it.

For the CreateProcess Event from Explorer.exe, check the stack, with Symbols loaded to find if there is a module making the CreateProcess API call or whatever the API call is to launch the powershell.exe process.  This could help.  If not, from that point, just work up the trace to see how it got called.

Hope it helps.

Thank you Sophos User930. You have definitely been very helpful to me, thank you for taking the time from your schedule to assist me.

I haven't had a chance to run all of these commands, but I found this in Autorun, and removed it from the startup folder, the registry, as well as all the temp files and folders for this user account:

Both PC's are online. I am several hundred miles away from them, but it may be possible to arrange a site visit with one of our local resources if this malware persists. So far since I removed this entry, Sophos has not been detecting any malware on the PC.

I still want to complete the rest of the steps you provided so I can be sure it's gone.

I also found the malicious MSI file that I believe introduced this malware to the PC, delete it so the user doesn't open it again, but kept a copy for myself, but I do not have a sandbox or test environment to run it.

-Mike

I forgot to add, this one was easier to find since this PC does not have an NVIDIA video card. That entry looked wrong right as soon as I saw it.

-Mike

This is great, glad you may have found a persistence entry.  That is certainly the idea.

As for the MSI, I would start with uploading it to Virus Total:

VirusTotal - Home

If you can paste back the URL, I'd be interested to see the results of the vendors.

Other than that, message back if you need any further assistance.  Not sure if you're able to provide the full command line argument in the PowerShell command.  I'd be happy to work out what it actually did/does.

One MSI: https://www.virustotal.com/gui/file/1ed9469724b3ba2891dc0efee29b1de93054601cb44aaf433c2b5860884dfa71

This one was downloaded as 'Dental-Consent-Form-For-Poor-Prognosis.msi' for one client and as 'Adult-Social-Behavior-Questionnaire.msi' for the second client.

I will work on the PowerShell command in a little bit. I really appreciate your contributions and assistance. Thank you again.

-Mike

Well that's appears to be related to the file lnk file referenced, you showed in Autoruns:

ab3a7c450f6438b0df5a3a34d38c0.LNk

In the VT analysis, on the relations page we see the same file:

VirusTotal - File - 1ed9469724b3ba2891dc0efee29b1de93054601cb44aaf433c2b5860884dfa71

So that matches up.

I think it would be worth sending in the same file to SophosLabs and see what they say.

FileSubmission (sophos.com)