Exploit:Script/SuspSignoutReq.A

The Exploit:Script/SuspSignoutReq.A attack chain starts by compromising SharePoint authentication security bugs by sending HTTP requests to trigger its vulnerabilities. To initiate the compromise, threat actors send specially crafted POST HTTP requests to the ToolPane.aspx file while spoofing legitimate SignOut.aspx requests by manipulating the referer header. With this authentication bypass, threat actors then leverage a .NET vulnerability, creating malicious serialized objects that SharePoint's back-end processes to gain the ability to launch arbitrary code with SYSTEM privileges with the w3wp.exe IIS worker process.

After successfully obtaining initial access, the attack uses various evasion methods while establishing persistence. It runs PowerShell commands that maliciously deploy a web shell (spinstall0.aspx) in the SharePoint TEMPLATE\LAYOUTS directory. The web shell performs multiple functions, such as collecting valuable ASP.NET cryptographic keys from the MachineKeys folders, allowing the threat actor to remote access the compromised devices, and allowing them to move laterally on the network.

The overall attack is file-less; it primarily uses memory through w3wp.exe and spawned normal Windows processes like cmd.exe and powershell.exe for running commands. In the event the attack needed to write files, Exploit:Script/SuspSignoutReq.A uses standard Windows temporary folder to store its components: IIS_Server_dll.dll (IIS module backdoor), and SharpHostInfo.x64.exe (reconnaissance).

107[.]191.58[.]76 for initial payload delivery and 104[.]238.159[.]149 for data exfiltration are used by Exploit:Script/SuspSignoutReq.A for command and control. The xd.exe component acts as a reverse proxy, creating TLS-encrypted tunnels over port 443 to maintain stealth communication with threat actor-controlled servers. These channels are for downloading secondary payloads, including ransomware components, when the threat actors transition to the final stage of their operation.

Exploit:Script/SuspSignoutReq.A drops the following files:

• \LAYOUTS\spinstall0.aspx (Primary web shell stealing MachineKeys)
• C:\Windows\Temp\SharpHostInfo.x64.exe (for recon)
• C:\Windows\Temp\IIS_Server_dll.dll (for persistence)
• C:\Windows\Temp\xd.exe (C2 reverse proxy via port 443 launched via Scheduled Tasks)

It creates the following process:

• w3wp.exe (which launches cmd.exe or powershell.exe for command line functions)

It modifies the following Windows Registry keys:

• HKLM\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware=1
• HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares (access network shares)

Exploit:Script/SuspSignoutReq.A communicates to the following hosts:

• 107[.]191.58[.]76
• 104[.]238.159[.]149