Hostile Site: bizoplata(dot)ru/pay(dot)html?
1. Upon visiting the site, Blink's Application Protection kills the initial attempt to execute code by displaying the following alert:
Event ID: BLINK-APP-100
Severity: High
Description: Blink detected a suspicious system call.
Alert: Yes
Program: C:\Program Files\Internet Explorer\iexplore.exe
Reason: KERNEL32.DLL!LoadLibraryA
Action: Restart process
- I disabled Blink's Application Protection layer and revisited the site.
2. This time Blink's Application Firewall prompted me to allow the following two outbound connections (I allowed these requests):
Allow C:\WINDOWS\system32\~.exe Outbound TCP connection to Remote Port 80?
and then
Allow C:\WINDOWS\system32\~.exe Outbound TCP connection to Remote Port 25?
- In Blink's Application Firewall section these rules showed up under the category "Cookie Converter".
3. About a minute after allowing the two outbond connections shown above, Blink's SMTP Protocol Analyzer Module (in the Intrusion Prevention System) layer alerts with the following:
Event ID: BLINK-BAM-4020
Severity: High
Description: Server sent too many error reply codes in this session
Alert: Yes
Action: Terminated
Attacker: 192.168.1.3
Attacker Port: 1189
Victim IP: 209.85.221.86
Victim Port: 25
Protocol: TCP
Argument: 550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 26si2154588qyk.127
Process Path: C:\WINDOWS\system32\~.exe
Event ID: BLINK-BAM-4020
Severity: High
Description: Server sent too many error reply codes in this session
Alert: Yes
Action: Terminated
Attacker: 192.168.1.3
Attacker Port: 1195
Victim IP: 209.85.221.86
Victim Port: 25
Protocol: TCP
Argument: 550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 26si2154881qyk.127
Process Path: C:\WINDOWS\system32\~.exe
At this point I check for any established connections and once again Blink was successful at stopping any further execution from happening.
At this point I am going to disable everything but the AV component in Blink and revist the site one last time. Before doing so, I revert my VMware image back to a known good state, run Regshot and take a complete snapshot of my system before continuing.
4. Upon revisiting the site, the executable ran itself, made its connections to the mail servers listed above and continued with out any further prompt or notice of malicious action by Blink. I opened TCP View and noted many active (and changing) connections to multiple internet mail servers which were passing data. This went silently in the background...even after I killed Internet Explorer's process and everything. At this point I took my final snapshot, with Regshot, of my system and compared the two. Nothing changed (other than Temporary Internet Files) on my system; no new noted files had been pulled to my system.
Regardless of this, it is noted that Blink stopped pretty much every possible avenue of this malicious action not allowing it to happen in the first place, this is the important factor to note here.