Forum Discussion
Hafnium - Removal of Changes
https://www.spectx.com/articles/investigate-your-logs-for-the-microsoft-exchange-vulnerability
Includes an msi app to look at the logs with various integrated scripts to check things out
Does your C:\Windows\Temp folder have IIS_USERS with special permissions added??
Traverse Folder/Execute File
Create Files/Write Data
Create Folders/Append Data
IIS_Users has no members and I have no unusual looking local users on the server either...
Looks like you have been really lucky. I'm in the process of migrating all the remaining mailboxes to o365 (something we were going to do anyway, 39 left) and building a brand new server at the same time as we are hybrid and still need a physical box. Looking into going fully hosted next, one less thing for me to worry about.
The only port I have open to the world on the compromised server is 443, everything else runs through Mimecast, I thought we would be in a much better position than most, I guess I was wrong, despite patching as soon as the bulletin was released. You can't win them all I guess!
Mine finished and it was clean. Guess I dodged the bullet... Ran a few other scripts that I found on GitHub. Looks like it was attempted but nothing stuck. The HTTP proxy logs just record the attempt if I understand, correct?
I had just locked down everything on our firewall after our migration a month back and put on the latest Malwarebytes and another AV.
- If it helps, these are the results from MS Safety Scanner, log file is located at %SYSTEMROOT%\debug\msert.log
It turns out I did have some unsavoury files...
Threat detected: Exploit:ASP/CVE-2021-27065.B!dha
file://C:\inetpub\wwwroot\aspnet_client\discover.aspx
SigSeq: 0x0000E9E793147CAE
SHA1: 8114cbe58622421bda6c56713d9ac0245c69e897
Threat detected: Backdoor:MSIL/Chopper.F!dha
file://C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\e22c2559\92c7e946\App_Web_usjyfoyu.dll
SigSeq: 0x00011540CBC0F3F1
SHA1: 10d3dd10796a9814c85cbe4c18af6c37b723a8a3
Extended Scan Removal Results
----------------
Start 'remove' for file://\\?\C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\e22c2559\92c7e946\App_Web_usjyfoyu.dll
Operation was scheduled to be completed after next reboot.
Start 'remove' for file://\\?\C:\inetpub\wwwroot\aspnet_client\discover.aspx
Operation succeeded !
Results Summary:
----------------
For cleaning Backdoor:MSIL/Chopper.F!dha, the system needs to be restarted.
Found Exploit:ASP/CVE-2021-27065.B!dha and Removed!
Microsoft Safety Scanner Finished On Mon Mar 08 11:32:33 2021
Return code: 10 (0xa) - Looks like I only have List Folder / Read data under Special Permissions / Advanced Permissions
