Is the WikiLeaks site not responding to requests?
------
Angelfire 31 August, 2017
Today, August 31st 2017, WikiLeaks publishes documents from the Angelfire project of the CIA. Angelfire is an implant comprised of five components: Solartime, Wolfcreek, Keystone (previously MagicWand), BadMFS, and the Windows Transitory File system. Like previously published CIA projects (Grasshopper[1] and AfterMidnight[2]) in the Vault7[3] series[4], it is a persistent framework that can load and execute custom implants on target computers running the Microsoft Windows operating system (XP or Win7).
Solartime modifies the partition boot sector so that when Windows loads boot time device drivers, it also loads and executes the Wolfcreek implant, that once executed, can load and run other Angelfire implants. According to the documents, the loading of additional implants creates memory leaks that can be possibly detected on infected machines.
Keystone is part of the Wolfcreek implant and responsible for starting malicious user applications. Loaded implants never touch the file system, so there is very little forensic evidence that the process was ever ran. It always disguises as "C:\Windows\system32\svchost.exe" and can thus be detected in the Windows task manager, if the operating system is installed on another partition or in a different path.
BadMFS is a library that implements a covert file system that is created at the end of the active partition (or in a file on disk in later versions). It is used to store all drivers and implants that Wolfcreek will start. All files are both encrypted and obfuscated to avoid string or PE header scanning. Some versions of BadMFS can be detected because the reference to the covert file system is stored in a file named "zf".
The Windows Transitory File system is the new method of installing AngelFire. Rather than lay independent components on disk, the system allows an operator to create transitory files for specific actions including installation, adding files to AngelFire, removing files from AngelFire, etc. Transitory files are added to the 'UserInstallApp'.
[1]: https://wikileaks.org/vault7/grasshopper/
[2]: https://wikileaks.org/vault7/#AfterMidnight
[3]: https://wikileaks.org/ciav7p1/
[4]: https://wikileaks.org/vault7/#
------
And here are the documents linked beside the post:
Angelfire 2.0 -- User Guide: https://wikileaks.org/vault7/document/Angelfire-2_0-UserGuid...
BadMFS -- Developer Guide: https://wikileaks.org/vault7/document/BadMFS_Developer_Guide...
Wolfcreek Docs -- Angelfire User Guide: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfi...
Wolfcreek Docs -- Angelfire Test Matrix: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfi...
Wolfcreek Docs -- NotesSee more: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Notes/
If I ever meet the manager who decided bundling half the services in the OS into svchost was a good idea, I'll give him a piece of my mind. I've lost more hours to that (both cleaning malware and troubleshooting performance or crashes) than anything else on Windows since the 9x days.
So you just see "C:\...\app.jar" unless you dig into the flag halfway through to see it's "--widget-1" and not "--widget-2".
The reason services are bundled into SVCHOST is that it offers reduced memory footprint and lower startup costs, which is still significant on resource constrained systems (which Windows embedded still targets)[0].
If malware didn't copycat SVCHOST they would just copycat one of a dozen other common Windows processes like conhst, dllhost, csrss, etc.
As an aside, in Task Manager if you go to the details tab, select columns, command line. You'll see exactly what each instance of SVCHOST is running. Process Explorer gives you even more information than that.
Process Explorer allows you to turn on Digital Signature checking. Run it as administrator. Select Columns -> Verified Signer. Options -> Verify Image Signatures. But also check your CA store to make sure no custom CA has been injected into the OS.
[0] https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=...
Even so, the original premise of performance doesn't hold water to me. I load a process that has 10 services inside so I can use two of them, and that's somehow reduced memory compared to just running the two, just in case I want to run the other 8 later? Some of those services I have disabled and never want to run. It's still taking up the memory.
Did they piss someone off too much this time?
https://www.theguardian.com/technology/2017/aug/31/wikileaks...