question

JohnOlivella-1132 avatar image
0 Votes"
JohnOlivella-1132 asked Goran-2356 edited

HAFNIUM and aspx files

Hi All,

We have run scanner on both of our exchange 2016 servers and one came back positive and the other negative.

However, on both servers, these files are .aspx files in %PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\:

errorFE.aspx
ExpirtedPassword.aspx
frowny.aspx
logoff.aspx
logon.aspx
OutlookCN.aspx
RedirSuiteServiceProxy.aspx
signout.aspx

Are these file normal in exchange 2016?
Also these files were created way before the attack.

office-exchange-server-administration
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @JohnOlivella-1132

Any update about your question?

0 Votes 0 ·

Hi @JohnOlivella-1132

Have you tried the MSERT tool?

0 Votes 0 ·
Goran-2356 avatar image
0 Votes"
Goran-2356 answered Goran-2356 edited

The files you pointed out exist on my exchange also however I also had a recent incident where Backdoor shell script was installed in the ecp\auth virtual directory that looked like this:
199453-image.png


199485-image.png

199497-image.png
Here are some useful links that helped me narrow down the issue and remove them:
https://www.microsoft.com/security/blog/2020/06/24/defending-exchange-servers-under-attack/

https://docs.microsoft.com/en-us/microsoft-365/security/intelligence/safety-scanner-download?view=o365-worldwide



image.png (40.0 KiB)
image.png (46.5 KiB)
image.png (28.0 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenLangers-7460 avatar image
0 Votes"
BenLangers-7460 answered

I can confirm I have the exact same files with the same creation dates and sizes on a restore of that box from before the exploit. Seems legit...

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

joyceshen-MSFT avatar image
0 Votes"
joyceshen-MSFT answered

Hi @JohnOlivella-1132

I have checked in my environment, and found the same files under the path.

These files should be nomal files for Exchange. For security reasons, I would suggest you use the MSERT.exe tool to scan your server.

For more information: Microsoft Exchange Server Vulnerabilities Mitigations – updated March 9, 2021 ,mainly refer to the part Microsoft Support Emergency Response Tool (MSERT) to scan Microsoft Exchange Server.


If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
 


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenLangers-7460 avatar image
0 Votes"
BenLangers-7460 answered

I have got those same files on an Exchange 2019 machine.
There is one extra: getidtoken.htm
Looks a bit out of place, there...
Will run a restore of a version before this exploit to verify and post back...

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BillNelson-4845 avatar image
0 Votes"
BillNelson-4845 answered BillNelson-4845 published

I have these same files on my server and I have the same question.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.