Obfuscated with a Simple 0x0A, (Fri, Apr 3rd)

With the current Coronavirus pandemic, we continue to see more and more malicious activity around this topic. Today, we got a report from a reader who found a nice malicious Word document part of a Coronavirus phishing campaign. I don't know how the URL was distributed (probably via email) but the landing page is fake White House-themed page. So, probably targeting US citizens.

ISC Stormcast For Friday, April 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=6938, (Fri, Apr 3rd)

ISC Stormcast For Thursday, April 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=6936, (Thu, Apr 2nd)

TPOT's Cowrie to ISC Logs, (Thu, Apr 2nd)

ISC Stormcast For Wednesday, April 1st 2020 https://isc.sans.edu/podcastdetail.html?id=6934, (Wed, Apr 1st)

Qakbot malspam sent from an infected Windows host, (Wed, Apr 1st)

Introduction

ISC Stormcast For Tuesday, March 31st 2020 https://isc.sans.edu/podcastdetail.html?id=6932, (Tue, Mar 31st)

Kwampirs Targeted Attacks Involving Healthcare Sector, (Tue, Mar 31st)

There is no honor among thieves. Even after some ransomware gangs claimed to seize targeting the healthcare sector, attacks continue to happen. But ransomware isn't alone. Last week, the FBI updated an advisory regarding the Kwampirs malware, pointing out the healthcare sector as one of its targets. Kwampirs isn't picky in its targeting. It has been observed going after various sectors (financial, energy, software supply chain, and healthcare, among others). One differentiator of Kwampirs is its modular structure. After penetrating a particular target network, the malware will load appropriate modules based on the targets it encounters. In general terms, Kwampirs is a "Remote Admin Tool" (RAT). It provides access to the target and can be used to execute additional payloads at the attacker's choosing.

Crashing explorer.exe with(out) a click, (Mon, Mar 30th)

In a couple of my recent diaries, we discussed two small unpatched vulnerabilities/weaknesses in Windows. One, which allowed us to brute-force contents of folders without any permissions[1], and another, which enabled us to change names of files and folders without actually renaming them[2]. Today, we’ll add another vulnerability/weakness to the collection – this one will allow us to cause a temporary DoS condition for the Explorer process (i.e. we will crash it) and/or for other processes. It is interesting since all that is required for it to work is that a user opens a link or visits a folder with a specially crafted file.

ISC Stormcast For Monday, March 30th 2020 https://isc.sans.edu/podcastdetail.html?id=6930, (Mon, Mar 30th)

Obfuscated Excel 4 Macros, (Sun, Mar 29th)

2 readers (anonymous and Robert) submitted very similar malicious spreadsheets with almost no detections on VT: c1394e8743f0d8e59a4c7123e6cd5298 and a03ae50077bf6fad3b562241444481c1.

Covid19 Domain Classifier, (Sat, Mar 28th)

Johannes started a Covid19 Domain Classifier here on our Internet Storm Center site.

Help us classify Covid19 related domains https://isc.sans.edu/covidclassifier.html (login required), (Fri, Mar 27th)

---

Malicious JavaScript Dropping Payload in the Registry, (Fri, Mar 27th)

When we speak about "fileless" malware, it means that the malware does not use the standard filesystem to store temporary files or payloads. But they need to write data somewhere in the system for persistence or during the infection phase. If the filesystem is not used, the classic way to store data is to use the registry. Here is an example of a malicious JavaScript code that uses a temporary registry key to drop its payload (but it also drops files in a classic way).

ISC Stormcast For Friday, March 27th 2020 https://isc.sans.edu/podcastdetail.html?id=6928, (Fri, Mar 27th)

Very Large Sample as Evasion Technique?, (Thu, Mar 26th)

Security controls have a major requirement: they can't (or at least they try to not) interfere with normal operations of the protected system. It is known that antivirus products do not scan very large files (or just the first x bytes) for performance reasons. Can we consider a very big file as a technique to bypass security controls? Yesterday, while hunting, I spotted a very interesting malware sample. The malicious PE file was delivered via multiple stages but the final dropped file was large... very large!

ISC Stormcast For Thursday, March 26th 2020 https://isc.sans.edu/podcastdetail.html?id=6926, (Thu, Mar 26th)

ISC Stormcast For Wednesday, March 25th 2020 https://isc.sans.edu/podcastdetail.html?id=6924, (Wed, Mar 25th)

Recent Dridex activity, (Wed, Mar 25th)

Introduction

SANS CyberCast Hallway Talk: Microsoft Windows Type 1 Font Parsing 0-Day https://www.youtube.com/watch?v=VSnVbrgnXJs, (Tue, Mar 24th)

---

Another Critical COVID-19 Shortage: Digital Security, (Tue, Mar 24th)

Following is a guest cross-post from John Scott-Railton, a Senior Researcher at The Citizen Lab. His work focuses on technological threats to civil society.

ISC Stormcast For Tuesday, March 24th 2020 https://isc.sans.edu/podcastdetail.html?id=6922, (Tue, Mar 24th)

Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability, (Mon, Mar 23rd)

Microsoft announced limited exploitation of a zeroday remote code execution vulnerability in the type 1 font parser.

KPOT Deployed via AutoIt Script, (Mon, Mar 23rd)

I have other samples like the malware I covered in yesterday's diary entry.

ISC Stormcast For Monday, March 23rd 2020 https://isc.sans.edu/podcastdetail.html?id=6920, (Mon, Mar 23rd)

More COVID-19 Themed Malware, (Sun, Mar 22nd)

Reader Andrew received a COVID-19 themed email with malicious attachment, and submitted the complete email.


Honeypot - Scanning and Targeting Devices & Services, (Sat, Mar 21st)

I was curious this week to see if my honeypot traffic would increase since a large portion of the world is working from home. Reviewing my honeypot logs, I decided to check what type of filename was mostly targeted (GET/POST/HEAD) by scanners  this past week on any web supported ports (i.e. 80, 81, 8000, etc). This first graph shows overall activity for the past 7 days.

ISC Stormcast For Friday, March 20th 2020 https://isc.sans.edu/podcastdetail.html?id=6918, (Fri, Mar 20th)

COVID-19 Themed Multistage Malware, (Thu, Mar 19th)

More and more countries are closing their borders and ask citizens to stay at home. The COVID-19 virus is everywhere and also used in campaigns to lure more victims who are looking for information about the pandemic. I found a malicious email that delivers a multi-stage malware.

ISC Stormcast For Thursday, March 19th 2020 https://isc.sans.edu/podcastdetail.html?id=6916, (Thu, Mar 19th)

ISC Stormcast For Wednesday, March 18th 2020 https://isc.sans.edu/podcastdetail.html?id=6914, (Wed, Mar 18th)

Trickbot gtag red5 distributed as a DLL file, (Wed, Mar 18th)

Introduction

A Quick Summary of Current Reflective DNS DDoS Attacks, (Tue, Mar 17th)

DNS is still a popular protocol to amplify denial of service attacks. A rather small DNS query, sent to an open recursive resolver, can be used to trigger a large response. Over the last few years, DNS servers implemented many countermeasures to make it more difficult to launch these attacks and easier to mitigate them. It also has become easier (but not trivial) to defend against these attacks. But in the end, you still have to "buy your way out" of a denial of service attacks. For smaller organizations, even an average attack can be devastating.

ISC Stormcast For Tuesday, March 17th 2020 https://isc.sans.edu/podcastdetail.html?id=6912, (Tue, Mar 17th)

Desktop.ini as a post-exploitation tool, (Mon, Mar 16th)

Desktop.ini files have been part of Windows operating systems for a long time. They provide users with the option to customize the appearance of specific folders in File Explorer, such as changing their icons[1]. That is not all they are good for, however.

ISC Stormcast For Monday, March 16th 2020 https://isc.sans.edu/podcastdetail.html?id=6910, (Mon, Mar 16th)

SANS Work From Home Deployment Kit. Free Material to Help You Stay Secure While Working From Home https://www.sans.org/security-awareness-training/sans-security-awareness-work-home-deployment-kit, (Mon, Mar 16th)

---

VPN Access and Activity Monitoring, (Sun, Mar 15th)

Because most individuals are going to have to work remotely from home, the activity that should be scrutinized over the coming weeks would be ports associated with VPN like OpenVPN (1194) or SSL VPN (TCP/UDP 443, IPsec/IKEv2 UDP 500/4500) with their associated logs to ensure these services are accessed by the right individuals and are not abused, exploited or compromised. It will be very important the VPN service is patched and up-to-date because there will be way more scrutiny (scanning) against these services. Capturing metrics about performance and availability will be very important to ensure mission critical systems and applications can be accessed to avoid downtime.

Phishing PDF With Incremental Updates., (Sat, Mar 14th)

Someone asked me for help with this phishing PDF.

VMware Patches for Bugs in DHCP Service (Workstation, Fusion, Horizon, VMRC), (Fri, Mar 13th)

VMware Security Avisory VMSA-2020-0004 ( https://www.vmware.com/security/advisories/VMSA-2020-0004.html ) outlines a fix for a user-after-free bug in vmnetdhcp that allows guests to execute code in the host.  Affected platforms are: VMware Workstation Pro / Player, VMware Fusion Pro / Fusion, VMware Horizon Client for Windows, VMware Remote Console for Windows (VMRC for Windows)

Microsoft Patches SMBv3 Compression RCE bug - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796, (Fri, Mar 13th)

ISC Stormcast For Friday, March 13th 2020 https://isc.sans.edu/podcastdetail.html?id=6908, (Fri, Mar 13th)

Not all Ethernet NICs are Created Equal - Trying to Capture Invalid Ethernet Frames, (Fri, Mar 13th)

This all started with a simple request.  A client had purchased some new, shiny networking gear, and in each failover pair the active unit was sending 1 "Runt" per second.

ISC Stormcast For Thursday, March 12th 2020 https://isc.sans.edu/podcastdetail.html?id=6906, (Thu, Mar 12th)

Hancitor distributed through coronavirus-themed malspam, (Thu, Mar 12th)

Introduction

Critical SMBv3 Vulnerability: Remote Code Execution, (Thu, Mar 12th)

[Update March 12, 2020]

Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account, (Wed, Mar 11th)

For a few days, there are new waves of Agent Tesla[1] landing in our mailboxes. I found one that uses two new "channels" to deliver the trojan. Today, we can potentially receive notifications and files from many types of systems or devices. I found a phishing sample that tries to hide behind a Canon EOS camera notification. Not very well designed but it’s uncommon to see this. It started with a simple email:

ISC Stormcast For Wednesday, March 11th 2020 https://isc.sans.edu/podcastdetail.html?id=6904, (Wed, Mar 11th)

Microsoft Patch Tuesday March 2020, (Tue, Mar 10th)

Microsoft today released patches for a total of 117 vulnerabilities. 25 of these vulnerabilities are rated critical. None of the vulnerabilities had been disclosed before today. Microsoft also has not seen any of them exploited in the wild.

ISC Stormcast For Tuesday, March 10th 2020 https://isc.sans.edu/podcastdetail.html?id=6902, (Tue, Mar 10th)

Malicious Spreadsheet With Data Connection and Excel 4 Macros, (Mon, Mar 9th)

Reader Carsten submitted an interesting malicious spreadsheet: c2af8b309a9ce65e9ac67c6d3c3acbe7.

ISC Stormcast For Monday, March 9th 2020 https://isc.sans.edu/podcastdetail.html?id=6900, (Mon, Mar 9th)

Excel Maldocs: Hidden Sheets, (Sun, Mar 8th)

Sheets in Excel workbooks can be hidden. To unhide them, right-click a sheet tab and select "Unhide":

Wireshark 3.2.2 Released: Windows' Users Pay Attention Please, (Sat, Mar 7th)

Wireshark version 3.2.2 was released.

Chain Reactor: Simulate Adversary Behaviors on Linux, (Sat, Mar 7th)

I am an advocate for the practice of adversary emulation to ensure detection efficacy. Candidly, I don’t consider a detection production-ready until it has been validated with appropriate adversary emulation to ensure the required triggers, alerts, and escalations are met. In many cases, basic human interaction can simulate the adversary per specific scenarios, but this doesn’t scale well. Applications and services to aid in this cause are essential. A couple of years ago I discussed APTSimulator as a means by which to test and simulate the HELK, but I haven’t given proper attention to adversary emulation on Linux. To that end, Chain Reactor “is an open source framework for composing executables that can simulate adversary behaviors and techniques on Linux endpoints. Executables can perform sequences of actions like process creation, network connections and more, through the simple configuration of a JSON file.”

A Safe Excel Sheet Not So Safe, (Fri, Mar 6th)

I discovered a nice sample yesterday. This excel sheet was found in a mail flagged as “suspicious” by a security appliance. The recipient asked to release the mail from the quarantine because “it was sent from a known contact”. Before releasing such a mail from the quarantine, the process in place is to have a quick look at the file to ensure that it is safe to be released.

ISC Stormcast For Friday, March 6th 2020 https://isc.sans.edu/podcastdetail.html?id=6898, (Fri, Mar 6th)

Will You Put Your Password in a Survey?, (Thu, Mar 5th)

Thanks to one of our readers who submitted this interesting piece of phishing. Personally, I was not aware of this technique which is interesting to bypass common anti-spam filter and reputation systems. The idea is to create a fake survey on a well-known online service.

ISC Stormcast For Thursday, March 5th 2020 https://isc.sans.edu/podcastdetail.html?id=6896, (Thu, Mar 5th)

Let's Encrypt Revoking 3 Million Certificates, (Wed, Mar 4th)

Let's Encrypt announced that they will be revoking a large number of certificates today. The revocation is due to an error in how "CAA" records were validated for these certificates.