FreshRSS

🔒
△ 🔃
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

SpectX: Log Parser for DFIR, (Tue, Apr 21st)

April 21st 2020 at 02:29
I hope this finds you all safe, healthy, and sheltered to the best of your ability.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

KPOT AutoIt Script: Analysis, (Mon, Apr 20th)

April 20th 2020 at 06:56
In diary entry "KPOT Deployed via AutoIt Script" I obtained 3 files:
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

KPOT Analysis: Obtaining the Decrypted KPOT EXE, (Sun, Apr 19th)

April 19th 2020 at 08:03
In diary entry "KPOT Deployed via AutoIt Script" I obtained 3 files:
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store, (Sat, Apr 18th)

April 18th 2020 at 18:38
This is a phishing document received today pretending to be an invoice (Word Document) from Apple Support but initial analysis shows it is a PDF document.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green


Weaponized RTF Document Generator & Mailer in PowerShell, (Fri, Apr 17th)

April 17th 2020 at 10:35
Another piece of malicious PowerShell script that I found while hunting. Like many malicious activities that occur in those days, it is related to the COVID19 pandemic. Its purpose of simple: It checks if Outlook is used by the victim and, if it's the case, it generates a malicious RTF document that is spread to all contacts extracted from Outlook. Let's have a look at it. The script is available on VT (SHA256: 1f7f0d75fe5dace66ec9b5935d28ba02765527f09f58345c2e33e17ab4c91bd7) and has a low score of 8/60[1].
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Using AppLocker to Prevent Living off the Land Attacks, (Thu, Apr 16th)

April 16th 2020 at 21:31
STI student David Brown published an STI research paper in January with some interesting ideas to prevent living off the land attacks with AppLocker. Living off the land attacks use existing Windows binaries instead of downloading specific attack tools. This post-compromise technique is very difficult to block. AppLocker isn't really designed to block these attacks because AppLocker by default does allow standard Windows binaries to run.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

No IOCs? No Problem! Getting a Start Hunting for Malicious Office Files, (Wed, Apr 15th)

April 15th 2020 at 12:53
Most of us know that macros in Office documents are one of the most common ways to get malware into an organization.  Unfortunately, all to many organizations depend on their AV products to detect these macros and the associated malware.  It's sad fact that macro's are easy to write, and it's not too tough to evade AV by being smart about how you write a malicious macro.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Microsoft April 2020 Patch Tuesday, (Tue, Apr 14th)

April 14th 2020 at 18:22
This month we got patches for 113 vulnerabilities total. According to Microsoft, three of them are being exploited (CVE-2020-1020, CVE-2020-0938 and CVE-2020-0968)  and two were previously disclosed (CVE-2020-1020 and CVE-2020-0935).
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Look at the same phishing campaign 3 months apart, (Mon, Apr 13th)

April 13th 2020 at 13:54
While going through a batch of malicious e-mails, which were caught by my mail filters in March, I noticed a simple phishing e-mail, which carried an entire credential-stealing page in its attachment. This, although interesting in its own way, would not be that unusual[1,2]. While I was analyzing it, however, I found that a nearly identical e-mail message, which was obviously part of the same campaign, was uploaded to Any.Run[3] back in January. Since I had two samples from nearly 3 months apart, I thought it might be interesting to take a look at how much has changed in this phishing campaign over that time.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Critical Vuln in vCenter vmdir (CVE-2020-3952), (Fri, Apr 10th)

April 10th 2020 at 22:30
On April 9, VMware published VMSA-2020-0006, a security advisory for a critical vulnerability in vCenter Server that received the maximum CVSSv3 score of 10.0.  The vulnerablity, %%cve:2020-3952%% , involves a sensitive information disclosure flaw in the VMware Directory Service (vmdir) which is included with VMware vCenter. Per the advisory, vmdir does not implement proper access controls, which could allow a malicious attacker with network access to obtain sensitive information.  This likely can allow the attacker to compromise other services which rely on vmdir for authentication.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

PowerShell Sample Extracting Payload From SSL, (Fri, Apr 10th)

April 10th 2020 at 09:32
Another diary, another technique to fetch a malicious payload and execute it on the victim host. I spotted this piece of Powershell code this morning while reviewing my hunting results. It implements a very interesting technique. As usual, all the code snippets below have been beautified.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Performing deception to OS Fingerprint (Part 1: nmap), (Sat, Mar 28th)

April 9th 2020 at 21:58
How can you know which operating system is running on a specific remote host? The technique to answer this question corresponds to the fingerprinting of the operating system and is executed by sending a specific set of packages to the remote host and see how it behaves. Each operating system responds differently, which allows it to be identified. 
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Password Protected Malicious Excel Files, (Mon, Apr 6th)

April 6th 2020 at 18:32
We've been seeing quite some malicious Excel files with Excel 4 macros lately.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Maldoc XLS Invoice with Excel 4 Macros, (Sun, Apr 5th)

April 5th 2020 at 20:20
This week I got an email claiming to be a YellowPages invoice with an XLS attachment containing an Excel 4.0 macro which has similarity to [1][2].
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

New Bypass Technique or Corrupt Word Document?, (Sat, Apr 4th)

April 4th 2020 at 23:07
I was taking a closer look at Xavier's Word document he analyzed in yesterday's diary entry: "Obfuscated with a Simple 0x0A".
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Obfuscated with a Simple 0x0A, (Fri, Apr 3rd)

April 3rd 2020 at 08:12
With the current Coronavirus pandemic, we continue to see more and more malicious activity around this topic. Today, we got a report from a reader who found a nice malicious Word document part of a Coronavirus phishing campaign. I don't know how the URL was distributed (probably via email) but the landing page is fake White House-themed page. So, probably targeting US citizens.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Kwampirs Targeted Attacks Involving Healthcare Sector, (Tue, Mar 31st)

March 31st 2020 at 00:52
There is no honor among thieves. Even after some ransomware gangs claimed to seize targeting the healthcare sector, attacks continue to happen. But ransomware isn't alone. Last week, the FBI updated an advisory regarding the Kwampirs malware, pointing out the healthcare sector as one of its targets. Kwampirs isn't picky in its targeting. It has been observed going after various sectors (financial, energy, software supply chain, and healthcare, among others). One differentiator of Kwampirs is its modular structure. After penetrating a particular target network, the malware will load appropriate modules based on the targets it encounters. In general terms, Kwampirs is a "Remote Admin Tool" (RAT). It provides access to the target and can be used to execute additional payloads at the attacker's choosing.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Crashing explorer.exe with(out) a click, (Mon, Mar 30th)

March 30th 2020 at 06:12
In a couple of my recent diaries, we discussed two small unpatched vulnerabilities/weaknesses in Windows. One, which allowed us to brute-force contents of folders without any permissions[1], and another, which enabled us to change names of files and folders without actually renaming them[2]. Today, we’ll add another vulnerability/weakness to the collection – this one will allow us to cause a temporary DoS condition for the Explorer process (i.e. we will crash it) and/or for other processes. It is interesting since all that is required for it to work is that a user opens a link or visits a folder with a specially crafted file.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Obfuscated Excel 4 Macros, (Sun, Mar 29th)

March 29th 2020 at 14:53
2 readers (anonymous and Robert) submitted very similar malicious spreadsheets with almost no detections on VT: c1394e8743f0d8e59a4c7123e6cd5298 and a03ae50077bf6fad3b562241444481c1.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Covid19 Domain Classifier, (Sat, Mar 28th)

March 28th 2020 at 11:16
Johannes started a Covid19 Domain Classifier here on our Internet Storm Center site.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Malicious JavaScript Dropping Payload in the Registry, (Fri, Mar 27th)

March 27th 2020 at 07:11
When we speak about "fileless" malware, it means that the malware does not use the standard filesystem to store temporary files or payloads. But they need to write data somewhere in the system for persistence or during the infection phase. If the filesystem is not used, the classic way to store data is to use the registry. Here is an example of a malicious JavaScript code that uses a temporary registry key to drop its payload (but it also drops files in a classic way).
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Very Large Sample as Evasion Technique?, (Thu, Mar 26th)

March 26th 2020 at 06:53
Security controls have a major requirement: they can't (or at least they try to not) interfere with normal operations of the protected system. It is known that antivirus products do not scan very large files (or just the first x bytes) for performance reasons. Can we consider a very big file as a technique to bypass security controls? Yesterday, while hunting, I spotted a very interesting malware sample. The malicious PE file was delivered via multiple stages but the final dropped file was large... very large!
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Another Critical COVID-19 Shortage: Digital Security, (Tue, Mar 24th)

March 24th 2020 at 04:14
Following is a guest cross-post from John Scott-Railton, a Senior Researcher at The Citizen Lab. His work focuses on technological threats to civil society.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability, (Mon, Mar 23rd)

March 24th 2020 at 01:22
Microsoft announced limited exploitation of a zeroday remote code execution vulnerability in the type 1 font parser.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

KPOT Deployed via AutoIt Script, (Mon, Mar 23rd)

March 23rd 2020 at 18:31
I have other samples like the malware I covered in yesterday's diary entry.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

More COVID-19 Themed Malware, (Sun, Mar 22nd)

March 22nd 2020 at 20:30
Reader Andrew received a COVID-19 themed email with malicious attachment, and submitted the complete email.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green


Honeypot - Scanning and Targeting Devices & Services, (Sat, Mar 21st)

March 21st 2020 at 20:28
I was curious this week to see if my honeypot traffic would increase since a large portion of the world is working from home. Reviewing my honeypot logs, I decided to check what type of filename was mostly targeted (GET/POST/HEAD) by scanners  this past week on any web supported ports (i.e. 80, 81, 8000, etc). This first graph shows overall activity for the past 7 days.
☐ ☆ ✇ SANS Internet Storm Center, InfoCON: green

COVID-19 Themed Multistage Malware, (Thu, Mar 19th)

March 19th 2020 at 06:41
More and more countries are closing their borders and ask citizens to stay at home. The COVID-19 virus is everywhere and also used in campaigns to lure more victims who are looking for information about the pandemic. I found a malicious email that delivers a multi-stage malware.
❌