Discover and read the best of Twitter Threads about #Squiblytwo
Most recents (2)
Today our behavioural anomaly hit an interesting sample.
1⃣ Macro Document
2⃣ Spawning Notead with a funny command line
3⃣ Spawning a WMIC instance
4⃣ WMIC running rundll32 with a malicious dll
But what got my attention was something else:
The bahaviour of wmic.
thread 👇🧵
1⃣ Macro Document
2⃣ Spawning Notead with a funny command line
3⃣ Spawning a WMIC instance
4⃣ WMIC running rundll32 with a malicious dll
But what got my attention was something else:
The bahaviour of wmic.
thread 👇🧵
I always looks for interesting behaviour, what you can notice is how is possible that WMIC is creating a process? 2 possibilites, or with the Macro injecting code, or #Squiblytwo
You can notice there is no Injection involved, nor the cmdline for Squiblytwo! 👇🧵
You can notice there is no Injection involved, nor the cmdline for Squiblytwo! 👇🧵
So i started digging the Macro and the behaviour was very funny.
1⃣ Macro spawns notepad and using Message Passing, it let create the document xsl needed later on
2⃣ Macro spawns wmic and using PostMessageA pass a new cmdline that will be the #Squiblytwo attack
👇🧵
1⃣ Macro spawns notepad and using Message Passing, it let create the document xsl needed later on
2⃣ Macro spawns wmic and using PostMessageA pass a new cmdline that will be the #Squiblytwo attack
👇🧵
Sure this doc
C:\Users\zhenmingda\Desktop\application_form.doc
created by "Bil Smith" 🙈
contains an embedded stylesheet (coal.xsl) launched with #squiblytwo
and downloads loprtaf[.]icu/dctch.exe
But it also has some dirty macros. #SwearEngine
VT (14/58): virustotal.com/gui/file/324ac…
C:\Users\zhenmingda\Desktop\application_form.doc
created by "Bil Smith" 🙈
contains an embedded stylesheet (coal.xsl) launched with #squiblytwo
and downloads loprtaf[.]icu/dctch.exe
But it also has some dirty macros. #SwearEngine
VT (14/58): virustotal.com/gui/file/324ac…
Here's a link to the file on @virusbay_io:
💾beta.virusbay.io/sample/browse/…
Some interesting techniques - including some unique obfuscation. No wonder Bil was working on it for 3 hours...
Here's the extracted MSXSL: beta.virusbay.io/paste/browse/5…
💾beta.virusbay.io/sample/browse/…
Some interesting techniques - including some unique obfuscation. No wonder Bil was working on it for 3 hours...
Here's the extracted MSXSL: beta.virusbay.io/paste/browse/5…
@virusbay_io loprtaf[.]icu SSL certificate is not at all suspicious
Issuer: C=US, CN=Let's Encrypt Authority X3, O=Let's Encrypt
Validity
Not Before: 2019-08-03 11:07:50
Not After: 2019-11-01 11:07:50
Subject: CN=pofhssri[.]pw
Issuer: C=US, CN=Let's Encrypt Authority X3, O=Let's Encrypt
Validity
Not Before: 2019-08-03 11:07:50
Not After: 2019-11-01 11:07:50
Subject: CN=pofhssri[.]pw
