Discover and read the best of Twitter Threads about #Squiblytwo

Most recents (2)

Today our behavioural anomaly hit an interesting sample.

1⃣ Macro Document
2⃣ Spawning Notead with a funny command line
3⃣ Spawning a WMIC instance
4⃣ WMIC running rundll32 with a malicious dll

But what got my attention was something else:
The bahaviour of wmic.

thread 👇🧵
I always looks for interesting behaviour, what you can notice is how is possible that WMIC is creating a process? 2 possibilites, or with the Macro injecting code, or #Squiblytwo

You can notice there is no Injection involved, nor the cmdline for Squiblytwo! 👇🧵
So i started digging the Macro and the behaviour was very funny.

1⃣ Macro spawns notepad and using Message Passing, it let create the document xsl needed later on
2⃣ Macro spawns wmic and using PostMessageA pass a new cmdline that will be the #Squiblytwo attack

👇🧵
Read 6 tweets
Sure this doc
C:\Users\zhenmingda\Desktop\application_form.doc
created by "Bil Smith" 🙈
contains an embedded stylesheet (coal.xsl) launched with #squiblytwo
and downloads loprtaf[.]icu/dctch.exe

But it also has some dirty macros. #SwearEngine
VT (14/58): virustotal.com/gui/file/324ac… ImageImageImage
Here's a link to the file on @virusbay_io:
💾beta.virusbay.io/sample/browse/…
Some interesting techniques - including some unique obfuscation. No wonder Bil was working on it for 3 hours...

Here's the extracted MSXSL: beta.virusbay.io/paste/browse/5… Image
@virusbay_io loprtaf[.]icu SSL certificate is not at all suspicious

Issuer: C=US, CN=Let's Encrypt Authority X3, O=Let's Encrypt
Validity
Not Before: 2019-08-03 11:07:50
Not After: 2019-11-01 11:07:50
Subject: CN=pofhssri[.]pw
Read 3 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!