Today our behavioural anomaly hit an interesting sample.
1⃣ Macro Document
2⃣ Spawning Notead with a funny command line
3⃣ Spawning a WMIC instance
4⃣ WMIC running rundll32 with a malicious dll
But what got my attention was something else:
The bahaviour of wmic.
thread 👇🧵
1⃣ Macro Document
2⃣ Spawning Notead with a funny command line
3⃣ Spawning a WMIC instance
4⃣ WMIC running rundll32 with a malicious dll
But what got my attention was something else:
The bahaviour of wmic.
thread 👇🧵
I always looks for interesting behaviour, what you can notice is how is possible that WMIC is creating a process? 2 possibilites, or with the Macro injecting code, or #Squiblytwo
You can notice there is no Injection involved, nor the cmdline for Squiblytwo! 👇🧵
You can notice there is no Injection involved, nor the cmdline for Squiblytwo! 👇🧵
So i started digging the Macro and the behaviour was very funny.
1⃣ Macro spawns notepad and using Message Passing, it let create the document xsl needed later on
2⃣ Macro spawns wmic and using PostMessageA pass a new cmdline that will be the #Squiblytwo attack
👇🧵
1⃣ Macro spawns notepad and using Message Passing, it let create the document xsl needed later on
2⃣ Macro spawns wmic and using PostMessageA pass a new cmdline that will be the #Squiblytwo attack
👇🧵
This is how:
