Thread by @therealwlambert

🦖Day 37 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: Exchange[.]Windows[.]Detection[.]ISOMount

Author: @ConorQuinn92

Link: docs.velociraptor.app/exchange/artif…

After Microsoft decided to block Office macros by default, threat actors began pivoting to a usage of container files such as .iso, .rar, and .lnk files for malware distribution.

This is because TAs can then bypass the "Mark of the web" restrictions for downloaded files.

When downloaded, container files will have the MOTW attribute because they were downloaded from the internet. However, the document inside, such as a macro-enabled spreadsheet, will not.

When the document is extracted from the container, the user will still have to enable macros for the malicious code to automatically execute, but document will not be considered as coming from the internet.

Aside from usage of macro-enabled documents, threat actors can also used container files to distribute payloads directly. These container files may included files such as, the following (which can install a malicious payload) :

- LNKs
- DLLs
- EXEs

One way we can look for this type of activity is through identification of ISO mounting.

This artifact searches through the 'Microsoft-Windows-VHDMP-Operational' Windows event log looking for specific event IDs and the .iso file extension to identify ISO mounting.

We can see the following information around an ISO mount event:

- Time of the event
- Computer on which the file was mounted
- User that mounted the file
- Event ID/channel/record ID
- Message
- Event data
- Filename (what file was mounted)

Here, we can see the contents of the ISO via File Explorer. 👀

- AllTheThingsx64.dll
- document (LNK/shortcut)

In this case, the 'document.lnk' file is executed from the 'AllTheThings.iso'.

The LNK file then executes 'cmd.exe' and rundll32 to in order to load and execute 'AllTheThingsx64.dll' from the ISO, which spawns 'calc.exe'. 😜

('Windows[.]Forensics[.]Lnk' - parse the .lnk)

Why spawn 'calc.exe'? This a test from Atomic Red Team!

You can try this out, by following the instructions here:
github.com/redcanaryco/at…

While the example provided may not have been truly malicious, it illustrates how a TA might use similar tactics/techniques.

An example of real-world usage similar to the above can be found in this research published by Proofpoint discussing Bumblebee:

proofpoint.com/us/blog/threat…

That's it for now! Stay tuned to learn about more artifacts! 🦖

Also, check out the following resources for more information!

MITRE ATT&CK - MOTW Bypass:
attack.mitre.org/techniques/T15…

Obscure WELs:
nasbench.medium.com/finding-forens…

Post-Macro/Containers:
proofpoint.com/us/blog/threat…

#DFIR