1/ USB-Malware, part 3: Here we go again - a malicous USB-stick contained various shortcuts (DCIM.lnk, Video.lnk, etc.), including the malicious payload 'DCIM.JPG'.
š§µ #CyberSecurity
š§µ #CyberSecurity
2/ After clicking on one of the shortcuts, the infection chain was kicked off (@MarvHaim did the first analysis šŖ):
C:\Windows\system32\Wscript.exe' /e:Vbscript.Encode DCIM.JPG
The file DCIM.JPG is - surpise - not an actual JPG image but an obfuscated malicious VBS script. [1]
C:\Windows\system32\Wscript.exe' /e:Vbscript.Encode DCIM.JPG
The file DCIM.JPG is - surpise - not an actual JPG image but an obfuscated malicious VBS script. [1]
3/ The execution of the malicious script resulted in the following actions:
dcim.jpg was copied to c:\users\<username>\perflogs\dcim.jpg, following by setting the file attributes 'system' and 'hidden'.
dcim.jpg was copied to c:\users\<username>\perflogs\dcim.jpg, following by setting the file attributes 'system' and 'hidden'.
4/ wscript.exe was copied to c:\users\<username>\perflogs\ and renamed into 'csrss.pif' [2]
Since Microsoft signed the file (wscript.exe), this results in a good #Hunting opportunity (Microsoft signed binary started from a directory within AppData).
Since Microsoft signed the file (wscript.exe), this results in a good #Hunting opportunity (Microsoft signed binary started from a directory within AppData).
5/ The malware sets ShowSuperHidden to zero (HKEY_USERS\<SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced)
for hiding system files.
If you're recording registry modifications, this would be another hunting opportunity.
for hiding system files.
If you're recording registry modifications, this would be another hunting opportunity.
6/ Next, persistence:
Good ol' Run key: run\visionneuse de photos windows'
with the following value/command:
c:\users\<username>\perflogs\csrss.pif /e:vbscript.encode 'c:\users\<username>\perflogs\dcim.jpg /minimized
Good ol' Run key: run\visionneuse de photos windows'
with the following value/command:
c:\users\<username>\perflogs\csrss.pif /e:vbscript.encode 'c:\users\<username>\perflogs\dcim.jpg /minimized
7/ So, nothing really new or out of the ordinary, and hunting for persistences in a network should make the run key light up red.
Good luck š
Good luck š
8/ References:
[1] DCIM.jpg = virustotal.com/gui/file/1c44bā¦
[2] csrss.pif = virustotal.com/gui/file/34008ā¦
[1] DCIM.jpg = virustotal.com/gui/file/1c44bā¦
[2] csrss.pif = virustotal.com/gui/file/34008ā¦
ā¢ ā¢ ā¢
Missing some Tweet in this thread? You can try to
force a refresh
ć
,%20including%20the%20malicious%20payload%20'DCIM.JPG'.%20%F0%9F%A7%B5%20%23CyberSecurity%202/%20After%20clicking%20on%20one...%E2%80%A6%0A%0Ahttps://threadreaderapp.com/thread/1603289853420269568.html){kind=link}