Thread by @malmoeb

1/ USB malware, part 4: Blast from the past. Again, a user executed a shortcut on a USB stick, which led to the execution of the following commands:

🧵 #CyberSecurity

2/ 'C:\Windows\system32\cmd.exe' /c cls&cls&cls&cls&cls&cls&start explorer FACTURE' 'PROFORMA&cls&cls&start notepad.vbe&cls&cls&cls&cls&cls&cls&cls&cls&cls&cls&cls&exit

Explorer is opened as a camouflage. In the background, the VBE script 'd:\notepad.vbe' runs (sample [1] ).

3/ The code is encoded (hence the E in VBE), but with CyberChef, we can at least get some readable code, but the script uses other obfuscation techniques, which are relatively easy to reversing.

@_bromiley wrote an excellent article about VBE files. [3]

4/ The malware drops the file notepad.vbe into the directory "C:\Users\<username>\AppData\Roaming\notepad\" and sets the hidden flag on the file.

This is to protect the file from an "easy" discovery.

5/ The run key is used as persistence ("software\microsoft\windows\currentversion\run\notepad") with the value "wscript.exe /b 'c:\users\<username>\appdata\roaming\notepad\notepad.vbe", which again should be noticed relatively quickly during an AutoRuns hunting on the network.

6/ Our sample reach out to two IP addresses on port TCP/4747. We see the same port used in another sandbox analysis. [2]

7/ Despite the age (I have found references to this malware from 2015), we have seen a recent successful infection at a customer's site.

Hunting for processes (wscript.exe) connecting to external IP addresses on this port could be promising in some circumstances.

8/ References:

[1] virustotal.com/gui/file/a022a…
[2] hybrid-analysis.com/sample/a022a4e…
[3] bromiley.medium.com/malware-monday…