Posts

Showing posts from 2018

Malicious office doc with process hollowing shellcode

Image
Introduction 

This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer Part-1 and Part-2 to get an understanding of  tools and approach to analyse phishing documents. 

Tools 
Didier Stevens Suite sudo pip install oletools Analysis
SHA256: 5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d
This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and the encoded shellcode is a property in stream 17.  The shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or process replacement.The explorer.exe process is created in a suspended state, the code for explorer.exe is removed, the code for the payload…

Malicious office document analysis Part-3

Image
Introduction
This post covers how to identify and extract potential malicious content like embedded executable and payloads from Macro forms in office documents. Refer Part-1 and Part-2 to get an understanding of  tools and approach to analyse phishing documents.

Tools 
Didier Stevens Suite sudo pip install oletools Analysis 
All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 
Hash: 345b804a9416595840516674caaa65e65be57591d300beab2b6190298a9eac78
Download above mentioned sample and check the integrity Check the file properties using native Linux file command which gives quick idea about sample Ran oledump.py  to check the embedded macros and macro related forms
It was found that stream 14 and 15 look like macro forms.  Dump them using -d option to check anything suspicious content in it
Wow ! Hex 4d5a was observed which is traditional ASCII MZ header…

Malicious document analysis Part-2

Image
Introduction 
A basic and quick approach to analyse phishing documents to identify indicators of maliciousness. Refer Part-1 to understand the tools and approach to analyse office word document. This post covers the  static analysis of pdf document to identify suspicious objects. (FYI  running pdf in sandbox environment can give much insight related to indicators of compromise.)  FYI this post doesn't cover complete & in depth analysis (like dealing with malicious obfuscated javascripts or shellcode)  of malicious documents
Tools peepdfDidier Stevens Suite  Analysis  All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 
Hash:93fc24573bd563f08b3a6a71276bfe085488d3bbb8d79bbbc3a75e5c0497e915 6256dead623ef48c9506e9d5dd92227c59f92828cff610a093b956f3bd7284c2

To analyse PDF files,  open them in a hex editor and look for the  signs of malicious PDF files, l…

Malicious document analysis Part - 1

Image
Introduction 
A basic and quick approach to analyse phishing documents to identify indicators of maliciousness. FYI this post doesn't cover complete & in depth analysis of malicious documents

Tools 
Didier Stevens Suite sudo pip install oletools Yara - A pattern matching Swiss knife Analysis  All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 
Hash 1: e07c84f98332b07ae40a22f15c32cbf794586e26576a7539def667881e15beae

Download above mentioned sample and check the integrity
Check the file properties using native Linux file command which gives quick idea about sample
Download Didier Stevens Suite and check for yara rules.
Run various rules against the sample document to identify any sort of maliciousness
The below rule can identify an executable file embedded in OLE objects
 Run above yara rule against the downloaded document
Observe the below mald…

Memory dump analysis of Donny's System

Image
Introduction 

This post solves the mystery of Donny's System  and outlines how to utilize memory forensics methodology to uncover artifacts from memory dumps

Tools: Volatility, Yara  & Windows Powershell

Analysis

Six-step investigative methodology by SANS

Identify rogue processes Analyze process DLLs and handles  Review network artifacts Look for evidence of code injection Check for signs of rootkitDump suspicious processes and drivers  Run volatility imageinfo plugin  to identify profile  PS C:\volatility> .\vol.exe -f .\unknown.vmem imageinfo
Run Volatility pslist plugin to see active running processes
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist
Just to remind that all process creation and termination timings are specified in UTC. Ensure to change them to system timezone while correlating the events with other sources of evidence
game.exe clearly looks suspicious as it ran and exit in a short span of time. The most interesting part was explor…