Mastodawn

Acquiredsec Dec 1, 2022

SHA1: e845d373bdbfad8c95c4eed2d56bd43649e1695a

https://bazaar.abuse.ch/sample/111884defe575650260a2eaab6c0fc2a3ebd3fbe4a9bf75bb56944a13f0aa009/

PWD Protected ZIP > ISO > LNK > BAT >DLL / EXE

C:\Windows\System32\cmd.exe /c navbar.bat

Starts process from LNK file and creates a scheduled task to install service.
Runs EXE from root of PrgramData.

SCHTASKS/create/tn"UpdateService"/tr"cmd.exe/cC:\programdata\YxurWe0fMb8Vi.exeC:\programdata\taxonomy.dll,cmfgutil"/schourly/mo1/sd01/01/2022/st00:00

MalwareBazaar | Checking your browser

Acquiredsec Nov 30, 2022

#Qakbot #threathunting tips for the week. 🦆 🤖

🚨 ISO > JS > wscript>PowerShell>DLL🚨

PowerShell Command Line Args
-ExecutionPolicy Bypass

📢 Anything Executing out of users\Public?
C:\users\public\*.jpg

And more Cmdline Args:

✔️ FromBase64String
✔️start-process regsvr32
✔️start-process Rundll32

Show thread

Acquiredsec Nov 23, 2022

Cmdline Telemetry

"C:\Windows\System32\cmd.exe" /c if exist C:\Users\<user>\AppData\Local\Temp\temp1_job_offer.zip\job_descr_10_22.pdf.lnk (certutil.exe -decode C:\Users\<user>\AppData\Local\Temp\temp1_job_offer.zip\job_descr_10_22.pdf.lnk C:\Users\<user>\AppData\Local\Temp\.hta&start C:\Users\<user>\AppData\Local\Temp\.hta)else (certutil -decode job_descr_10_22.pdf.lnk C:\Users\<user>\AppData\Local\Temp\.hta&start C:\Users\<user>\AppData\Local\Temp\.hta)

Show thread

Acquiredsec Nov 23, 2022

For anyone using SentinelOne here's a few easy ways to find this.

The initial execution of the LNK file: IndicatorName = "SuspiciousCmdFromLnk"

IndicatorName = "SuspiciousCmdFromLnk" AND SrcProcCmdLine Contains Anycase "certutil"

documented here on my GIT:

https://github.com/acquiredsecurity/Sentinel-One-STAR-Rules-Threat-Hunts/blob/main/HUNT/Malware:%20ZippyReads

Sentinel-One-STAR-Rules-Threat-Hunts/Malware: ZippyReads at main · acquiredsecurity/Sentinel-One-STAR-Rules-Threat-Hunts

SentinelOne STAR Rules. Contribute to acquiredsecurity/Sentinel-One-STAR-Rules-Threat-Hunts development by creating an account on GitHub.

GitHub

Acquiredsec Nov 23, 2022

Some hunting opportunities for:
https://www.virustotal.com/gui/file/13846a9778f224ae692edddcc90746d0e619f872733c2c880188c36797b2c4e7

@k3dg3 and pointed out by @gossithedog #ZippyReads

PDF LNK file uses cerutil -decode and .hta. fetches .zip file payload and connects to C2.

michaelpagerecruitment-ukoffers(d)com
r3(d)o(d)lencr(d)org

#threatintel

VirusTotal

Acquiredsec Nov 23, 2022

Kevin Beaumont Nov 23, 2022

Great #malware sample caught by @k3dg3 #threatintel

Exploits #ZippyReads (read only file for bypass of Mark-of-the-Web) and #DefenderExplode, a large file zero day in Microsoft Defender AV which breaks their telemetry and detection.

Targets Italy. Calls michaelpagerecruitment-ukoffers.]com

https://www.virustotal.com/gui/file/13846a9778f224ae692edddcc90746d0e619f872733c2c880188c36797b2c4e7

VirusTotal

Acquiredsec Nov 22, 2022

Two easy detection/hunt opportunities for this week and the last several weeks, months, years. #qakbot #bumblebee #malware #threathunt

ISO Files, JS, VBS, DLL OH MY 🦁 🐅 🐻

🚨 **regsvr outgoing IP connection events 🦆 🤖

🚨 **rundll32 outgoing IP connection events with rundll32 and a command parameter of CheckSettings in the cmdline telemetry 🐝