Malware Analysis Exercise – Living Off the Land with Powershell

It is common for threat actors to utilize living off the land (LOTL) techniques, such as the execution of PowerShell to further their attacks and transition from macro code. This lab is intended to show how you can often times perform quick analysis to extract important IOCs. While there may be several ways to answer these questions the focus on this exercise is on static techniques for analysis. You can find the exercise, artifacts and full walk-through on my Github at https://github.com/jstrosch/malware-samples/tree/master/malware_analysis_exercises/2020/December Looking for more of a challenge? Try this on CyberDefenders as part of their CTF! https://cyberdefenders.org/labs/51

Read more

Malware Analysis Exercise – Getting Started with Excel 4 Macros

Recently, we have seen a resurgence of Excel-based malicious office documents. However, instead of using VBA-style macros, they are using older style Excel 4 macros. This changes our approach to analyzing these documents, requiring a slightly different set of tools. In this challenge, you’ll get hands-on with two documents that use Excel 4.0 macros to perform anti-analysis and download the next stage of the attack. You can find the exercise, artifacts and full walk-through on my Github at https://github.com/jstrosch/malware-samples/tree/master/malware_analysis_exercises/2021/February. Looking for more of a challenge? Try this on CyberDefenders as part of their CTF! https://cyberdefenders.org/labs/55

Read more

Excel 4 Macros – Get.Workspace Reference

With the recent resurgence of the use of Excel 4 macros in malicious excel documents, I’ve found myself scouring the internet looking for language references. One such function that was particularly difficult to find documentation for was Get.Workspace, which takes a integer value as an argument and returns information about the environment. Since it appears that it is all but impossible to find Excel 4 macro documentation from Microsoft, I thought I’d create a few posts in the hopes of the content getting indexed and thus easier to find. The source of this information came from this PDF, which used…

Read more

Removing Passwords from VBA Projects

Occasionally I’ll encounter a maldoc that has a password-protected VBA project. While tools such as oledump may still extract the macros, the password protection is typically encountered when accessing the project through the Office/VBA IDE (which I typically use for dynamic analysis). This happens rare enough that I often forget the steps of removing the password so thought I’d start collecting possible solutions. Word – 2007+ Sample MD5: dc989fa836fa93fe1f158fa490382686Any.Run: https://app.any.run/tasks/dd8ae979-4afc-44ac-99d2-3b57f9d6e2b1Hybrid-Analysis: https://www.hybrid-analysis.com/sample/4bb275b253db05bfa23a677d3db8f78cef0d633bbef19d05e37780f61577153c?environmentId=100 With this type of document, you can rename the original file with a .zip extension, this will allow you to explore the contents. This type of file uses the…

Read more

Malware Analysis – Triaging Emotet (Fall 2019)

This is a summary of initial (triage) analysis of Emotet droppers and the associated network traffic from the fall of 2019. This write-up provides the tools/techniques for assessing the malicious samples and gathering initial indicators of compromise (IOCs). While Emotet will certainly continue to evolve, the approach outlined here will provide a solid foundation for anyone looking to continue to analyze Emotet (or similiar). Please Click Enable Content Since resuming operations in September 2019, Emotet has not failed in regaining a foothold as a dominent botnet.[1] To accomplish this, Emotet regularly utilizes macro-enabled Microsoft Office documents to retrieve and drop…

Read more