1
00:00:01,920 --> 00:00:03,679
hello and welcome to blue team village's

2
00:00:03,679 --> 00:00:05,200
project obsidian reverse engineering

3
00:00:05,200 --> 00:00:07,200
malware station walkthrough this is long

4
00:00:07,200 --> 00:00:08,720
walks on the beach analyzing collected

5
00:00:08,720 --> 00:00:10,719
powershells and today we're going to be

6
00:00:10,719 --> 00:00:12,320
going over some basic powershell scripts

7
00:00:12,320 --> 00:00:14,240
obtained for us by our forensics team

8
00:00:14,240 --> 00:00:15,679
and going over some tactics and

9
00:00:15,679 --> 00:00:17,119
techniques and understanding them as

10
00:00:17,119 --> 00:00:18,640
well as a few basic diffusation

11
00:00:18,640 --> 00:00:20,400
techniques this workshop is geared

12
00:00:20,400 --> 00:00:21,840
toward beginners and absolute newbies so

13
00:00:21,840 --> 00:00:24,240
if you're looking for more advanced um

14
00:00:24,240 --> 00:00:26,640
and in-depth analysis uh for powershell

15
00:00:26,640 --> 00:00:28,640
techniques on the obfuscation we're

16
00:00:28,640 --> 00:00:30,000
looking to release content like that in

17
00:00:30,000 --> 00:00:33,280
the future so keep an eye out for that

18
00:00:33,280 --> 00:00:35,200
so a little bit about myself my name is

19
00:00:35,200 --> 00:00:37,680
allison although i go by scrabble

20
00:00:37,680 --> 00:00:39,680
i'm a fourth year cybersecurity major at

21
00:00:39,680 --> 00:00:42,000
a university over the northeast and my

22
00:00:42,000 --> 00:00:43,520
background is mainly an incident

23
00:00:43,520 --> 00:00:45,680
response reverse engineering and cyber

24
00:00:45,680 --> 00:00:47,600
security engineering

25
00:00:47,600 --> 00:00:49,039
it's a little bit all over the place but

26
00:00:49,039 --> 00:00:51,039
generally speaking i like to stay in the

27
00:00:51,039 --> 00:00:53,520
blue team side of things uh this is my

28
00:00:53,520 --> 00:00:55,360
second year with blizzy village so last

29
00:00:55,360 --> 00:00:57,199
year i was part of the malware station

30
00:00:57,199 --> 00:00:59,199
as well i just wasn't leading it this

31
00:00:59,199 --> 00:01:00,960
year i'm leading two workshops which is

32
00:01:00,960 --> 00:01:03,120
a really amazing opportunity 10 out of

33
00:01:03,120 --> 00:01:05,280
10 recommend to join this community

34
00:01:05,280 --> 00:01:07,680
there's really fantastic people in there

35
00:01:07,680 --> 00:01:10,000
with such a depth of knowledge um and

36
00:01:10,000 --> 00:01:11,760
totally recommend just you know even

37
00:01:11,760 --> 00:01:13,920
talking to any of the people involved in

38
00:01:13,920 --> 00:01:16,240
the stations because really there's just

39
00:01:16,240 --> 00:01:19,119
such um amazing variety of knowledge

40
00:01:19,119 --> 00:01:20,159
here

41
00:01:20,159 --> 00:01:21,520
oh and i guess a little fun fact about

42
00:01:21,520 --> 00:01:23,920
myself i really love black cats i have

43
00:01:23,920 --> 00:01:25,840
one of my own and contrary to all the

44
00:01:25,840 --> 00:01:27,680
stereotypes i thought like she's super

45
00:01:27,680 --> 00:01:30,880
super clingy um so that's a little funny

46
00:01:30,880 --> 00:01:33,280
but all right so going on into the meat

47
00:01:33,280 --> 00:01:35,200
of this uh so what we're going to be

48
00:01:35,200 --> 00:01:37,280
going over today is assuming from an

49
00:01:37,280 --> 00:01:38,799
absolute beginner perspective you've

50
00:01:38,799 --> 00:01:41,119
never done malware analysis before or

51
00:01:41,119 --> 00:01:42,640
maybe the most you've ever done is just

52
00:01:42,640 --> 00:01:44,640
pop something in the sandbox uh so what

53
00:01:44,640 --> 00:01:45,680
we're going to do is we're going to

54
00:01:45,680 --> 00:01:48,079
start with the basics of setting up a vm

55
00:01:48,079 --> 00:01:50,000
what vms you want to look for

56
00:01:50,000 --> 00:01:51,680
so recommendations and then some

57
00:01:51,680 --> 00:01:53,680
settings you should be on the lookout

58
00:01:53,680 --> 00:01:56,479
for when you're configuring your vms

59
00:01:56,479 --> 00:01:58,479
secondly taking precautions

60
00:01:58,479 --> 00:02:00,079
so going over some things like opsec

61
00:02:00,079 --> 00:02:02,960
when analyzing malware samples

62
00:02:02,960 --> 00:02:04,560
and then we're going to touch on some

63
00:02:04,560 --> 00:02:06,719
basic static analysis so what is static

64
00:02:06,719 --> 00:02:08,080
analysis or the different forms of

65
00:02:08,080 --> 00:02:10,318
malware analysis and then some

66
00:02:10,318 --> 00:02:12,480
particulars about powershell

67
00:02:12,480 --> 00:02:14,160
and then we're going to be going into

68
00:02:14,160 --> 00:02:15,599
our demo one which is going to be

69
00:02:15,599 --> 00:02:18,000
covering kill chain one kill chain three

70
00:02:18,000 --> 00:02:20,640
um which has five powershell samples

71
00:02:20,640 --> 00:02:23,120
that are all unobfuscated which may

72
00:02:23,120 --> 00:02:25,040
sound easy but we're taking a pretty

73
00:02:25,040 --> 00:02:27,200
non-technical approach in trying to

74
00:02:27,200 --> 00:02:29,200
understand what's going on here and some

75
00:02:29,200 --> 00:02:31,760
limitations that we may have

76
00:02:31,760 --> 00:02:33,200
and then we're going to be going on to

77
00:02:33,200 --> 00:02:34,800
our second demo which is looking at kill

78
00:02:34,800 --> 00:02:36,879
chain one the two powershell scripts

79
00:02:36,879 --> 00:02:38,959
that are in there uh taking a look at

80
00:02:38,959 --> 00:02:40,959
some ways to de-obfuscate them as well

81
00:02:40,959 --> 00:02:42,959
as some things to look out for uh when

82
00:02:42,959 --> 00:02:44,879
you're going through your analysis and

83
00:02:44,879 --> 00:02:46,480
then finally some takeaways from this

84
00:02:46,480 --> 00:02:48,720
whole workshop uh things to you know

85
00:02:48,720 --> 00:02:51,599
hopefully you know take in and keep with

86
00:02:51,599 --> 00:02:54,000
you as you go on your malware analysis

87
00:02:54,000 --> 00:02:55,760
journey

88
00:02:55,760 --> 00:02:57,040
all right so we're going to start

89
00:02:57,040 --> 00:02:58,720
setting things up and if you have your

90
00:02:58,720 --> 00:03:00,720
hands on the samples already uh totally

91
00:03:00,720 --> 00:03:02,400
get those uh but i think you might have

92
00:03:02,400 --> 00:03:04,879
noticed especially for the kill chain 3

93
00:03:04,879 --> 00:03:06,239
powershell samples is that they've all

94
00:03:06,239 --> 00:03:07,920
been defanged which is a fancy way of

95
00:03:07,920 --> 00:03:09,840
saying they're all text documents now so

96
00:03:09,840 --> 00:03:11,760
if you accidentally double click them

97
00:03:11,760 --> 00:03:12,959
you're not accidentally running a

98
00:03:12,959 --> 00:03:14,800
powershell script you're just opening a

99
00:03:14,800 --> 00:03:16,879
text editor and seeing you know whatever

100
00:03:16,879 --> 00:03:19,280
visible code is there

101
00:03:19,280 --> 00:03:20,640
however that's not to say that you

102
00:03:20,640 --> 00:03:22,800
shouldn't uh work with these in a safe

103
00:03:22,800 --> 00:03:24,560
environment uh because you definitely

104
00:03:24,560 --> 00:03:26,560
should it's good practice too even if

105
00:03:26,560 --> 00:03:28,319
you believe something has been defamed

106
00:03:28,319 --> 00:03:30,400
always be cautious with it um like i say

107
00:03:30,400 --> 00:03:31,920
it only takes one time and then you

108
00:03:31,920 --> 00:03:34,560
learn your lesson the hard way i had a

109
00:03:34,560 --> 00:03:35,920
fellow student when i was learning

110
00:03:35,920 --> 00:03:37,519
malware analysis for the first time in

111
00:03:37,519 --> 00:03:40,400
college um who thought that he was on

112
00:03:40,400 --> 00:03:42,159
you know his host um

113
00:03:42,159 --> 00:03:45,040
let us host his um analysis vm you know

114
00:03:45,040 --> 00:03:47,200
totally safe uh deployed some ransomware

115
00:03:47,200 --> 00:03:48,799
for dynamic analysis and then didn't

116
00:03:48,799 --> 00:03:50,239
realize he was actually on his host and

117
00:03:50,239 --> 00:03:52,239
he deployed ransomware on his personal

118
00:03:52,239 --> 00:03:55,439
computer uh which isn't great um so

119
00:03:55,439 --> 00:03:57,360
definitely i would say good practices

120
00:03:57,360 --> 00:04:00,159
double check if you're you know in your

121
00:04:00,159 --> 00:04:02,400
uh analysis vm making sure you're taking

122
00:04:02,400 --> 00:04:04,400
all precautions before you start uh

123
00:04:04,400 --> 00:04:06,080
playing around with things

124
00:04:06,080 --> 00:04:07,920
so uh some recommendations uh you're

125
00:04:07,920 --> 00:04:09,120
going to want some kind of

126
00:04:09,120 --> 00:04:11,360
virtualization software ritual box is

127
00:04:11,360 --> 00:04:13,680
free i personally use vmware because i

128
00:04:13,680 --> 00:04:15,680
just have that available to me

129
00:04:15,680 --> 00:04:18,320
but anything that really works for you

130
00:04:18,320 --> 00:04:21,120
going on to the two

131
00:04:21,120 --> 00:04:22,240
things that i would recommend

132
00:04:22,240 --> 00:04:23,840
specifically for this workshop but also

133
00:04:23,840 --> 00:04:24,960
in general

134
00:04:24,960 --> 00:04:26,479
some sort of linux distro i would

135
00:04:26,479 --> 00:04:28,479
recommend remnix because that becomes

136
00:04:28,479 --> 00:04:30,720
pre-loaded with a bunch of really useful

137
00:04:30,720 --> 00:04:32,960
malware analysis tools

138
00:04:32,960 --> 00:04:34,960
um so definitely grab that

139
00:04:34,960 --> 00:04:37,440
and then optionally um i will briefly

140
00:04:37,440 --> 00:04:40,080
touch on doing some things in windows so

141
00:04:40,080 --> 00:04:42,080
i'd recommend some form of windows vm a

142
00:04:42,080 --> 00:04:44,400
flare vm which is additionally free uh

143
00:04:44,400 --> 00:04:45,919
comes from mandiant

144
00:04:45,919 --> 00:04:47,360
is um

145
00:04:47,360 --> 00:04:49,199
a windows distro where like remnix it

146
00:04:49,199 --> 00:04:50,560
comes pre-loaded with a bunch of really

147
00:04:50,560 --> 00:04:52,800
great tools for malware analysis

148
00:04:52,800 --> 00:04:54,160
and then once you have that all set up

149
00:04:54,160 --> 00:04:55,919
once you have you know logged in get

150
00:04:55,919 --> 00:04:56,960
into your

151
00:04:56,960 --> 00:04:59,120
virtual machines uh what you want to

152
00:04:59,120 --> 00:05:00,880
gonna want to do is that in your network

153
00:05:00,880 --> 00:05:02,960
settings you're going to want to switch

154
00:05:02,960 --> 00:05:05,280
from whatever nat bridge whatever option

155
00:05:05,280 --> 00:05:08,720
you have currently set to host only

156
00:05:08,720 --> 00:05:11,039
this is to disconnect your vm from the

157
00:05:11,039 --> 00:05:12,960
external network and to sort of protect

158
00:05:12,960 --> 00:05:15,360
your own hosts as well um so that you

159
00:05:15,360 --> 00:05:17,520
know in the case if you're ever running

160
00:05:17,520 --> 00:05:19,440
it dynamically if you're not executing

161
00:05:19,440 --> 00:05:21,120
the actual malware you're protecting

162
00:05:21,120 --> 00:05:22,560
yourself you're protecting the outside

163
00:05:22,560 --> 00:05:23,600
world

164
00:05:23,600 --> 00:05:25,039
you're just keeping it contained with

165
00:05:25,039 --> 00:05:26,720
within that vm

166
00:05:26,720 --> 00:05:29,120
in that regard

167
00:05:29,120 --> 00:05:32,080
so moving on to taking some precautions

168
00:05:32,080 --> 00:05:33,680
um

169
00:05:33,680 --> 00:05:35,680
some things about opsec especially when

170
00:05:35,680 --> 00:05:37,199
it pertains to malware analysis and

171
00:05:37,199 --> 00:05:40,240
beginners when you get samples so i know

172
00:05:40,240 --> 00:05:41,680
if you have any experience in working in

173
00:05:41,680 --> 00:05:43,919
a sock before i did my previous

174
00:05:43,919 --> 00:05:45,680
internship

175
00:05:45,680 --> 00:05:47,120
standard practice

176
00:05:47,120 --> 00:05:49,280
is to usually if you do have a sample or

177
00:05:49,280 --> 00:05:51,280
something malicious you throw it into a

178
00:05:51,280 --> 00:05:53,520
sandbox typically this is

179
00:05:53,520 --> 00:05:55,680
at least in the case of my company a

180
00:05:55,680 --> 00:05:59,360
private sandbox that is not public um

181
00:05:59,360 --> 00:06:01,360
in that case that was pretty safe to do

182
00:06:01,360 --> 00:06:02,880
uh because we're not really necessarily

183
00:06:02,880 --> 00:06:05,199
learning people publicly that we're

184
00:06:05,199 --> 00:06:06,400
analyzing this

185
00:06:06,400 --> 00:06:08,080
but generally speaking when you're using

186
00:06:08,080 --> 00:06:09,919
public resources you want to check the

187
00:06:09,919 --> 00:06:11,280
hash first you don't want to submit the

188
00:06:11,280 --> 00:06:13,840
actual sample and so in checking the

189
00:06:13,840 --> 00:06:15,360
hash you're determining one of two

190
00:06:15,360 --> 00:06:18,560
things is this known or is this unknown

191
00:06:18,560 --> 00:06:20,639
and then basing your next steps off of

192
00:06:20,639 --> 00:06:23,919
that so if it's known then typically

193
00:06:23,919 --> 00:06:26,240
you'll come with you know the sandbox um

194
00:06:26,240 --> 00:06:28,160
analysis maybe if it's something that's

195
00:06:28,160 --> 00:06:30,319
known that's really well known uh say

196
00:06:30,319 --> 00:06:31,840
you know i gotta wanna cry sample once

197
00:06:31,840 --> 00:06:33,120
wannacry is really well known it's

198
00:06:33,120 --> 00:06:34,720
really well documented as to what it

199
00:06:34,720 --> 00:06:37,199
does what steps it takes um so when

200
00:06:37,199 --> 00:06:38,800
writing up your final report for that

201
00:06:38,800 --> 00:06:40,560
analysis you'll be like hey you know

202
00:06:40,560 --> 00:06:42,319
this is determined to be wannacry

203
00:06:42,319 --> 00:06:44,160
obviously double check you know don't

204
00:06:44,160 --> 00:06:46,479
just trust the hash make it make sure

205
00:06:46,479 --> 00:06:48,000
make the necessary comparisons to make

206
00:06:48,000 --> 00:06:49,680
sure that this has all the you know

207
00:06:49,680 --> 00:06:51,840
typical ifcs that you know want to cry

208
00:06:51,840 --> 00:06:54,319
or whatever you have might have

209
00:06:54,319 --> 00:06:56,000
and then say like okay this is it this

210
00:06:56,000 --> 00:06:58,639
is it you have all that nice data and

211
00:06:58,639 --> 00:07:00,639
open source knowledge to kind of feed

212
00:07:00,639 --> 00:07:02,800
off of but otherwise if it's something

213
00:07:02,800 --> 00:07:04,319
that's not known you want to start

214
00:07:04,319 --> 00:07:06,400
treating it carefully so i wouldn't

215
00:07:06,400 --> 00:07:08,400
recommend to submit it into any sort of

216
00:07:08,400 --> 00:07:10,400
public sandbox just because you run the

217
00:07:10,400 --> 00:07:11,840
risk of tipping off threat actors and

218
00:07:11,840 --> 00:07:13,360
generally speaking when it comes to

219
00:07:13,360 --> 00:07:15,039
mellow analysis you want to avoid that

220
00:07:15,039 --> 00:07:16,800
as much as possible

221
00:07:16,800 --> 00:07:18,400
i would also say to try not to execute

222
00:07:18,400 --> 00:07:20,880
it immediately uh just take a lot of

223
00:07:20,880 --> 00:07:23,599
precautions in doing so you know do very

224
00:07:23,599 --> 00:07:25,759
thorough static analysis beforehand i'll

225
00:07:25,759 --> 00:07:28,000
explain what that is um in a bit um

226
00:07:28,000 --> 00:07:29,280
especially if it's on a system with

227
00:07:29,280 --> 00:07:31,360
external network communication likewise

228
00:07:31,360 --> 00:07:32,880
you know you're again potentially

229
00:07:32,880 --> 00:07:34,240
tipping off thread actors and you don't

230
00:07:34,240 --> 00:07:35,520
want to run it if you don't know what

231
00:07:35,520 --> 00:07:38,160
it's doing or what it will do

232
00:07:38,160 --> 00:07:39,680
and another thing to consider is that it

233
00:07:39,680 --> 00:07:40,960
could be potentially unique to your

234
00:07:40,960 --> 00:07:43,039
environment so depending on you know if

235
00:07:43,039 --> 00:07:44,160
you're doing this in an enterprise

236
00:07:44,160 --> 00:07:45,680
environment or something you get

237
00:07:45,680 --> 00:07:46,639
something that's you know completely

238
00:07:46,639 --> 00:07:48,720
you've never seen this before uh you may

239
00:07:48,720 --> 00:07:51,039
want to sync up with your cyber um

240
00:07:51,039 --> 00:07:53,680
intelligence team and try and see if

241
00:07:53,680 --> 00:07:55,120
there you can get any attribution on

242
00:07:55,120 --> 00:07:57,120
this if this is you know a result of

243
00:07:57,120 --> 00:07:59,440
someone directly targeting uh you and

244
00:07:59,440 --> 00:08:02,479
your uh company

245
00:08:02,479 --> 00:08:06,240
so going on to static analysis

246
00:08:06,240 --> 00:08:08,400
a little bit about what it is so there's

247
00:08:08,400 --> 00:08:10,160
two forms two

248
00:08:10,160 --> 00:08:12,400
general big forms of analysis

249
00:08:12,400 --> 00:08:14,080
when it comes to malware analysis

250
00:08:14,080 --> 00:08:16,400
there's static and then there's dynamic

251
00:08:16,400 --> 00:08:18,639
and so uh when i was ta i usually kind

252
00:08:18,639 --> 00:08:21,039
of use this dumb food metaphor which is

253
00:08:21,039 --> 00:08:23,919
that lower or you know a suspicious

254
00:08:23,919 --> 00:08:24,879
sample

255
00:08:24,879 --> 00:08:26,960
is a tasty dish that may or may not be

256
00:08:26,960 --> 00:08:28,800
poisoned and your job is to determine

257
00:08:28,800 --> 00:08:30,720
whether it's been poisoned or whether

258
00:08:30,720 --> 00:08:32,958
it's not poisoned and if it is poisoned

259
00:08:32,958 --> 00:08:35,279
what kind of poison is it

260
00:08:35,279 --> 00:08:36,240
so

261
00:08:36,240 --> 00:08:38,719
you have two ways to do this statically

262
00:08:38,719 --> 00:08:40,880
which is typically the safest way so

263
00:08:40,880 --> 00:08:42,559
you're just observing the dish kind of

264
00:08:42,559 --> 00:08:44,000
smelling of the dish seeing what you can

265
00:08:44,000 --> 00:08:45,760
see so you know you see like a long

266
00:08:45,760 --> 00:08:47,279
green thing that looks like a green bean

267
00:08:47,279 --> 00:08:48,800
you're like okay that looks like a green

268
00:08:48,800 --> 00:08:50,720
bean chances are that might be it this

269
00:08:50,720 --> 00:08:52,240
is what i should expect when i'm looking

270
00:08:52,240 --> 00:08:55,200
at this or eating this dish you know

271
00:08:55,200 --> 00:08:57,200
likewise dynamically you'd be doing

272
00:08:57,200 --> 00:08:58,959
things like poking the dish tasting dish

273
00:08:58,959 --> 00:09:02,320
etc but you're doing so at a slight risk

274
00:09:02,320 --> 00:09:03,920
so you know maybe if you don't take

275
00:09:03,920 --> 00:09:05,600
proper precautions by poking in the dish

276
00:09:05,600 --> 00:09:07,760
oh no you have a rash or if you just go

277
00:09:07,760 --> 00:09:09,440
ahead and start like eating the dish you

278
00:09:09,440 --> 00:09:11,040
may be going like oh god wait this is

279
00:09:11,040 --> 00:09:14,720
poison you get poisoned um so

280
00:09:14,720 --> 00:09:16,480
that's not to say though that dynamic

281
00:09:16,480 --> 00:09:18,800
runs a ton of risks with no reward but

282
00:09:18,800 --> 00:09:21,600
it's always a little bit more of a risk

283
00:09:21,600 --> 00:09:24,080
going on though through dynamic analysis

284
00:09:24,080 --> 00:09:25,760
you can learn a lot more than you can

285
00:09:25,760 --> 00:09:27,279
through static analysis so some

286
00:09:27,279 --> 00:09:29,279
assumptions you made may be incorrect or

287
00:09:29,279 --> 00:09:32,000
some assumptions that you made um

288
00:09:32,000 --> 00:09:33,440
you may not have a full picture of

289
00:09:33,440 --> 00:09:34,839
there's way to

290
00:09:34,839 --> 00:09:37,839
obfuscate information about the program

291
00:09:37,839 --> 00:09:39,920
from static analysis and so the only way

292
00:09:39,920 --> 00:09:41,360
you can really figure it out may be

293
00:09:41,360 --> 00:09:44,080
through dynamic analysis

294
00:09:44,080 --> 00:09:46,800
so back to actual programs of malware

295
00:09:46,800 --> 00:09:48,640
static analysis is usually regarded as

296
00:09:48,640 --> 00:09:50,399
regarded as the safest form so it's

297
00:09:50,399 --> 00:09:51,760
doing everything except executing the

298
00:09:51,760 --> 00:09:52,640
program

299
00:09:52,640 --> 00:09:54,399
so it can be things from like what kind

300
00:09:54,399 --> 00:09:56,560
of file is this you know is this a word

301
00:09:56,560 --> 00:09:59,519
document or excel document or is it you

302
00:09:59,519 --> 00:10:01,519
know a powershell script or is it a

303
00:10:01,519 --> 00:10:03,920
portable executable a windows executable

304
00:10:03,920 --> 00:10:05,440
um what is it doing if it's code

305
00:10:05,440 --> 00:10:06,880
readable so you know in the case of

306
00:10:06,880 --> 00:10:09,200
powershell um you know can we see what

307
00:10:09,200 --> 00:10:10,880
it's doing immediately uh do we have to

308
00:10:10,880 --> 00:10:12,320
do a little bit more definition maybe to

309
00:10:12,320 --> 00:10:14,399
see what it's doing and so on

310
00:10:14,399 --> 00:10:16,160
maybe it's calling out to something you

311
00:10:16,160 --> 00:10:19,519
know what not and then you know likewise

312
00:10:19,519 --> 00:10:21,360
for portable executables for example

313
00:10:21,360 --> 00:10:23,040
sometimes if it's unobfuscated or

314
00:10:23,040 --> 00:10:25,279
unpacked um

315
00:10:25,279 --> 00:10:26,640
we can see what kind of functions it's

316
00:10:26,640 --> 00:10:28,720
calling and kind of get an idea of what

317
00:10:28,720 --> 00:10:30,399
it may be doing so if it's calling like

318
00:10:30,399 --> 00:10:32,959
a download data function then that gives

319
00:10:32,959 --> 00:10:34,399
you the idea that okay it's making

320
00:10:34,399 --> 00:10:35,680
external communication grabbing

321
00:10:35,680 --> 00:10:37,040
something from some kind of remote

322
00:10:37,040 --> 00:10:39,760
server potentially um or if it's doing

323
00:10:39,760 --> 00:10:42,240
you know get process create process okay

324
00:10:42,240 --> 00:10:43,360
it's you know doing some process

325
00:10:43,360 --> 00:10:45,120
manipulation this is something i should

326
00:10:45,120 --> 00:10:46,959
look out for

327
00:10:46,959 --> 00:10:48,399
and then you know going on from that

328
00:10:48,399 --> 00:10:50,399
isn't making external communication um

329
00:10:50,399 --> 00:10:53,200
so sometimes if it's you know obfuscated

330
00:10:53,200 --> 00:10:55,120
you might be able to see some

331
00:10:55,120 --> 00:10:58,480
urls domains on ip addresses or even

332
00:10:58,480 --> 00:11:00,720
just a function um that's typical for

333
00:11:00,720 --> 00:11:03,760
network communications

334
00:11:04,240 --> 00:11:05,920
and so specifically into powershell

335
00:11:05,920 --> 00:11:07,279
static analysis

336
00:11:07,279 --> 00:11:08,880
um it's either office skater d

337
00:11:08,880 --> 00:11:11,440
obfuscated it's kind of not as common to

338
00:11:11,440 --> 00:11:14,160
see it's completely unobfuscated if

339
00:11:14,160 --> 00:11:15,920
that's the case i found it's usually

340
00:11:15,920 --> 00:11:18,079
something that's um

341
00:11:18,079 --> 00:11:20,480
open source publicly available

342
00:11:20,480 --> 00:11:22,320
but most of the time it's going to be

343
00:11:22,320 --> 00:11:24,880
obfuscated and in that case there's

344
00:11:24,880 --> 00:11:27,600
usually some pretty common ways to

345
00:11:27,600 --> 00:11:29,360
pretty easily de-obfuscate it but

346
00:11:29,360 --> 00:11:31,440
sometimes you know a malware author may

347
00:11:31,440 --> 00:11:33,360
have a few tricks up their sleeve maybe

348
00:11:33,360 --> 00:11:34,720
a little bit more challenging to do some

349
00:11:34,720 --> 00:11:36,880
de-obfuscation so

350
00:11:36,880 --> 00:11:38,800
it's a mixed bag as it always is with

351
00:11:38,800 --> 00:11:40,320
malware

352
00:11:40,320 --> 00:11:42,399
and so malware authors will often do you

353
00:11:42,399 --> 00:11:44,079
know fun little tricks uh to try and

354
00:11:44,079 --> 00:11:45,920
fool you or try to fool

355
00:11:45,920 --> 00:11:47,040
um

356
00:11:47,040 --> 00:11:48,560
you know whatever defender that you have

357
00:11:48,560 --> 00:11:51,200
on your system so it can try to hide

358
00:11:51,200 --> 00:11:53,760
calls to certain functions um either by

359
00:11:53,760 --> 00:11:55,600
kind of making it hard to read so when

360
00:11:55,600 --> 00:11:56,560
you're going through it you may be

361
00:11:56,560 --> 00:11:58,079
looking out for a certain function they

362
00:11:58,079 --> 00:11:59,680
may be hiding it with some shorthand

363
00:11:59,680 --> 00:12:00,639
technique

364
00:12:00,639 --> 00:12:03,120
um usually it's something involving

365
00:12:03,120 --> 00:12:04,959
base64

366
00:12:04,959 --> 00:12:07,680
encoding that's pretty common um some

367
00:12:07,680 --> 00:12:09,519
things like string concatenation where

368
00:12:09,519 --> 00:12:11,440
it shortens um

369
00:12:11,440 --> 00:12:13,839
you know if it's calling out to a url or

370
00:12:13,839 --> 00:12:15,680
domain or something it'll shorten all

371
00:12:15,680 --> 00:12:18,079
the individual components of that string

372
00:12:18,079 --> 00:12:20,320
to make it harder for

373
00:12:20,320 --> 00:12:21,839
detection and harder for you to

374
00:12:21,839 --> 00:12:24,399
potentially read or just grab easily and

375
00:12:24,399 --> 00:12:26,639
another thing to keep in mind is context

376
00:12:26,639 --> 00:12:28,639
of it so sometimes powershell scripts

377
00:12:28,639 --> 00:12:30,079
you can just run the script itself but

378
00:12:30,079 --> 00:12:32,639
sometimes it may require flags and so

379
00:12:32,639 --> 00:12:33,839
you want to make sure that you have the

380
00:12:33,839 --> 00:12:35,760
full context of the script itself

381
00:12:35,760 --> 00:12:36,800
otherwise you're going to be missing

382
00:12:36,800 --> 00:12:39,120
some vital information and this is

383
00:12:39,120 --> 00:12:40,560
definitely not going to come up in our

384
00:12:40,560 --> 00:12:43,279
next demo but it might um

385
00:12:43,279 --> 00:12:45,680
and so moving on let's move on to our

386
00:12:45,680 --> 00:12:49,120
first demo right now

387
00:12:49,360 --> 00:12:52,480
alrighty so welcome to demo one so right

388
00:12:52,480 --> 00:12:54,240
now we're in my uh cute little kill

389
00:12:54,240 --> 00:12:55,760
chain theory folder

390
00:12:55,760 --> 00:12:58,079
and all of these powershell examples are

391
00:12:58,079 --> 00:12:59,279
going to be

392
00:12:59,279 --> 00:13:02,639
in this powershell malware zipped file

393
00:13:02,639 --> 00:13:05,440
um so to unzip it for reference i'm just

394
00:13:05,440 --> 00:13:09,040
going to do 7z e and then

395
00:13:09,040 --> 00:13:10,639
the name of the file

396
00:13:10,639 --> 00:13:13,120
enter and then the password is infected

397
00:13:13,120 --> 00:13:14,480
at least it is at the time of this

398
00:13:14,480 --> 00:13:15,519
recording

399
00:13:15,519 --> 00:13:16,720
and then that will get you all of your

400
00:13:16,720 --> 00:13:18,639
samples out

401
00:13:18,639 --> 00:13:21,120
i like to keep everything clean and um

402
00:13:21,120 --> 00:13:23,760
organized so i usually keep the zipped

403
00:13:23,760 --> 00:13:25,440
malware in one folder just in case

404
00:13:25,440 --> 00:13:26,880
something happens to the samples that

405
00:13:26,880 --> 00:13:29,120
have been extracted um but for now we've

406
00:13:29,120 --> 00:13:30,560
got all of our powershell samples and

407
00:13:30,560 --> 00:13:32,079
we've got five of them

408
00:13:32,079 --> 00:13:33,279
so what we're going to want to do

409
00:13:33,279 --> 00:13:35,600
initially first is to grab the hashes of

410
00:13:35,600 --> 00:13:38,560
things and try and see if we can uh find

411
00:13:38,560 --> 00:13:40,959
any similar samples out there so just

412
00:13:40,959 --> 00:13:42,720
going by order i'm just going to grab

413
00:13:42,720 --> 00:13:44,720
invoke kerberos so

414
00:13:44,720 --> 00:13:46,959
d5 is um

415
00:13:46,959 --> 00:13:48,639
velcroist

416
00:13:48,639 --> 00:13:50,160
grab that

417
00:13:50,160 --> 00:13:51,199
and then

418
00:13:51,199 --> 00:13:53,120
let's grab that so you may also want to

419
00:13:53,120 --> 00:13:55,839
use a sha-256 i'm just using md5 because

420
00:13:55,839 --> 00:13:58,480
that's shorter um but opening up

421
00:13:58,480 --> 00:14:00,240
virustotal

422
00:14:00,240 --> 00:14:03,120
going over to search well not empty five

423
00:14:03,120 --> 00:14:05,040
sum

424
00:14:05,040 --> 00:14:06,079
let's go

425
00:14:06,079 --> 00:14:07,440
actually

426
00:14:07,440 --> 00:14:09,440
grab the right one there

427
00:14:09,440 --> 00:14:10,959
there we go

428
00:14:10,959 --> 00:14:12,720
so popping this open and this has been

429
00:14:12,720 --> 00:14:14,959
seen before so that may you know help us

430
00:14:14,959 --> 00:14:16,639
in trying to understand what this is

431
00:14:16,639 --> 00:14:18,320
so we see that there's you know pretty

432
00:14:18,320 --> 00:14:19,440
malicious

433
00:14:19,440 --> 00:14:21,519
assuming we want to make sure also

434
00:14:21,519 --> 00:14:23,279
grabbing this power split is something

435
00:14:23,279 --> 00:14:25,600
we want to look out for

436
00:14:25,600 --> 00:14:27,680
um but in virustotal we can get more

437
00:14:27,680 --> 00:14:28,800
information we can get you know the

438
00:14:28,800 --> 00:14:31,680
various uh hash sums we can grab you

439
00:14:31,680 --> 00:14:33,760
know when it was first seen uh when it

440
00:14:33,760 --> 00:14:36,399
was last seen and so on

441
00:14:36,399 --> 00:14:38,560
um and some additional powershell info

442
00:14:38,560 --> 00:14:41,199
so you know functions that are used here

443
00:14:41,199 --> 00:14:44,480
there's any calls and so on and so forth

444
00:14:44,480 --> 00:14:45,839
as well as some various names that it

445
00:14:45,839 --> 00:14:47,680
may be called in case you're looking for

446
00:14:47,680 --> 00:14:48,639
that

447
00:14:48,639 --> 00:14:50,320
under the community tab obviously take

448
00:14:50,320 --> 00:14:51,519
the information here with a grain of

449
00:14:51,519 --> 00:14:54,720
salt but um some sandboxes will kind of

450
00:14:54,720 --> 00:14:55,680
paste

451
00:14:55,680 --> 00:14:59,360
their analysis of it in here

452
00:14:59,360 --> 00:15:01,199
other times you may see other users

453
00:15:01,199 --> 00:15:03,519
paste uh what it is um

454
00:15:03,519 --> 00:15:04,880
you know sometimes

455
00:15:04,880 --> 00:15:06,959
um we'll see funny things like uh this

456
00:15:06,959 --> 00:15:08,399
isn't malicious and something that's

457
00:15:08,399 --> 00:15:10,320
pingy malicious and well yeah take that

458
00:15:10,320 --> 00:15:12,320
with a grain of salt sometimes but we're

459
00:15:12,320 --> 00:15:14,240
getting that this is you know known

460
00:15:14,240 --> 00:15:16,240
malicious and if we were to grab the

461
00:15:16,240 --> 00:15:17,920
hashes of all of these all of these

462
00:15:17,920 --> 00:15:20,880
would come back pinging as malicious

463
00:15:20,880 --> 00:15:22,480
and so let's take a look at this one

464
00:15:22,480 --> 00:15:24,720
real quick open it up

465
00:15:24,720 --> 00:15:26,880
and we can see immediately that this has

466
00:15:26,880 --> 00:15:29,519
no obfuscation on it in fact it's pretty

467
00:15:29,519 --> 00:15:32,880
well documented for what it is

468
00:15:34,160 --> 00:15:35,360
and you know we have the whole author

469
00:15:35,360 --> 00:15:36,720
and stuff like that

470
00:15:36,720 --> 00:15:38,240
um

471
00:15:38,240 --> 00:15:39,120
but

472
00:15:39,120 --> 00:15:41,040
one thing i want to point out to you and

473
00:15:41,040 --> 00:15:43,519
it's not in this simple i think it's in

474
00:15:43,519 --> 00:15:44,639
this one

475
00:15:44,639 --> 00:15:45,920
yes it is

476
00:15:45,920 --> 00:15:48,320
all right is that we see this called a

477
00:15:48,320 --> 00:15:51,279
power split function open port scan

478
00:15:51,279 --> 00:15:52,880
invoke port scan

479
00:15:52,880 --> 00:15:55,440
and so

480
00:15:55,440 --> 00:15:57,279
largely this is going to be trying to

481
00:15:57,279 --> 00:15:58,639
determine

482
00:15:58,639 --> 00:16:01,279
what these five things do here so i'm

483
00:16:01,279 --> 00:16:03,199
just going to do a deep five dive into

484
00:16:03,199 --> 00:16:05,680
port scan and maybe into vocabulary and

485
00:16:05,680 --> 00:16:07,600
try to understand what these two things

486
00:16:07,600 --> 00:16:08,560
are doing

487
00:16:08,560 --> 00:16:10,000
and then i'll cheat a little and let you

488
00:16:10,000 --> 00:16:11,759
know what the rest of them do

489
00:16:11,759 --> 00:16:13,600
and then we'll try to determine what

490
00:16:13,600 --> 00:16:15,519
happened here purely based on these

491
00:16:15,519 --> 00:16:17,040
samples

492
00:16:17,040 --> 00:16:18,800
so we have our port scanning one we'll

493
00:16:18,800 --> 00:16:20,079
start off with that since that seems

494
00:16:20,079 --> 00:16:22,320
pretty basic you know recon activity

495
00:16:22,320 --> 00:16:25,199
trying to determine you know maybe um

496
00:16:25,199 --> 00:16:28,000
the sockets are open what ports are open

497
00:16:28,000 --> 00:16:29,440
and so on

498
00:16:29,440 --> 00:16:30,399
so

499
00:16:30,399 --> 00:16:32,000
we have power supplies

500
00:16:32,000 --> 00:16:33,920
and so if i were to search powersport

501
00:16:33,920 --> 00:16:35,839
we'd probably get this uh powershell

502
00:16:35,839 --> 00:16:38,560
mafia power exploit github that comes up

503
00:16:38,560 --> 00:16:40,000
it's been archived we'll just ignore

504
00:16:40,000 --> 00:16:40,800
that

505
00:16:40,800 --> 00:16:43,519
but we can see uh from the documentation

506
00:16:43,519 --> 00:16:45,759
that it's a series of powershell modules

507
00:16:45,759 --> 00:16:48,480
uh used for penetration testing and so

508
00:16:48,480 --> 00:16:49,759
you know there's a lot of legitimate

509
00:16:49,759 --> 00:16:53,040
uses for these um sadly in our case our

510
00:16:53,040 --> 00:16:55,120
uh threat actors have used them for

511
00:16:55,120 --> 00:16:56,959
something a little bit nefarious and

512
00:16:56,959 --> 00:16:58,880
from what we can see in this virus total

513
00:16:58,880 --> 00:17:00,800
other threat actors have actually done

514
00:17:00,800 --> 00:17:03,360
that um previously

515
00:17:03,360 --> 00:17:04,720
um but going into a little bit there

516
00:17:04,720 --> 00:17:06,880
seems to be a lot of them um i think

517
00:17:06,880 --> 00:17:08,400
that poor scanning is recons we're going

518
00:17:08,400 --> 00:17:10,959
to go into recon we can see this invoke

519
00:17:10,959 --> 00:17:13,679
port scan script here

520
00:17:13,679 --> 00:17:15,199
and there we go that looks pretty

521
00:17:15,199 --> 00:17:16,640
familiar doesn't it

522
00:17:16,640 --> 00:17:18,160
and so if you want to you know double

523
00:17:18,160 --> 00:17:20,160
triple check that this is you know

524
00:17:20,160 --> 00:17:21,679
nothing has been changed from this you

525
00:17:21,679 --> 00:17:23,679
can do a side-by-side comparison

526
00:17:23,679 --> 00:17:25,359
copy this compare it to the script that

527
00:17:25,359 --> 00:17:27,520
you found um i'll say this matches one

528
00:17:27,520 --> 00:17:29,120
to one i believe

529
00:17:29,120 --> 00:17:31,679
so that's not so much of an issue here

530
00:17:31,679 --> 00:17:33,440
but what we may want to do is we may

531
00:17:33,440 --> 00:17:34,480
want to see is there any more

532
00:17:34,480 --> 00:17:36,400
information that we can glean from this

533
00:17:36,400 --> 00:17:38,799
and in fact powersport has its own uh

534
00:17:38,799 --> 00:17:42,000
talks so that makes our job pretty easy

535
00:17:42,000 --> 00:17:44,320
um i think for whatever reason let me

536
00:17:44,320 --> 00:17:47,840
try invoke port scan i know the search

537
00:17:47,840 --> 00:17:50,240
utility on this is a little funky and

538
00:17:50,240 --> 00:17:52,880
yeah it is all right that's fine uh but

539
00:17:52,880 --> 00:17:54,559
i see the invoke kerberos one so we'll

540
00:17:54,559 --> 00:17:56,160
just skip ahead to that one and try to

541
00:17:56,160 --> 00:17:58,400
understand that real quick

542
00:17:58,400 --> 00:18:00,080
but you can see a summary of it so it

543
00:18:00,080 --> 00:18:02,080
requests service tickets for kerberos

544
00:18:02,080 --> 00:18:04,640
kerberostable accounts and returns

545
00:18:04,640 --> 00:18:06,720
extracted ticket hashes um i'll explain

546
00:18:06,720 --> 00:18:08,080
what cobra roasting is in a bit if you

547
00:18:08,080 --> 00:18:10,160
don't know what that means um but we can

548
00:18:10,160 --> 00:18:11,919
see you know there's a whole description

549
00:18:11,919 --> 00:18:13,520
how it works you can see the whole

550
00:18:13,520 --> 00:18:15,679
syntax you know what um

551
00:18:15,679 --> 00:18:17,280
several examples

552
00:18:17,280 --> 00:18:19,600
each parameter does it's very like a man

553
00:18:19,600 --> 00:18:21,919
page this is pretty well documented as

554
00:18:21,919 --> 00:18:23,520
to what it'll do

555
00:18:23,520 --> 00:18:25,679
um but you may start to see a problem

556
00:18:25,679 --> 00:18:27,440
here is that while

557
00:18:27,440 --> 00:18:29,440
invokers it's well documented you see

558
00:18:29,440 --> 00:18:30,799
you know oh yeah you know we know what

559
00:18:30,799 --> 00:18:32,000
it does we know all the possible use

560
00:18:32,000 --> 00:18:34,080
cases of it we know that you know how it

561
00:18:34,080 --> 00:18:36,240
can be used we don't know how this was

562
00:18:36,240 --> 00:18:38,640
used um and that's slightly problematic

563
00:18:38,640 --> 00:18:40,720
because we were just given these scripts

564
00:18:40,720 --> 00:18:43,200
nothing else uh no vlogs no command

565
00:18:43,200 --> 00:18:46,000
lines that were seen um and so all we

566
00:18:46,000 --> 00:18:47,200
have are these scripts to kind of

567
00:18:47,200 --> 00:18:49,760
connect the dots and ideally in some

568
00:18:49,760 --> 00:18:51,440
sort of incident you would be able to

569
00:18:51,440 --> 00:18:53,280
link up with your forensics team your ir

570
00:18:53,280 --> 00:18:55,600
team be like hey you guys shot me some

571
00:18:55,600 --> 00:18:57,840
you know powershell scripts do you have

572
00:18:57,840 --> 00:19:00,000
you know the logs for them being run you

573
00:19:00,000 --> 00:19:01,919
know maybe if there was any flags added

574
00:19:01,919 --> 00:19:03,520
so we can get a better understanding as

575
00:19:03,520 --> 00:19:05,039
to what they did

576
00:19:05,039 --> 00:19:07,520
because right now we just know that they

577
00:19:07,520 --> 00:19:09,039
might have done curb arresting and

578
00:19:09,039 --> 00:19:11,600
that's about it or you know for port

579
00:19:11,600 --> 00:19:12,720
scanning we know that they might have

580
00:19:12,720 --> 00:19:14,400
done port scanning we don't know what

581
00:19:14,400 --> 00:19:17,360
ports were scanned on what you know why

582
00:19:17,360 --> 00:19:18,640
what information they might have cleaned

583
00:19:18,640 --> 00:19:19,600
from that

584
00:19:19,600 --> 00:19:22,320
and so that's it that's kind of where

585
00:19:22,320 --> 00:19:25,200
we're stuck and obviously you should be

586
00:19:25,200 --> 00:19:26,799
able to get these logs you know in real

587
00:19:26,799 --> 00:19:28,559
life but sometimes you're not able to

588
00:19:28,559 --> 00:19:29,760
and this is something that can

589
00:19:29,760 --> 00:19:31,840
occasionally happen um

590
00:19:31,840 --> 00:19:34,320
is that when i was doing my whole little

591
00:19:34,320 --> 00:19:36,720
stint in power analysis in a sock

592
00:19:36,720 --> 00:19:38,000
i would get some samples and i would

593
00:19:38,000 --> 00:19:40,080
just get the sample and that's it um or

594
00:19:40,080 --> 00:19:41,919
sometimes i would get really old sample

595
00:19:41,919 --> 00:19:43,600
you know it would have been uh submitted

596
00:19:43,600 --> 00:19:45,280
months ago and there's backlogs so when

597
00:19:45,280 --> 00:19:48,160
i finally got to it um i hit a wall you

598
00:19:48,160 --> 00:19:49,760
know there was no more logs for me to

599
00:19:49,760 --> 00:19:52,400
look at there was no more um you know

600
00:19:52,400 --> 00:19:54,720
information for me to clean uh maybe the

601
00:19:54,720 --> 00:19:56,799
domain that the

602
00:19:56,799 --> 00:19:59,520
malware was calling out to was no longer

603
00:19:59,520 --> 00:20:02,960
containing uh whatever secondary

604
00:20:02,960 --> 00:20:05,840
malware piece there was and so this can

605
00:20:05,840 --> 00:20:07,280
happen from time to time and then what

606
00:20:07,280 --> 00:20:08,400
you're left with when you're writing

607
00:20:08,400 --> 00:20:10,640
your report is kind of try and

608
00:20:10,640 --> 00:20:13,600
understand what's going on um give your

609
00:20:13,600 --> 00:20:15,679
best shot at it as to what it's doing

610
00:20:15,679 --> 00:20:17,760
but obviously list out the facts first

611
00:20:17,760 --> 00:20:20,240
before you get your opinion and so the

612
00:20:20,240 --> 00:20:22,559
facts are that these five things here uh

613
00:20:22,559 --> 00:20:23,919
do the following

614
00:20:23,919 --> 00:20:25,919
is that port scanning obviously does

615
00:20:25,919 --> 00:20:28,240
port scanning using regular sockets kind

616
00:20:28,240 --> 00:20:29,840
of like nmap does

617
00:20:29,840 --> 00:20:31,440
so we have some sort of

618
00:20:31,440 --> 00:20:32,080
an

619
00:20:32,080 --> 00:20:35,039
end map like utility here

620
00:20:35,039 --> 00:20:37,440
uh secondly we have let's go over to

621
00:20:37,440 --> 00:20:40,159
power view here which is primarily used

622
00:20:40,159 --> 00:20:42,960
for network awareness but it can also be

623
00:20:42,960 --> 00:20:45,120
used to do user hunting things like uh

624
00:20:45,120 --> 00:20:47,679
what networks users are logged into or

625
00:20:47,679 --> 00:20:49,200
whether the current user is a local

626
00:20:49,200 --> 00:20:52,480
admin on hosts in the domain and so on

627
00:20:52,480 --> 00:20:55,520
uh going over to invoke mimikatz uh this

628
00:20:55,520 --> 00:20:57,679
loads mini cats into memory so it can be

629
00:20:57,679 --> 00:20:59,280
used to dump credentials without writing

630
00:20:59,280 --> 00:21:01,440
to disk uh so this looks like there may

631
00:21:01,440 --> 00:21:03,120
be some sort of exfiltration component

632
00:21:03,120 --> 00:21:04,240
to this

633
00:21:04,240 --> 00:21:06,799
um and invoke kerberos um so a little

634
00:21:06,799 --> 00:21:08,480
bit background what kerberosing is but

635
00:21:08,480 --> 00:21:10,400
what kerberos sting does is that it

636
00:21:10,400 --> 00:21:11,919
attempts to crack the password of an

637
00:21:11,919 --> 00:21:13,840
active directory service count uh by

638
00:21:13,840 --> 00:21:15,840
requesting a ticket which contains an

639
00:21:15,840 --> 00:21:18,000
encrypted password capturing the ticket

640
00:21:18,000 --> 00:21:19,679
granting service and then attempting to

641
00:21:19,679 --> 00:21:21,760
crack the service credential hash to

642
00:21:21,760 --> 00:21:23,280
potentially gain that plaintext user

643
00:21:23,280 --> 00:21:24,799
credential

644
00:21:24,799 --> 00:21:27,120
and then sharppound acts as a data

645
00:21:27,120 --> 00:21:28,640
collector for bloodhound

646
00:21:28,640 --> 00:21:30,080
which collects data from the domain

647
00:21:30,080 --> 00:21:32,000
controllers and domain joined windows

648
00:21:32,000 --> 00:21:34,320
systems so if you're starting to sense a

649
00:21:34,320 --> 00:21:35,440
theme here

650
00:21:35,440 --> 00:21:38,960
there's appears to be some kind of

651
00:21:38,960 --> 00:21:41,360
user credential

652
00:21:41,360 --> 00:21:43,120
harvesting

653
00:21:43,120 --> 00:21:45,600
and so you know if you were to ready to

654
00:21:45,600 --> 00:21:47,760
report you know you'd obviously sum up

655
00:21:47,760 --> 00:21:49,440
what all these things do

656
00:21:49,440 --> 00:21:51,360
what they're known to do possible use

657
00:21:51,360 --> 00:21:52,400
cases

658
00:21:52,400 --> 00:21:54,400
and then say you know okay maybe you

659
00:21:54,400 --> 00:21:57,440
know based on these you know both five

660
00:21:57,440 --> 00:22:00,320
of these in context it appears that if

661
00:22:00,320 --> 00:22:02,720
ran this may you know

662
00:22:02,720 --> 00:22:05,520
potentially be uh geared toward user

663
00:22:05,520 --> 00:22:07,280
credential harvesting or at least an

664
00:22:07,280 --> 00:22:08,640
attempt to

665
00:22:08,640 --> 00:22:10,159
that being said though that's pretty

666
00:22:10,159 --> 00:22:12,080
guessy because we don't really quite

667
00:22:12,080 --> 00:22:13,760
know what's going on here

668
00:22:13,760 --> 00:22:15,679
other than the usage of these scripts or

669
00:22:15,679 --> 00:22:18,400
the probable usage of these scripts

670
00:22:18,400 --> 00:22:21,360
and so that's kind of not fun to start

671
00:22:21,360 --> 00:22:23,280
off with but it brings up an important

672
00:22:23,280 --> 00:22:24,880
skill to have

673
00:22:24,880 --> 00:22:28,000
in malware analysis which is essentially

674
00:22:28,000 --> 00:22:29,360
a lot of googling and a lot of

675
00:22:29,360 --> 00:22:30,799
researching

676
00:22:30,799 --> 00:22:32,559
and looking up you know in the case of

677
00:22:32,559 --> 00:22:34,400
these these are all open source so

678
00:22:34,400 --> 00:22:35,440
you're going to be looking at that

679
00:22:35,440 --> 00:22:36,880
you're going to be looking you know if

680
00:22:36,880 --> 00:22:38,000
you don't know what cover hosting is

681
00:22:38,000 --> 00:22:38,880
you're going to be learning what cover

682
00:22:38,880 --> 00:22:40,640
resting is or you know how it might be

683
00:22:40,640 --> 00:22:42,559
utilized

684
00:22:42,559 --> 00:22:43,760
and so on

685
00:22:43,760 --> 00:22:45,360
so

686
00:22:45,360 --> 00:22:47,360
this is i would say a pretty good

687
00:22:47,360 --> 00:22:49,039
jumping point for getting into that

688
00:22:49,039 --> 00:22:50,559
research mindset so if you're looking

689
00:22:50,559 --> 00:22:52,640
for any sort of homework i would say

690
00:22:52,640 --> 00:22:54,240
look into what are the use cases of

691
00:22:54,240 --> 00:22:56,000
invoke kerberos you know how can you use

692
00:22:56,000 --> 00:22:58,240
this you know maybe try it out yourself

693
00:22:58,240 --> 00:22:59,679
uh try you know some a little bit of

694
00:22:59,679 --> 00:23:01,679
penetration testing yourself to kind of

695
00:23:01,679 --> 00:23:03,600
understand you know how someone might be

696
00:23:03,600 --> 00:23:06,320
using this obviously do so safely and

697
00:23:06,320 --> 00:23:08,640
don't do it on you know uh hosts that

698
00:23:08,640 --> 00:23:10,720
you don't have commission or access uh

699
00:23:10,720 --> 00:23:13,280
you know initial permission or access to

700
00:23:13,280 --> 00:23:15,520
but you know definitely uh get a better

701
00:23:15,520 --> 00:23:17,679
idea of what's going on here

702
00:23:17,679 --> 00:23:19,120
and that'll you know really help you

703
00:23:19,120 --> 00:23:20,159
understand

704
00:23:20,159 --> 00:23:22,400
why uh threat actors do things a certain

705
00:23:22,400 --> 00:23:23,840
way

706
00:23:23,840 --> 00:23:25,360
um so

707
00:23:25,360 --> 00:23:27,760
we're going to move on back to the

708
00:23:27,760 --> 00:23:30,559
slides real quick and do a little uh

709
00:23:30,559 --> 00:23:33,840
summary of this demo

710
00:23:33,840 --> 00:23:35,600
all right so that may have not been like

711
00:23:35,600 --> 00:23:37,760
the sexiest example of powershell

712
00:23:37,760 --> 00:23:40,320
scripts but i wanted to at least for

713
00:23:40,320 --> 00:23:41,440
beginners

714
00:23:41,440 --> 00:23:43,279
uh give them the understanding that

715
00:23:43,279 --> 00:23:45,440
malware analysis can't really happen on

716
00:23:45,440 --> 00:23:47,440
its own without the full context of what

717
00:23:47,440 --> 00:23:49,679
is going on so sometimes you may be

718
00:23:49,679 --> 00:23:52,080
given a sample but sometimes that sample

719
00:23:52,080 --> 00:23:53,679
may be useless in trying to understand

720
00:23:53,679 --> 00:23:55,919
the full

721
00:23:55,919 --> 00:23:58,240
context of what occurred within that

722
00:23:58,240 --> 00:23:59,200
attack

723
00:23:59,200 --> 00:24:00,240
and so

724
00:24:00,240 --> 00:24:02,559
in this well we have the scripts used we

725
00:24:02,559 --> 00:24:04,240
don't have the flags or any other

726
00:24:04,240 --> 00:24:06,240
information our attackers used so all of

727
00:24:06,240 --> 00:24:07,919
those powershell scripts required

728
00:24:07,919 --> 00:24:10,320
certain parameters to be input in order

729
00:24:10,320 --> 00:24:12,799
to gain specific information and we

730
00:24:12,799 --> 00:24:14,559
don't know what parameters were used we

731
00:24:14,559 --> 00:24:16,320
don't know what specific information

732
00:24:16,320 --> 00:24:18,480
that our attackers wanted and so we

733
00:24:18,480 --> 00:24:20,159
don't have the full context as to what

734
00:24:20,159 --> 00:24:22,559
happened other than based on what each

735
00:24:22,559 --> 00:24:25,360
script does guessing that usu

736
00:24:25,360 --> 00:24:27,440
usually with all these scripts together

737
00:24:27,440 --> 00:24:29,440
this may you know

738
00:24:29,440 --> 00:24:31,440
point to some credential harvesting

739
00:24:31,440 --> 00:24:32,720
activities

740
00:24:32,720 --> 00:24:33,520
uh

741
00:24:33,520 --> 00:24:35,600
primarily using curb roasting

742
00:24:35,600 --> 00:24:37,440
so this is kind of what happens

743
00:24:37,440 --> 00:24:39,279
sometimes is that it's kind of like a

744
00:24:39,279 --> 00:24:41,520
box of chocolates as to what you get um

745
00:24:41,520 --> 00:24:43,039
sometimes you'll get some really fun

746
00:24:43,039 --> 00:24:44,799
samples where you can get you know map

747
00:24:44,799 --> 00:24:47,120
the whole thing out and be like oh yeah

748
00:24:47,120 --> 00:24:49,039
this is you know this powershell script

749
00:24:49,039 --> 00:24:51,520
spawns uh this executable which does

750
00:24:51,520 --> 00:24:54,159
this and so on and so forth you can you

751
00:24:54,159 --> 00:24:55,840
know get a really nice cool report and

752
00:24:55,840 --> 00:24:56,960
write up out

753
00:24:56,960 --> 00:24:58,720
and sometimes you kind of get like a

754
00:24:58,720 --> 00:25:00,799
well i mean this might have happened uh

755
00:25:00,799 --> 00:25:02,720
this is what i got or you know here's

756
00:25:02,720 --> 00:25:04,080
the limitations of the sample that i

757
00:25:04,080 --> 00:25:04,960
have

758
00:25:04,960 --> 00:25:06,480
and

759
00:25:06,480 --> 00:25:08,880
so in that case it's to kind of make

760
00:25:08,880 --> 00:25:10,799
sure to note that that may happen

761
00:25:10,799 --> 00:25:12,880
sometimes and doing the best you can

762
00:25:12,880 --> 00:25:15,360
with it and making sure that you know in

763
00:25:15,360 --> 00:25:16,880
a real incident keeping communication

764
00:25:16,880 --> 00:25:18,880
open so that you know if this were a

765
00:25:18,880 --> 00:25:20,080
real life thing and i was just handed

766
00:25:20,080 --> 00:25:22,080
those five samples without any context i

767
00:25:22,080 --> 00:25:24,080
would definitely be going to the ir team

768
00:25:24,080 --> 00:25:26,000
or the forensics team and being like hey

769
00:25:26,000 --> 00:25:27,600
uh logs please

770
00:25:27,600 --> 00:25:28,960
so

771
00:25:28,960 --> 00:25:31,760
going on we have another thing

772
00:25:31,760 --> 00:25:33,919
to look at that may be a little bit more

773
00:25:33,919 --> 00:25:34,960
fun

774
00:25:34,960 --> 00:25:37,279
and so this is going into kill chain one

775
00:25:37,279 --> 00:25:39,760
now and there are two samples that we're

776
00:25:39,760 --> 00:25:42,799
going to be taking a look at us a few

777
00:25:42,799 --> 00:25:44,720
ways to tackle these as well as some

778
00:25:44,720 --> 00:25:46,799
considerations when you're choosing how

779
00:25:46,799 --> 00:25:48,400
to de-obfuscate

780
00:25:48,400 --> 00:25:50,159
powershell scripts

781
00:25:50,159 --> 00:25:52,559
so on to demo too

782
00:25:52,559 --> 00:25:55,600
alrighty so welcome to demo 2. we're now

783
00:25:55,600 --> 00:25:57,039
in kill chain one and we're going to be

784
00:25:57,039 --> 00:25:58,559
looking at the two samples that we can

785
00:25:58,559 --> 00:26:00,840
immediately find uh this

786
00:26:00,840 --> 00:26:02,960
maliciouspowershell.txt and then this

787
00:26:02,960 --> 00:26:05,360
pid malware.txt

788
00:26:05,360 --> 00:26:07,440
um so this one will be

789
00:26:07,440 --> 00:26:09,120
just as is i believe you can just grab

790
00:26:09,120 --> 00:26:10,480
it as the text document no need for

791
00:26:10,480 --> 00:26:12,400
unzipping uh but this malicious

792
00:26:12,400 --> 00:26:14,880
powershell one is going to be located in

793
00:26:14,880 --> 00:26:18,080
the for malware re team accept file so

794
00:26:18,080 --> 00:26:19,919
once you've got all of those unzipped uh

795
00:26:19,919 --> 00:26:21,600
we're going to start with this malicious

796
00:26:21,600 --> 00:26:23,039
powershell one

797
00:26:23,039 --> 00:26:25,120
and so opening up with a text editor you

798
00:26:25,120 --> 00:26:28,320
can see immediately uh that this

799
00:26:28,320 --> 00:26:31,440
is not legible at least not to us and

800
00:26:31,440 --> 00:26:33,679
um you may be wondering like okay oh god

801
00:26:33,679 --> 00:26:35,120
where do we go from here

802
00:26:35,120 --> 00:26:37,440
and the clue lies in this tech e and c

803
00:26:37,440 --> 00:26:39,440
flag here which stands for encoded

804
00:26:39,440 --> 00:26:40,400
command

805
00:26:40,400 --> 00:26:42,000
now this means that powershell will

806
00:26:42,000 --> 00:26:44,960
accept base64 encoded commands and be

807
00:26:44,960 --> 00:26:46,480
able to run them

808
00:26:46,480 --> 00:26:48,240
so knowing that that's our first clue

809
00:26:48,240 --> 00:26:50,320
here we can go ahead grab this real

810
00:26:50,320 --> 00:26:51,120
quick

811
00:26:51,120 --> 00:26:53,360
and then what i'm going to do is open up

812
00:26:53,360 --> 00:26:55,279
cyber chef

813
00:26:55,279 --> 00:26:57,600
um as a note for whatever reason when

814
00:26:57,600 --> 00:26:59,039
you just download a fresh install of

815
00:26:59,039 --> 00:27:00,080
remnucks

816
00:27:00,080 --> 00:27:02,320
cyber chef comes two years out of date

817
00:27:02,320 --> 00:27:03,760
or that just might be something that

818
00:27:03,760 --> 00:27:05,919
happened to me i don't know obviously

819
00:27:05,919 --> 00:27:07,440
you should keep it up to date but for

820
00:27:07,440 --> 00:27:09,120
the purposes of this demonstration

821
00:27:09,120 --> 00:27:10,960
that's not super necessary

822
00:27:10,960 --> 00:27:12,240
but what we're going to want to do is

823
00:27:12,240 --> 00:27:14,159
first take out this powershell header

824
00:27:14,159 --> 00:27:16,559
here we just want this base64 encoding

825
00:27:16,559 --> 00:27:18,320
that's going to mess up our conversion

826
00:27:18,320 --> 00:27:20,720
when we make it if it's still in there

827
00:27:20,720 --> 00:27:22,559
and so a little bit about power cyber

828
00:27:22,559 --> 00:27:24,559
chef if you're not familiar it's a

829
00:27:24,559 --> 00:27:26,640
really useful tool for

830
00:27:26,640 --> 00:27:29,520
pretty much a lot of you know data

831
00:27:29,520 --> 00:27:31,120
formatting conversions

832
00:27:31,120 --> 00:27:33,039
as you can see from this list here i

833
00:27:33,039 --> 00:27:34,559
like to say that if there is an input

834
00:27:34,559 --> 00:27:36,559
and an output cyber chef can typically

835
00:27:36,559 --> 00:27:40,000
do it or can handle a good chunk of it

836
00:27:40,000 --> 00:27:41,600
a lot of what i use it for are data

837
00:27:41,600 --> 00:27:43,120
format conversions

838
00:27:43,120 --> 00:27:45,039
specifically in the case of if i need to

839
00:27:45,039 --> 00:27:47,279
do several conversions stacked on top of

840
00:27:47,279 --> 00:27:48,799
each other cyber chef is really useful

841
00:27:48,799 --> 00:27:50,559
for that you know so for example this

842
00:27:50,559 --> 00:27:52,320
won't work at all for what we're doing

843
00:27:52,320 --> 00:27:54,000
but i can do all this on top of each

844
00:27:54,000 --> 00:27:56,480
other and if it's for whatever reason a

845
00:27:56,480 --> 00:27:59,279
recipe that i use pretty frequently what

846
00:27:59,279 --> 00:28:01,039
i can do is save it and then load it

847
00:28:01,039 --> 00:28:03,440
later in the future if i need to use it

848
00:28:03,440 --> 00:28:04,880
again and it's something that i don't

849
00:28:04,880 --> 00:28:06,080
want to have to keep remembering how to

850
00:28:06,080 --> 00:28:07,600
do

851
00:28:07,600 --> 00:28:09,200
but all we need to do right now is grab

852
00:28:09,200 --> 00:28:11,520
this from base64 recipe

853
00:28:11,520 --> 00:28:14,000
for operation and pop it into our recipe

854
00:28:14,000 --> 00:28:14,880
here

855
00:28:14,880 --> 00:28:16,960
we can see immediately that this is

856
00:28:16,960 --> 00:28:18,480
starting to look like powershell you

857
00:28:18,480 --> 00:28:20,559
know gives you new object eye the stream

858
00:28:20,559 --> 00:28:23,200
reader weird formatting um but there's

859
00:28:23,200 --> 00:28:26,080
some weird periods pace spaces uh weird

860
00:28:26,080 --> 00:28:28,320
capitalizations going on uh so what i'm

861
00:28:28,320 --> 00:28:29,520
going to do is i'm going to grab the

862
00:28:29,520 --> 00:28:32,080
regular expression operation and pop it

863
00:28:32,080 --> 00:28:33,679
over here and without having to put any

864
00:28:33,679 --> 00:28:36,320
regex in this is already kind of fixed

865
00:28:36,320 --> 00:28:38,320
itself

866
00:28:38,320 --> 00:28:40,640
now for we can see is that you may be

867
00:28:40,640 --> 00:28:42,159
looking at this and seeing like oh god

868
00:28:42,159 --> 00:28:44,640
okay maybe it's another base64 string uh

869
00:28:44,640 --> 00:28:46,480
this is maybe you know we have to pop

870
00:28:46,480 --> 00:28:48,640
this in here and i'm going to say that

871
00:28:48,640 --> 00:28:51,440
you're kind of there halfway

872
00:28:51,440 --> 00:28:53,279
but to additionally consider this

873
00:28:53,279 --> 00:28:55,279
compression deflate stream

874
00:28:55,279 --> 00:28:57,440
you know more compression stuff this is

875
00:28:57,440 --> 00:28:59,200
obviously pointing to well this is basic

876
00:28:59,200 --> 00:29:02,399
c4 it's also compressed

877
00:29:02,399 --> 00:29:04,960
um so there's two ways to tackle this

878
00:29:04,960 --> 00:29:06,880
one we can do purely in cyber chef which

879
00:29:06,880 --> 00:29:08,640
is what i typically like to do as the

880
00:29:08,640 --> 00:29:10,000
first stage

881
00:29:10,000 --> 00:29:13,200
and two is to do in powershell uh which

882
00:29:13,200 --> 00:29:15,039
is really easy you don't have to really

883
00:29:15,039 --> 00:29:17,120
do much other than copy paste it and pop

884
00:29:17,120 --> 00:29:18,960
it into powershell but there are some

885
00:29:18,960 --> 00:29:20,559
additional considerations to be made

886
00:29:20,559 --> 00:29:22,960
when you do that technique

887
00:29:22,960 --> 00:29:25,200
first of all uh there's a function that

888
00:29:25,200 --> 00:29:27,039
you should be on the lookout for

889
00:29:27,039 --> 00:29:29,440
which is invoke expression

890
00:29:29,440 --> 00:29:32,320
that will in fact all this

891
00:29:32,320 --> 00:29:34,559
run it and you probably don't want that

892
00:29:34,559 --> 00:29:36,240
especially if you're

893
00:29:36,240 --> 00:29:38,559
doing static analysis first

894
00:29:38,559 --> 00:29:40,080
and so what you want to do is trying to

895
00:29:40,080 --> 00:29:42,320
find that invoke expression the problem

896
00:29:42,320 --> 00:29:43,840
of it is is that there's a lot of ways

897
00:29:43,840 --> 00:29:46,159
to hide this so sometimes it may just be

898
00:29:46,159 --> 00:29:48,399
in a flat out there invoke expression

899
00:29:48,399 --> 00:29:50,559
other times it may go by its shorthand

900
00:29:50,559 --> 00:29:52,000
ie x

901
00:29:52,000 --> 00:29:55,360
or in this instance it's like this and

902
00:29:55,360 --> 00:29:56,960
so you may be wondering what this uh

903
00:29:56,960 --> 00:29:59,200
shell id thingy here is

904
00:29:59,200 --> 00:30:01,679
and this is an environment variable so

905
00:30:01,679 --> 00:30:05,039
if i were to go over to say our

906
00:30:05,039 --> 00:30:07,120
cute little powershell thing over here

907
00:30:07,120 --> 00:30:09,919
and ignoring vmware real quick

908
00:30:09,919 --> 00:30:11,360
if i type in

909
00:30:11,360 --> 00:30:13,360
shell id

910
00:30:13,360 --> 00:30:14,799
and hit enter

911
00:30:14,799 --> 00:30:16,320
it's gonna you know bring us microsoft

912
00:30:16,320 --> 00:30:17,520
powershell

913
00:30:17,520 --> 00:30:19,039
and so

914
00:30:19,039 --> 00:30:22,000
going back here we can see it's grabbing

915
00:30:22,000 --> 00:30:24,000
a character from the first index and the

916
00:30:24,000 --> 00:30:25,679
13th index

917
00:30:25,679 --> 00:30:28,000
and concatenating it with the letter x

918
00:30:28,000 --> 00:30:30,159
so popping back over character the first

919
00:30:30,159 --> 00:30:31,440
index is i

920
00:30:31,440 --> 00:30:33,679
character at the i think the this is the

921
00:30:33,679 --> 00:30:37,120
13th index is e um so putting it all

922
00:30:37,120 --> 00:30:39,679
together that's ie x which shorthand

923
00:30:39,679 --> 00:30:41,600
again phonebook expression so you want

924
00:30:41,600 --> 00:30:43,200
to look out for that so if you were to

925
00:30:43,200 --> 00:30:45,039
do this whole little trick of copy

926
00:30:45,039 --> 00:30:47,200
pasting it into powershell you want to

927
00:30:47,200 --> 00:30:50,480
avoid this little fella at the end here

928
00:30:50,480 --> 00:30:51,919
so i'm going to grab that

929
00:30:51,919 --> 00:30:53,520
i'm going to go over here i'm just going

930
00:30:53,520 --> 00:30:54,720
to pop it in

931
00:30:54,720 --> 00:30:55,760
hit enter

932
00:30:55,760 --> 00:30:57,919
and there we go there's our next step of

933
00:30:57,919 --> 00:30:59,679
the translation there

934
00:30:59,679 --> 00:31:01,679
conversely if you want to do this purely

935
00:31:01,679 --> 00:31:05,360
in cyber chef what you do is

936
00:31:05,360 --> 00:31:07,840
not that

937
00:31:07,840 --> 00:31:10,640
there we go um so what you do is

938
00:31:10,640 --> 00:31:13,039
grab all of this

939
00:31:13,039 --> 00:31:14,159
and

940
00:31:14,159 --> 00:31:17,279
take out this ending piece here

941
00:31:17,279 --> 00:31:19,120
there we go

942
00:31:19,120 --> 00:31:21,039
and immediately we still have this from

943
00:31:21,039 --> 00:31:23,760
b64 recipe we can see that this isn't

944
00:31:23,760 --> 00:31:25,519
quite working but we know it's been

945
00:31:25,519 --> 00:31:27,840
compressed and so cyber chef has this

946
00:31:27,840 --> 00:31:30,399
operation called raw inflate

947
00:31:30,399 --> 00:31:32,080
which decompresses data which has been

948
00:31:32,080 --> 00:31:33,440
compressed

949
00:31:33,440 --> 00:31:34,799
and what we could do is pop it at the

950
00:31:34,799 --> 00:31:36,880
bottom here and we get the same exact

951
00:31:36,880 --> 00:31:39,120
output down below

952
00:31:39,120 --> 00:31:40,640
and so this next step i'm going to

953
00:31:40,640 --> 00:31:42,559
additionally do in cyber chef but i'd

954
00:31:42,559 --> 00:31:45,120
also like to note um another instance of

955
00:31:45,120 --> 00:31:46,720
hiding that iex

956
00:31:46,720 --> 00:31:49,679
this is in this over here and so if we

957
00:31:49,679 --> 00:31:50,559
grab

958
00:31:50,559 --> 00:31:53,840
this verbose preference here

959
00:31:53,840 --> 00:31:55,760
and once again just pop it into

960
00:31:55,760 --> 00:31:57,360
powershell just to see what that is what

961
00:31:57,360 --> 00:31:58,880
that's doing

962
00:31:58,880 --> 00:32:01,120
it comes back as silently continue

963
00:32:01,120 --> 00:32:02,640
and we know from this it's grabbing from

964
00:32:02,640 --> 00:32:04,960
the first and the third index which once

965
00:32:04,960 --> 00:32:07,679
again is i and e

966
00:32:07,679 --> 00:32:10,799
and at joining x to it so we have iex

967
00:32:10,799 --> 00:32:12,960
right there

968
00:32:12,960 --> 00:32:15,120
so being careful with that of course we

969
00:32:15,120 --> 00:32:16,960
want to avoid it take that out so if

970
00:32:16,960 --> 00:32:21,200
you're going to do another powershell uh

971
00:32:21,200 --> 00:32:22,640
pop it into powershell once again you're

972
00:32:22,640 --> 00:32:24,080
going to want to delete that and then

973
00:32:24,080 --> 00:32:25,919
put the rest of this in here

974
00:32:25,919 --> 00:32:27,840
but if we're going to just do this in

975
00:32:27,840 --> 00:32:30,159
cyber chef um just to note as to what

976
00:32:30,159 --> 00:32:32,799
the next step is in s char tells me that

977
00:32:32,799 --> 00:32:34,559
this is converting all these integers to

978
00:32:34,559 --> 00:32:36,240
characters which tells me that this is

979
00:32:36,240 --> 00:32:37,840
charcoal

980
00:32:37,840 --> 00:32:40,159
so i'm going to just grab these right

981
00:32:40,159 --> 00:32:41,200
here

982
00:32:41,200 --> 00:32:43,440
i'm going to delete the input pop in

983
00:32:43,440 --> 00:32:45,279
there obviously delete our current

984
00:32:45,279 --> 00:32:46,320
recipe

985
00:32:46,320 --> 00:32:48,399
and what i want to do first is that if

986
00:32:48,399 --> 00:32:50,159
you take a look at the

987
00:32:50,159 --> 00:32:51,840
from charcoaled

988
00:32:51,840 --> 00:32:53,120
operation you can see that there's a

989
00:32:53,120 --> 00:32:55,279
delimiter that's needed and with our

990
00:32:55,279 --> 00:32:57,279
current uh well

991
00:32:57,279 --> 00:33:00,320
uh output we'll input here really now um

992
00:33:00,320 --> 00:33:02,159
we can see that we're both using spaces

993
00:33:02,159 --> 00:33:04,559
and commas which probably isn't the best

994
00:33:04,559 --> 00:33:06,080
so what we're going to want to do is

995
00:33:06,080 --> 00:33:08,559
there's another formatting operation

996
00:33:08,559 --> 00:33:10,880
remove white space we'll just do that

997
00:33:10,880 --> 00:33:12,000
and

998
00:33:12,000 --> 00:33:13,679
taking out the from charcoal we can see

999
00:33:13,679 --> 00:33:16,720
our output has been normalized

1000
00:33:16,720 --> 00:33:18,399
so back to from charcoal we're going to

1001
00:33:18,399 --> 00:33:20,480
change our delimiter to comma you may

1002
00:33:20,480 --> 00:33:23,039
now be thinking uh oh uh that's not

1003
00:33:23,039 --> 00:33:25,360
right um but we need to remember that

1004
00:33:25,360 --> 00:33:26,880
play around with the bases a little bit

1005
00:33:26,880 --> 00:33:28,240
there's different ones

1006
00:33:28,240 --> 00:33:30,480
and in this case base 10 works for us

1007
00:33:30,480 --> 00:33:32,480
and gets us to our endpoint

1008
00:33:32,480 --> 00:33:33,840
and so here if you're just purely

1009
00:33:33,840 --> 00:33:36,000
looking for iocs uh you can see this

1010
00:33:36,000 --> 00:33:39,200
download data this malwareoflove.xyz

1011
00:33:39,200 --> 00:33:41,039
url and you may want to just quickly

1012
00:33:41,039 --> 00:33:43,200
grab that and you know

1013
00:33:43,200 --> 00:33:45,519
take it with you use it how you may um

1014
00:33:45,519 --> 00:33:47,679
in general this appears to be creating a

1015
00:33:47,679 --> 00:33:50,000
user agent downloading data from this

1016
00:33:50,000 --> 00:33:52,960
malware love domain and then loading it

1017
00:33:52,960 --> 00:33:55,679
into the system um so that's kind of

1018
00:33:55,679 --> 00:33:58,159
spooky um but for considerations then

1019
00:33:58,159 --> 00:34:00,320
you'd want to probably look at making

1020
00:34:00,320 --> 00:34:03,760
some detections for this domain or any

1021
00:34:03,760 --> 00:34:06,480
attempts to connect this domain

1022
00:34:06,480 --> 00:34:09,040
and so here we are we're at the end and

1023
00:34:09,040 --> 00:34:10,480
some other neat things to note about

1024
00:34:10,480 --> 00:34:12,639
this too is how the strings have been

1025
00:34:12,639 --> 00:34:13,520
kind of

1026
00:34:13,520 --> 00:34:16,000
i won't say manipulated but they've been

1027
00:34:16,000 --> 00:34:17,199
um

1028
00:34:17,199 --> 00:34:19,040
you know changed up in kind of a way to

1029
00:34:19,040 --> 00:34:21,359
make it harder to detect obviously these

1030
00:34:21,359 --> 00:34:24,639
have been split apart as far as possible

1031
00:34:24,639 --> 00:34:26,399
same up here with user agent and you

1032
00:34:26,399 --> 00:34:28,239
know all of this up here

1033
00:34:28,239 --> 00:34:30,159
has been sort of hard as to

1034
00:34:30,159 --> 00:34:32,320
further attempt to obfuscate what's

1035
00:34:32,320 --> 00:34:35,040
going on over here

1036
00:34:35,040 --> 00:34:37,918
and so that's it for this first one

1037
00:34:37,918 --> 00:34:39,520
so we're going to

1038
00:34:39,520 --> 00:34:40,719
let's delete this because i think we're

1039
00:34:40,719 --> 00:34:43,119
using cyber chef again

1040
00:34:43,119 --> 00:34:46,480
uh so we're gonna go back and

1041
00:34:46,480 --> 00:34:49,119
to our cute little demo space

1042
00:34:49,119 --> 00:34:50,560
we're going into the next one which is

1043
00:34:50,560 --> 00:34:52,000
this kc1

1044
00:34:52,000 --> 00:34:53,839
uh you know i'm going to rename that

1045
00:34:53,839 --> 00:34:55,199
because that's getting really difficult

1046
00:34:55,199 --> 00:34:56,320
to say out loud i'm just going to call

1047
00:34:56,320 --> 00:34:57,520
it cool

1048
00:34:57,520 --> 00:34:59,040
cat too

1049
00:34:59,040 --> 00:35:01,200
um probably keep things named the same

1050
00:35:01,200 --> 00:35:03,359
way in this case

1051
00:35:03,359 --> 00:35:04,720
i'm just getting tired of trying to

1052
00:35:04,720 --> 00:35:06,480
figure out what to call it so cool cat 2

1053
00:35:06,480 --> 00:35:07,359
works

1054
00:35:07,359 --> 00:35:09,200
we're going to open up

1055
00:35:09,200 --> 00:35:11,599
this into our editor and

1056
00:35:11,599 --> 00:35:12,960
it's a little weird so let's wrap it

1057
00:35:12,960 --> 00:35:14,400
real quick

1058
00:35:14,400 --> 00:35:16,320
and we can see that this is a little bit

1059
00:35:16,320 --> 00:35:18,400
different from our first sample um

1060
00:35:18,400 --> 00:35:19,680
popping that open real quick for a

1061
00:35:19,680 --> 00:35:22,160
comparison uh while this started with

1062
00:35:22,160 --> 00:35:24,240
that you know pure base64 encoding at

1063
00:35:24,240 --> 00:35:25,839
the beginning this has kind of skipped

1064
00:35:25,839 --> 00:35:27,839
that step we're already on to

1065
00:35:27,839 --> 00:35:31,040
that um compression base64 string type

1066
00:35:31,040 --> 00:35:32,480
business

1067
00:35:32,480 --> 00:35:35,200
so i'm just going to grab all of this

1068
00:35:35,200 --> 00:35:36,560
and

1069
00:35:36,560 --> 00:35:38,000
again like i said i prefer to do it

1070
00:35:38,000 --> 00:35:40,480
cyber chef as a first step um of course

1071
00:35:40,480 --> 00:35:41,440
you can

1072
00:35:41,440 --> 00:35:42,800
attempt to do it

1073
00:35:42,800 --> 00:35:44,240
in

1074
00:35:44,240 --> 00:35:46,240
powershell if you'd like but it'll

1075
00:35:46,240 --> 00:35:48,160
become clear why i like to do this at

1076
00:35:48,160 --> 00:35:49,599
cyber chef

1077
00:35:49,599 --> 00:35:51,920
pretty quickly so we're just going to

1078
00:35:51,920 --> 00:35:52,960
grab

1079
00:35:52,960 --> 00:35:55,119
all that first

1080
00:35:55,119 --> 00:35:56,480
and

1081
00:35:56,480 --> 00:35:58,560
what we're going to do is we're going to

1082
00:35:58,560 --> 00:36:01,119
do the typical formatting that we did

1083
00:36:01,119 --> 00:36:04,400
for that base64 compression

1084
00:36:04,400 --> 00:36:08,880
so base64 and raw in

1085
00:36:09,200 --> 00:36:12,079
spelling that correctly around plates

1086
00:36:12,079 --> 00:36:13,599
and we get you know maybe looking down

1087
00:36:13,599 --> 00:36:15,040
here and you'd be like oh god uh that

1088
00:36:15,040 --> 00:36:17,359
doesn't make any sense oh no but then

1089
00:36:17,359 --> 00:36:18,960
you'll see this little sentence up here

1090
00:36:18,960 --> 00:36:20,720
which is this program cannot be run in

1091
00:36:20,720 --> 00:36:21,760
dos mode

1092
00:36:21,760 --> 00:36:23,520
and so if you're in the know

1093
00:36:23,520 --> 00:36:25,359
uh this is an executable this is a

1094
00:36:25,359 --> 00:36:27,760
portable executable a windows executive

1095
00:36:27,760 --> 00:36:29,520
and if you're ever unsure as to what you

1096
00:36:29,520 --> 00:36:31,119
may be looking at you know maybe you'll

1097
00:36:31,119 --> 00:36:32,400
do something correctly or you think you

1098
00:36:32,400 --> 00:36:34,079
do it correctly you're like wow this

1099
00:36:34,079 --> 00:36:35,599
isn't the output i expected at all you

1100
00:36:35,599 --> 00:36:37,359
know this should be something else uh

1101
00:36:37,359 --> 00:36:40,480
what you can do is grab that detect file

1102
00:36:40,480 --> 00:36:43,200
type operation pop it at the bottom and

1103
00:36:43,200 --> 00:36:44,560
it'll tell you what it's look what

1104
00:36:44,560 --> 00:36:46,240
you're looking at right now

1105
00:36:46,240 --> 00:36:48,640
so this is a windows portable executable

1106
00:36:48,640 --> 00:36:50,800
and so we're gonna take the suit out

1107
00:36:50,800 --> 00:36:53,200
real quick and what we're looking at is

1108
00:36:53,200 --> 00:36:55,760
pretty much a semi-equivalent of if you

1109
00:36:55,760 --> 00:36:59,200
were to run um strings strings is a

1110
00:36:59,200 --> 00:37:00,560
useful tool to look at all the strings

1111
00:37:00,560 --> 00:37:03,119
within executable

1112
00:37:03,119 --> 00:37:04,640
but if you were to run it

1113
00:37:04,640 --> 00:37:07,040
in the terminal here you'd get

1114
00:37:07,040 --> 00:37:09,119
approximately a similar output here

1115
00:37:09,119 --> 00:37:12,000
obviously a little bit different

1116
00:37:12,000 --> 00:37:13,920
maybe a little bit more formatted better

1117
00:37:13,920 --> 00:37:16,480
but we can see all of the function calls

1118
00:37:16,480 --> 00:37:17,760
here

1119
00:37:17,760 --> 00:37:20,320
in this kind of text block that the

1120
00:37:20,320 --> 00:37:22,640
program is making uh you know rsa crypto

1121
00:37:22,640 --> 00:37:24,720
server service provider um you know

1122
00:37:24,720 --> 00:37:27,599
validate search decrypt things like that

1123
00:37:27,599 --> 00:37:30,000
as well as uh this is really badly

1124
00:37:30,000 --> 00:37:32,480
formatted but this uh again

1125
00:37:32,480 --> 00:37:34,480
malwarelove.xyz

1126
00:37:34,480 --> 00:37:39,119
uh at port 443 url here

1127
00:37:39,119 --> 00:37:41,040
and what appears to be a little bit of

1128
00:37:41,040 --> 00:37:43,200
html that's kind of neat

1129
00:37:43,200 --> 00:37:44,800
um so things like that you can see right

1130
00:37:44,800 --> 00:37:45,599
there

1131
00:37:45,599 --> 00:37:47,599
and if you want it um

1132
00:37:47,599 --> 00:37:50,079
probably should um download this for

1133
00:37:50,079 --> 00:37:52,240
further analysis so what you're able to

1134
00:37:52,240 --> 00:37:54,240
do is you can save this output file and

1135
00:37:54,240 --> 00:37:55,440
what you are doing is that you're

1136
00:37:55,440 --> 00:37:57,520
downloading the binary itself um so i'm

1137
00:37:57,520 --> 00:37:58,880
just going to call this

1138
00:37:58,880 --> 00:38:01,680
qat2.exe

1139
00:38:01,680 --> 00:38:02,800
save it

1140
00:38:02,800 --> 00:38:05,040
do not run it and

1141
00:38:05,040 --> 00:38:06,640
now we have the executable that was

1142
00:38:06,640 --> 00:38:08,800
hiding in this powershell

1143
00:38:08,800 --> 00:38:10,880
and um if we want to take the next steps

1144
00:38:10,880 --> 00:38:13,440
and looking at um understanding what

1145
00:38:13,440 --> 00:38:16,240
it's doing then we can do so here

1146
00:38:16,240 --> 00:38:17,520
safely

1147
00:38:17,520 --> 00:38:19,760
all right we're gonna cut it right there

1148
00:38:19,760 --> 00:38:21,119
just because this is purely for

1149
00:38:21,119 --> 00:38:23,200
powershell analysis but i'll be taking a

1150
00:38:23,200 --> 00:38:24,960
look at this executable in my other

1151
00:38:24,960 --> 00:38:27,440
workshop so definitely look out for that

1152
00:38:27,440 --> 00:38:29,280
but in the meantime that pretty much

1153
00:38:29,280 --> 00:38:33,520
summarizes demo two

1154
00:38:33,520 --> 00:38:35,040
all right so to finish this off that

1155
00:38:35,040 --> 00:38:37,520
wasn't too bad actually um and it may

1156
00:38:37,520 --> 00:38:38,720
have seen that like i was going through

1157
00:38:38,720 --> 00:38:39,839
and i'm like some kind of wizard that

1158
00:38:39,839 --> 00:38:41,920
knows what i'm doing but in truth a lot

1159
00:38:41,920 --> 00:38:43,760
of it is googling and understanding

1160
00:38:43,760 --> 00:38:45,520
what's uh trying to understand what's

1161
00:38:45,520 --> 00:38:46,960
going on

1162
00:38:46,960 --> 00:38:48,880
and so a lot of that information you can

1163
00:38:48,880 --> 00:38:51,680
learn simply by just copy pasting uh

1164
00:38:51,680 --> 00:38:53,920
into google something that looks weird

1165
00:38:53,920 --> 00:38:56,079
and most of the time you'll be able to

1166
00:38:56,079 --> 00:38:58,000
find out you know an explanation as to

1167
00:38:58,000 --> 00:39:00,480
why that is so if you recall

1168
00:39:00,480 --> 00:39:02,480
that you know shell id thing or that

1169
00:39:02,480 --> 00:39:04,560
verbose preference thing where there

1170
00:39:04,560 --> 00:39:06,560
were two techniques to try and get iex

1171
00:39:06,560 --> 00:39:08,240
into the script without you know

1172
00:39:08,240 --> 00:39:10,400
explicitly saying this is iex there's

1173
00:39:10,400 --> 00:39:11,920
some things i found out from google as

1174
00:39:11,920 --> 00:39:13,680
to why that did that and why people

1175
00:39:13,680 --> 00:39:15,280
would use that um

1176
00:39:15,280 --> 00:39:17,520
those little hidden ways and techniques

1177
00:39:17,520 --> 00:39:18,320
that

1178
00:39:18,320 --> 00:39:19,760
malware authors

1179
00:39:19,760 --> 00:39:20,720
will do

1180
00:39:20,720 --> 00:39:24,160
and so trying to find those weird things

1181
00:39:24,160 --> 00:39:25,119
and trying to find you know what the

1182
00:39:25,119 --> 00:39:27,680
next step is if you're stuck really

1183
00:39:27,680 --> 00:39:30,720
really helps um in your you know overall

1184
00:39:30,720 --> 00:39:32,560
understanding of it because in our

1185
00:39:32,560 --> 00:39:34,560
analysis

1186
00:39:34,560 --> 00:39:36,160
you're kind of in the state of always

1187
00:39:36,160 --> 00:39:37,839
learning you know you're learning new

1188
00:39:37,839 --> 00:39:40,720
techniques may not have um

1189
00:39:40,720 --> 00:39:43,280
experience this uh specific method of

1190
00:39:43,280 --> 00:39:46,240
utilizing you know xyz thing and that'll

1191
00:39:46,240 --> 00:39:48,000
come across every single form malware

1192
00:39:48,000 --> 00:39:49,440
can come in and malware can come in a

1193
00:39:49,440 --> 00:39:51,920
lot of diverse forms and so pretty much

1194
00:39:51,920 --> 00:39:54,320
staying on your toes um recognizing

1195
00:39:54,320 --> 00:39:56,960
patterns and not being afraid to ask for

1196
00:39:56,960 --> 00:39:59,839
help is a really good skill set to have

1197
00:39:59,839 --> 00:40:00,960
uh when you're starting to breach

1198
00:40:00,960 --> 00:40:02,880
malware analysis

1199
00:40:02,880 --> 00:40:05,839
and so some big takeaways is that i want

1200
00:40:05,839 --> 00:40:07,680
uh you to have that sort of analysis

1201
00:40:07,680 --> 00:40:09,839
mindset of understanding that being good

1202
00:40:09,839 --> 00:40:11,440
at reversing is being good i'm always

1203
00:40:11,440 --> 00:40:13,920
learning um there's always new malware

1204
00:40:13,920 --> 00:40:15,839
out there it's always evolving and so

1205
00:40:15,839 --> 00:40:17,520
you're constantly having to learn what

1206
00:40:17,520 --> 00:40:19,920
the newest techniques are um

1207
00:40:19,920 --> 00:40:21,839
what might be used what's you know kind

1208
00:40:21,839 --> 00:40:23,839
of in the past maybe coming back again

1209
00:40:23,839 --> 00:40:25,920
things like that and of course staying

1210
00:40:25,920 --> 00:40:28,160
safe keeping yourself safe trying not to

1211
00:40:28,160 --> 00:40:30,240
tip off threat actors and of course

1212
00:40:30,240 --> 00:40:32,480
keeping everyone else um

1213
00:40:32,480 --> 00:40:34,319
safe by not accidentally you know

1214
00:40:34,319 --> 00:40:36,160
releasing malware into

1215
00:40:36,160 --> 00:40:38,400
the world unintentionally

1216
00:40:38,400 --> 00:40:39,920
and of course information sharing is

1217
00:40:39,920 --> 00:40:41,839
vital so you know things like in our

1218
00:40:41,839 --> 00:40:44,000
first demo when we're looking at okay we

1219
00:40:44,000 --> 00:40:46,079
didn't have the full context being able

1220
00:40:46,079 --> 00:40:47,839
to talk to the people who may have that

1221
00:40:47,839 --> 00:40:50,480
information for you or may have it may

1222
00:40:50,480 --> 00:40:52,240
be able to find it for you is really

1223
00:40:52,240 --> 00:40:54,640
vital in addressing an incident

1224
00:40:54,640 --> 00:40:56,480
likewise with malware analysis in

1225
00:40:56,480 --> 00:40:58,560
general it's a really steep step up to

1226
00:40:58,560 --> 00:41:00,720
start becoming proficient and a lot of

1227
00:41:00,720 --> 00:41:02,800
the information that helped me uh become

1228
00:41:02,800 --> 00:41:04,560
more proficient or more knowledgeable in

1229
00:41:04,560 --> 00:41:07,680
a certain type of you know analysis or

1230
00:41:07,680 --> 00:41:09,680
you know tackling a certain problem was

1231
00:41:09,680 --> 00:41:11,760
people who wrote up what they did for

1232
00:41:11,760 --> 00:41:13,760
each thing and so those little like

1233
00:41:13,760 --> 00:41:15,680
tricks and tips you might find within

1234
00:41:15,680 --> 00:41:18,000
these write-ups and so as you become

1235
00:41:18,000 --> 00:41:19,200
more proficient i would totally

1236
00:41:19,200 --> 00:41:20,800
recommend giving back to the community

1237
00:41:20,800 --> 00:41:22,800
when you're able to and showing you know

1238
00:41:22,800 --> 00:41:24,240
how you analyze it you know the tricks

1239
00:41:24,240 --> 00:41:26,240
that you use to tackle you know certain

1240
00:41:26,240 --> 00:41:28,720
problems or certain steps within a

1241
00:41:28,720 --> 00:41:30,800
analysis um

1242
00:41:30,800 --> 00:41:32,240
that you're facing

1243
00:41:32,240 --> 00:41:33,760
and additionally google is your best

1244
00:41:33,760 --> 00:41:35,440
friend uh it's not cheating google

1245
00:41:35,440 --> 00:41:37,359
everything uh you know powershell google

1246
00:41:37,359 --> 00:41:39,520
each function google what's going on

1247
00:41:39,520 --> 00:41:41,200
here you know again if you see something

1248
00:41:41,200 --> 00:41:43,599
weird google that um find out everything

1249
00:41:43,599 --> 00:41:45,119
you can about it because that

1250
00:41:45,119 --> 00:41:47,280
information is all free it's open to you

1251
00:41:47,280 --> 00:41:48,560
and it's kind of a waste if you're not

1252
00:41:48,560 --> 00:41:51,119
utilizing it so of course take advantage

1253
00:41:51,119 --> 00:41:52,319
of all the information that you have

1254
00:41:52,319 --> 00:41:54,400
available to you it's only served to

1255
00:41:54,400 --> 00:41:56,800
help you

1256
00:41:56,960 --> 00:41:59,280
and lastly i'd love to give thanks to

1257
00:41:59,280 --> 00:42:01,119
our red team and our forensics team over

1258
00:42:01,119 --> 00:42:02,880
at blue team village the red team was

1259
00:42:02,880 --> 00:42:04,240
responsible for creating these kill

1260
00:42:04,240 --> 00:42:06,400
chains and the forensics team uh were

1261
00:42:06,400 --> 00:42:08,560
the folks who gave us these samples that

1262
00:42:08,560 --> 00:42:10,640
we are using for these workshops so

1263
00:42:10,640 --> 00:42:12,079
definitely check out their talks they're

1264
00:42:12,079 --> 00:42:14,720
all really amazing um i'd like to also

1265
00:42:14,720 --> 00:42:16,000
thank lask

1266
00:42:16,000 --> 00:42:18,400
they brought up a emote powershell

1267
00:42:18,400 --> 00:42:20,319
payload um

1268
00:42:20,319 --> 00:42:22,319
some skills and tactics that they use

1269
00:42:22,319 --> 00:42:24,480
that i used for this presentation as

1270
00:42:24,480 --> 00:42:25,920
well as some of their explanations that

1271
00:42:25,920 --> 00:42:28,079
i also use because that was a little bit

1272
00:42:28,079 --> 00:42:30,560
more clearer than what i had initially

1273
00:42:30,560 --> 00:42:33,119
and also thanks to um harmjoy joseon

1274
00:42:33,119 --> 00:42:35,119
bialek and rich lundin for their power

1275
00:42:35,119 --> 00:42:37,119
support scripts that were used in uh

1276
00:42:37,119 --> 00:42:38,480
kill chain three

1277
00:42:38,480 --> 00:42:40,920
and then special thanks to the vioxx and

1278
00:42:40,920 --> 00:42:43,119
paladin316 uh these were the guys that

1279
00:42:43,119 --> 00:42:46,319
were with me last year on def on 29 for

1280
00:42:46,319 --> 00:42:48,400
our excellent uh

1281
00:42:48,400 --> 00:42:51,520
macros and excel um workshop and so

1282
00:42:51,520 --> 00:42:53,520
these guys really helped me in you know

1283
00:42:53,520 --> 00:42:55,280
getting my step up and generating

1284
00:42:55,280 --> 00:42:57,359
community content like this and you know

1285
00:42:57,359 --> 00:42:59,359
now here i am one year later creating my

1286
00:42:59,359 --> 00:43:01,119
own workshops so i'd really like to

1287
00:43:01,119 --> 00:43:03,599
thank those two they are amazing um

1288
00:43:03,599 --> 00:43:05,040
they're really knowledgeable in the area

1289
00:43:05,040 --> 00:43:07,200
of our analysis so definitely check them

1290
00:43:07,200 --> 00:43:09,680
out they're fantastic people

1291
00:43:09,680 --> 00:43:12,160
and lastly thank you all for watching uh

1292
00:43:12,160 --> 00:43:13,520
if you want to reach out to me i'm on

1293
00:43:13,520 --> 00:43:15,359
twitter as rescrabble i'm not super

1294
00:43:15,359 --> 00:43:16,560
active on twitter but you're more than

1295
00:43:16,560 --> 00:43:18,880
welcome to dm me and i'm also on discord

1296
00:43:18,880 --> 00:43:21,200
um as scrabble9731

1297
00:43:21,200 --> 00:43:23,359
so definitely uh reach out if you have

1298
00:43:23,359 --> 00:43:27,839
any questions and have a lovely day