Recent Notes

See 130 more →

Analyze artifacts to extract IOCs

Created: Updated: 18 min read

Having a brief overview of the sample artifact first:

$ file sample.bin
 
sample.bin: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Jul 23 00:12:00 2020, Last Saved Time/Date: Thu Jul 23 00:12:00 2020, Number of Pages: 1, Number of Words: 3, Number of Characters: 21, Security: 0

The file provided is a Microsoft Office document stored in the Compound File Binary (CFB) format, a widely used structure for Office files.

The Compound File Binary (CFB) file format is used for storing storage objects and stream objects in a hierarchical structure within a single file.

Extracting Macro

This part involves using oletools to analyze the streams within the CFB format.

oleid: to analyze OLE files to detect specific characteristics usually found in malicious files.

$ oleid sample.bin
 
Filename: sample.bin
 
--------------------+--------------------+----------+--------------------------
Indicator           |Value               |Risk      |Description
--------------------+--------------------+----------+--------------------------
File format         |MS Word 97-2003     |info      |
                    |Document or Template|          |
--------------------+--------------------+----------+--------------------------
Container format    |OLE                 |info      |Container type
--------------------+--------------------+----------+--------------------------
Application name    |Microsoft Office    |info      |Application name declared
                    |Word                |          |in properties
--------------------+--------------------+----------+--------------------------
Properties code page|1252: ANSI Latin 1; |info      |Code page used for
                    |Western European    |          |properties
                    |(Windows)           |          |
--------------------+--------------------+----------+--------------------------
Encrypted           |False               |none      |The file is not encrypted
--------------------+--------------------+----------+--------------------------
VBA Macros          |Yes, suspicious     |HIGH      |This file contains VBA
                    |                    |          |macros. Suspicious
                    |                    |          |keywords were found. Use
                    |                    |          |olevba and mraptor for
                    |                    |          |more info.
--------------------+--------------------+----------+--------------------------
XLM Macros          |No                  |none      |This file does not contain
                    |                    |          |Excel 4/XLM macros.
--------------------+--------------------+----------+--------------------------
External            |0                   |none      |External relationships
Relationships       |                    |          |such as remote templates,
                    |                    |          |remote OLE objects, etc
--------------------+--------------------+----------+--------------------------

Found suspicious behavior in VBA Macros, using olevba to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML). However, due to the amount of output information, I will put it in an expandable callout:

...
|AutoExec  |Document_open       |Runs when the Word or Publisher document is  |
...

The Document_open event is a VBA trigger that automatically executes when a document is opened. This functionality is commonly exploited by attackers to initiate malicious code as soon as the victim opens the document. By leveraging this event, the malicious macro doesn’t require any manual action from the user, such as clicking a button, making it an effective initial attack vector.

Additionally, the analysis output highlights other suspicious activities, such as the use of commands to create objects, manipulate strings, or decode Base64-encoded data. These are red flags often associated with malicious behavior in VBA macros.

Analyzing stream

The stream Macros/roubhaol/i09/o is storing a base64-encoded string with obfuscated, and it stands out due to the amount of content it has.

Obfuscation: Binary Padding

The adversaries use this technique to add junk data and adjust the on-disk representation of malware. Read more

The obfuscation in this artifact is a repetition string that create space between each character, removing them reveal the full malicious script that it ran. In such case, CyberChef with Find / Replace and From base64 operations would be useful. The repetition is `2342772g3&*gs7712ffvs626fq:

Remove null bytes and add line break, I ended up with this:

Flowchart

graph TD
    A[Word Document Opened] --> B[Triggers Document_open]
    B --> C[Calls boaxvoebxiotqueb]
    C --> D[Builds WMI String]
    D -->|Deobfuscates| E(“winmgmts:win32_Process”)
    C --> F[Extracts Payload from ControlTipText]
    F -->|Deobfuscates| G[Base64 PowerShell Script]
    C --> H[Creates WMI Object]
    H --> I[Executes PowerShell]

    I --> J[Set TLS Protocols]
    J --> K[Define Payload Path]
    K -->|%USERPROFILE%| L[337.exe]
    I --> M[Define URLs]
    M --> N[“haoqunkong.com<br/>techtravel.events<br/>digiwebmarketing.com<br/>holfve.se<br/>cfm.nl”]
    
    I --> O[Loop Through URLs]
    O --> P{Download Successful?}
    P -->|Yes| Q[Check File Size ≥ 24751 bytes]
    P -->|No| O[Try Next URL]
    Q -->|Valid| R[Execute via WMI]
    Q -->|Invalid| O[Try Next URL]
    R --> S[Run Malware Payload]

Graph View

Recent Notes

See 133 more →