Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 24th 2020 https://isc.sans.edu/podcastdetail.html?id=6968, (Fri, Apr 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 23rd 2020 https://isc.sans.edu/podcastdetail.html?id=6966, (Thu, Apr 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 22nd 2020 https://isc.sans.edu/podcastdetail.html?id=6964, (Wed, Apr 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 21st 2020 https://isc.sans.edu/podcastdetail.html?id=6962, (Tue, Apr 21st)
I hope this finds you all safe, healthy, and sheltered to the best of your ability.
In February I received a DM via Twitter from Liisa at SpectX regarding my interest in checking out SpectX. Never one to shy away from a tool review offer, I accepted. SpectX, available in a free, community desktop version, is a log parser and query engine that enables you to investigate incidents via log files from multiple sources such as log servers, AWS, Azure, Google Storage, Hadoop, ELK and SQL-databases. Actions include:
Continue reading SpectX: Log Parser for DFIR, (Tue, Apr 21st)
In diary entry “KPOT Deployed via AutoIt Script” I obtained 3 files:
Continue reading KPOT AutoIt Script: Analysis, (Mon, Apr 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 20th 2020 https://isc.sans.edu/podcastdetail.html?id=6960, (Mon, Apr 20th)
In diary entry “KPOT Deployed via AutoIt Script” I obtained 3 files:
Continue reading KPOT Analysis: Obtaining the Decrypted KPOT EXE, (Sun, Apr 19th)
This is a phishing document received today pretending to be an invoice (Word Document) from Apple Support but initial analysis shows it is a PDF document.
; 
Another piece of malicious PowerShell script that I found while hunting. Like many malicious activities that occur in those days, it is related to the COVID19 pandemic.&#;x26;#;xc2;&#;x26;#;xa0;Its purpose of simple: It checks if Outlook is used by the victim and, if it&#;x26;#;39;s the case, it generates a malicious RTF document that is spread to all contacts extracted from Outlook. Let&#;x26;#;39;s have a look at it. The script is available on VT (SHA256: 1f7f0d75fe5dace66ec9b5935d28ba02765527f09f58345c2e33e17ab4c91bd7) and has a low score of 8/60[1].
Continue reading Weaponized RTF Document Generator & Mailer in PowerShell, (Fri, Apr 17th)