Introduction​

During the development of the ATLAS, even though I believed it would be something, I didn't have any clue that proves this statement. I started to write as much as possible ATLAS rules afterward, and the experience has convinced me that ATLAS helps us to store and share malware analysis details in an actionable way.

Introduction​

For so long, Microsoft Office's macro capability has been to go option for initial access by threat actors. The community has seen a great variety of samples of this technology. But things are changing by Microsoft's decisions from last year. VBA macros are blocked if the origin of the document is the internet. Although in the middle, they retrieved but then by overwhelming responses, they returned to their initial decision. On the other hand, EXCEL 4.0 macros are restricted by default.

After these game-changing decisions, threat actors started to adopt new techniques for initial access, and the community responded to this movement with an appropriate answer. The trends show us that ISO and LNK file formats are at their peak. LNK files are Windows shortcuts, and recently SentinelOne shared excellent research around them. The post inspired me to do similar research on ISO files.

ISO Format​

ISO file is a disk image, a sector-by-sector copy of the optical disc data stored inside a binary file. It contains everything an optical disk does, including a file system. There are various file systems for optical disks, but for this research, I am referring to ISO 9660.

After Windows 8, ISO is natively supported, and OS can directly mount it. Another option is to use an archive tool like 7-zip to inspect its content.

Research​

The main goal of this research is to understand ISO trends among malware after those two significant decisions.

Initially, I filtered ISO files with 5+ positives for the past 90 days on VirusTotal. Through this search, I got more than 3k samples. Because the total amount of disk space was enormous even before the extraction, I decided to use an EC2 on AWS to take advantage of the cloud. But then the cost increased remarkably, although the machine's CPU and RAM config were very low. So I finally got back to the local. This decision forced me to filter out more aggressively.

Thus, in addition to the query above, I've picked samples with those sizes lower than 10MB. So, in the end, 304 are the total samples subject to this research.

Without any doubt, I took advantage of ATLAS to easily process this dataset. At the end of the post, I shared the ATLAS rule and script for anyone who would like to continue this or do similar research.

Next Stage​

The analysis shows that the next stage payload in the attack vector is likely PEEXE with %74.

Masquerading File Type​

I identified that plenty of samples try to lure people into believing that their contents are documents. According to the statistics, PDF is far more popular than any other format.

By the way, I intentionally tried to avoid naming this part as Double File Extension as Mitre ATT&CK names. Because I count the below samples as masquerading. But they don't follow precisely Double File Extension patterns like .pdf.exe or .xls.exe:

• RFQ_AP65425652_032421 urgente,pdf.exe
• NDJ Heysen Shipping 18.08.2022_PDF.exe
• TENDER BOQ-LH22000309AA2022_Pdf__.exe

The actual file type is mostly PEEXE, although different types like LNK and VBS samples also exist.

LNK​

I've found that 46 samples out of 304 continue with the LNK file. Even though the LNK files' target is diverse, most run a batch file.

And for the samples that continue with LNK, the majority of them belong to the IcedID family. Additionally, I detected a Bumblebee sample as well.

Language Distribution​

I tried to analyze the distribution by language usage of the files extracted from ISO. There are 27 languages in total, and English is the winner with %67.6:

Conclusion​

According to the research, I identified that much ISO-originated malware tries to deceive its target by mimicking a document. Especially PDF is far more prevalent in this respect. So I kindly advise taking the utmost care when dealing with files look like PDF.

Also I can confirm that ISO then LNK execution is a thing. Among those samples, IcedID is very dominant.

Another observation is that the samples I examined use urgent, financial, or procurement themes to convince them to open. They are business related. So ISO file in the corporate network should be observed closely. All the files in this research are under 10MB. So, size is not a criterion. If ISO file type is not a part of the business, it might be wise to block it completely, or to deploy detection rules.

ATLAS​

Here is the ATLAS rule that I used for this research:

meta:
  name: "iso_research"
  description: "A rule for ISO research project."
  author: "r00tten"
  version: "1.0"

scripts:
    create_dir: "aW1wb3J0IG9zCmltcG9ydCB0aW1lCgpkZWYgY3JlYXRlX2RpcihwYXRoOiBzdHIpIC0+IHN0cjoKICAgIHRpbWVzdGFtcCA9IHRpbWUudGltZSgpCiAgICBiYXNlbmFtZSA9IG9zLnBhdGguYmFzZW5hbWUocGF0aCkKCiAgICBkaXJfbmFtZSA9ICJ7fV97fSIuZm9ybWF0KGJhc2VuYW1lLCBpbnQodGltZXN0YW1wKSkKICAgIG9zLm1rZGlyKGRpcl9uYW1lKQoKICAgIHJldHVybiBkaXJfbmFtZQ=="
    iso_extract: "aW1wb3J0IGlvCmltcG9ydCBvcwppbXBvcnQgc3lzCmltcG9ydCBweWNkbGliCmltcG9ydCBjb2xsZWN0aW9ucwoKZGVmIGlzb19leHRyYWN0KGRhdGE6IGJ5dGVzLCB0YXJnZXRfcGF0aDogc3RyPSIuIikgLT4gbGlzdDoKICAgIHJlc3VsdCA9IFtdCiAgICBmaWxlX2xpa2UgPSBpby5CeXRlc0lPKGRhdGEpCgogICAgaXNvID0gcHljZGxpYi5QeUNkbGliKCkKICAgIGlzby5vcGVuX2ZwKGZpbGVfbGlrZSkKCiAgICBpZiBpc28uaGFzX3VkZigpOgogICAgICAgIHBhdGhuYW1lID0gJ3VkZl9wYXRoJwogICAgZWxpZiBpc28uaGFzX3JvY2tfcmlkZ2UoKToKICAgICAgICBwYXRobmFtZSA9ICdycl9wYXRoJwogICAgZWxpZiBpc28uaGFzX2pvbGlldCgpOgogICAgICAgIHBhdGhuYW1lID0gJ2pvbGlldF9wYXRoJwogICAgZWxzZToKICAgICAgICBwYXRobmFtZSA9ICdpc29fcGF0aCcKCiAgICByb290X2VudHJ5ID0gaXNvLmdldF9yZWNvcmQoKip7cGF0aG5hbWU6ICIvIn0pCgogICAgZGlycyA9IGNvbGxlY3Rpb25zLmRlcXVlKFtyb290X2VudHJ5XSkKICAgIHdoaWxlIGRpcnM6CiAgICAgICAgZGlyX3JlY29yZCA9IGRpcnMucG9wbGVmdCgpCiAgICAgICAgaWRlbnRfdG9faGVyZSA9IGlzby5mdWxsX3BhdGhfZnJvbV9kaXJyZWNvcmQoZGlyX3JlY29yZCwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByb2NrcmlkZ2U9cGF0aG5hbWUgPT0gJ3JyX3BhdGgnKQogICAgICAgIHJlbG5hbWUgPSBpZGVudF90b19oZXJlW2xlbigiLyIpOl0KICAgICAgICBpZiByZWxuYW1lIGFuZCByZWxuYW1lWzBdID09ICIvIjoKICAgICAgICAgICAgcmVsbmFtZSA9IHJlbG5hbWVbMTpdCiAgICAgICAgaWYgZGlyX3JlY29yZC5pc19kaXIoKToKICAgICAgICAgICAgaWYgcmVsbmFtZSAhPSAnJzoKICAgICAgICAgICAgICAgIG9zLm1ha2VkaXJzKG9zLnBhdGguam9pbih0YXJnZXRfcGF0aCwgcmVsbmFtZSkpCiAgICAgICAgICAgIGNoaWxkX2xpc3RlciA9IGlzby5saXN0X2NoaWxkcmVuKCoqe3BhdGhuYW1lOiBpZGVudF90b19oZXJlfSkKCiAgICAgICAgICAgIGZvciBjaGlsZCBpbiBjaGlsZF9saXN0ZXI6CiAgICAgICAgICAgICAgICBpZiBjaGlsZCBpcyBOb25lIG9yIGNoaWxkLmlzX2RvdCgpIG9yIGNoaWxkLmlzX2RvdGRvdCgpOgogICAgICAgICAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgICAgICAgICBkaXJzLmFwcGVuZChjaGlsZCkKICAgICAgICBlbHNlOgogICAgICAgICAgICBpZiBkaXJfcmVjb3JkLmlzX3N5bWxpbmsoKToKICAgICAgICAgICAgICAgIGZ1bGxwYXRoID0gb3MucGF0aC5qb2luKHRhcmdldF9wYXRoLCByZWxuYW1lKQogICAgICAgICAgICAgICAgbG9jYWxfZGlyID0gb3MucGF0aC5kaXJuYW1lKGZ1bGxwYXRoKQogICAgICAgICAgICAgICAgbG9jYWxfbGlua19uYW1lID0gb3MucGF0aC5iYXNlbmFtZShmdWxscGF0aCkKICAgICAgICAgICAgICAgIG9sZF9kaXIgPSBvcy5nZXRjd2QoKQogICAgICAgICAgICAgICAgb3MuY2hkaXIobG9jYWxfZGlyKQogICAgICAgICAgICAgICAgb3Muc3ltbGluayhkaXJfcmVjb3JkLnJvY2tfcmlkZ2Uuc3ltbGlua19wYXRoKCksIGxvY2FsX2xpbmtfbmFtZSkKICAgICAgICAgICAgICAgIG9zLmNoZGlyKG9sZF9kaXIpCiAgICAgICAgICAgIGVsc2U6CiAgICAgICAgICAgICAgICBpc28uZ2V0X2ZpbGVfZnJvbV9pc28ob3MucGF0aC5qb2luKHRhcmdldF9wYXRoLCByZWxuYW1lKSwgKip7cGF0aG5hbWU6IGlkZW50X3RvX2hlcmV9KQogICAgICAgICAgICAgICAgcmVzdWx0LmFwcGVuZChvcy5wYXRoLmpvaW4ob3MuZ2V0Y3dkKCksICh0YXJnZXRfcGF0aCArIGlkZW50X3RvX2hlcmUpKSkKICAgIAogICAgaXNvLmNsb3NlKCkKCiAgICByZXR1cm4gcmVzdWx0"
    find_lnk: "aW1wb3J0IHJlCgpkZWYgZmluZF9sbmsoYXJyOiBsaXN0KSAtPiBzdHI6CiAgICByZXN1bHQgPSAiIgoKICAgIHBhdHRyID0gcmUuY29tcGlsZShyIlwubG5rJCIpCgogICAgZm9yIGkgaW4gYXJyOgogICAgICAgIGlmIHJlLnNlYXJjaChwYXR0ciwgaSk6CiAgICAgICAgICAgIHJlc3VsdCA9IGkKICAgICAgICAgICAgYnJlYWsKCiAgICByZXR1cm4gcmVzdWx0"
    get_lnk_target: "aW1wb3J0IExua1BhcnNlMwogCmRlZiBnZXRfbG5rX3RhcmdldChwYXRoOiBzdHIpIC0+IGRpY3Q6ICAKICAgIHJlc3VsdCA9IHt9CiAgICB0YXJnZXQgPSAiIgogICAgY29tbWFuZCA9ICIiCgogICAgd2l0aCBvcGVuKHBhdGgsICJyYiIpIGFzIGZpbGU6CiAgICAgICAgbG5rID0gTG5rUGFyc2UzLmxua19maWxlKGZpbGUpCiAgICAgICAgbG5rX2pzb24gPSBsbmsuZ2V0X2pzb24oKQoKICAgICAgICBpZiBsbmtfanNvbi5nZXQoInRhcmdldCIsICIiKSAhPSAiIjoKICAgICAgICAgICAgZm9yIGkgaW4gbG5rX2pzb25bInRhcmdldCJdWyJpdGVtcyJdOgogICAgICAgICAgICAgICAgaWYgaVsiY2xhc3MiXSA9PSAiUm9vdCBGb2xkZXIiIG9yXAogICAgICAgICAgICAgICAgaVsiY2xhc3MiXSA9PSAiVm9sdW1lIEl0ZW0iOgogICAgICAgICAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgICAgICAgICBlbGlmIGlbImNsYXNzIl0gPT0gIkZpbGUgZW50cnkiOgogICAgICAgICAgICAgICAgICAgIGlmIGlbImZsYWdzIl0gPT0gIklzIGRpcmVjdG9yeSI6CiAgICAgICAgICAgICAgICAgICAgICAgIHRhcmdldCArPSBpWyJwcmltYXJ5X25hbWUiXSArICIvIgogICAgICAgICAgICAgICAgICAgIGVsaWYgaVsiZmxhZ3MiXSA9PSAiSXMgZmlsZSI6CiAgICAgICAgICAgICAgICAgICAgICAgIHRhcmdldCArPSBpWyJwcmltYXJ5X25hbWUiXQogICAgICAgIGVsaWYgbG5rX2pzb24uZ2V0KCJleHRyYSIsICIiKSAhPSAiIjoKICAgICAgICAgICAgdGFyZ2V0ID0gbG5rX2pzb25bImV4dHJhIl1bIkVOVklST05NRU5UQUxfVkFSSUFCTEVTX0xPQ0FUSU9OX0JMT0NLIl1bInRhcmdldF9hbnNpIl0KICAgICAgICAgICAgCiAgICAgICAgY29tbWFuZCA9IGxua19qc29uWyJkYXRhIl0uZ2V0KCJjb21tYW5kX2xpbmVfYXJndW1lbnRzIiwgIiIpCiAgICAgICAgCiAgICAgICAgcmVzdWx0WyJ0YXJnZXQiXSA9IHRhcmdldAogICAgICAgIHJlc3VsdFsiY29tbWFuZCJdID0gY29tbWFuZAoKICAgIHJldHVybiByZXN1bHQ="

chain:
    s1:
        input: $param.file
        func: file_read_bin

    s1_5:
        input:
            - $scripts.create_dir
            - $param.file
        func: python_executor

    s2:
        input: 
            - $scripts.iso_extract
            - $s1
            - $s1_5
        func: python_executor

    s3:
        input:
            - $scripts.find_lnk 
            - $s2
        func: python_executor
    
    s4:
        input:
            - $scripts.get_lnk_target
            - $s3
        func: python_executor

The rule helps me to digest this dataset and to standardize the analysis process:

• Takes the ISO file's path and reads it,
• Creates a folder for the samples,
• Extracts the ISO file's content,
• Looks for a sign of the LNK file,
• If it finds, it gets the target and command line of the LNK file.

After processing the samples, I switched to Google Sheets for data analysis. I took advantage of ATLAS's execution results to get the required data with me. Here is the script that executes the rule and then creates a CSV file with the result of the execution:

import csv

from atlas import atlas


def main():
    atl = atlas("../iso_research.atl", param={'file': '.\*'})
    result = atl.execute()
    
    with open("../iso_research.csv", "w", encoding='UTF-8', newline="") as file:
        writer = csv.writer(file)
        writer.writerow(["filename", "folder", "ISO_Content", "LNK_File", "LNK_Target", "LNK_Command"])
        for i in result:
            temp = []
            for key in i:
                try:
                    if key == "s1":
                        temp. append(i[key]['input'][0])
                    elif key == "s4":
                        temp.append(i[key]['output']['target'])
                        temp.append(i[key]['output']['command'])
                    else:
                        temp.append(i[key]['output'])
            
                except Exception as e:
                    print(e)
            
            writer.writerow(temp)


if __name__ == "__main__":
    main()  

CSV File​

Rerefences​

• https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
• https://techcommunity.microsoft.com/t5/excel-blog/excel-4-0-xlm-macros-now-restricted-by-default-for-customer/ba-p/3057905
• https://www.sentinelone.com/labs/who-needs-macros-threat-actors-pivot-to-abusing-explorer-and-other-lolbins-via-windows-shortcuts/
• https://en.wikipedia.org/wiki/Optical_disc_image
• https://en.wikipedia.org/wiki/ISO_9660
• https://www.extremetech.com/computing/94370-windows-8-explorer-will-support-native-mounting-of-iso-and-vhd
• https://attack.mitre.org/techniques/T1036/007/

Introduction​

When I saw the attack vector for the first time, I realized that it is an excellent case to demonstrate the potential of the ATLAS. So, after finishing the analysis and the ATLAS rule, I've decided to write a blog post with a detailed explanation of creating the ATLAS rule.

Introduction​

I am passionate about developing a standalone version of the distinct capabilities of the malware, attack vector that I analyze. It helps me to understand the specimen much more deeply. The other advantage is that your code breaks when the actor updates the capability. That means I can track them. In one of my other blog posts, I described how I tracked two highly active malware families, Remcos and Emotet, for months. It is for fun and profit.

Introduction​

In a world full of threats that target indiscriminately every bit and byte of our society, it is curial to have decent intelligence and respond accordingly. These threats often use specialized tools, named malicious software or malware, to achieve from cybercrime to espionage and destructive purposes. In this cat and mouse game, VirusTotal, which was created in 2004, has become the source of malware intelligence, and it provides myriads of information. By the platform's maturation, it has gained advanced capabilities that the analyst uses to enlighten the knowledge gaps.

Introduction​

Albert Lamorisse invented Risk game in 1957. According to Wikipedia,

Risk is a strategy board game of diplomacy, conflict and conquest for two to six players. The standard version is played on a board depicting a political map of Earth, divided into forty-two territories, which are grouped into six continents. Turn rotates among players who control armies of playing pieces with which they attempt to capture territories from other players, with results determined by dice rolls. Players may form and dissolve alliances during the course of the game. The goal of the game is to occupy every territory on the board and in doing so, eliminate the other players.

Introduction​

Agent.Tesla​

Agent.Tesla is a piece of malware that is active since 2014. According to an article that is published on 'krebsonsecurity.com', access right is acquired by paying subscription fee via bitcoin and by the time of the article, it had more than 6,300 customers. 7/24 technical support via Discord channel is also included.

The tag "Late Night Show" because, the attack origins at the end of 2018 and apparently the Show is very late.

Introduction​

APT28​

The group, also known as FancyBear, Sofacy Group, Sednit..., starts its activity in the mid-2000s. They target government, military and security organizations especially NATO-aligned states.

APT28 is a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment. This group reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.