Packet Analysis – Page 8 – Lost in Security (and mostly everything else)

2016-02-06 Network Alerts At Cupid’s Arrow Online

February 23, 2016 February 23, 2016Packet Analysis

So here is the latest malware exercise from Brad. I will not lie – for some reason this one threw me for a loop. Personally I think it was because I did not have my usual Saturday morning cuppa when I started working on this one. But the emails that Brad included really threw me off for some reason – even after running all the javascript attachments in my VM and seeing that there was no match with the infection traffic in the PCAP or in the Snort rules. With that being said, here are my results for this one….

2016-02-02 Malicious Jar Attachment

February 10, 2016 February 23, 2016Packet Analysis

IoC from this investigation: ============================ myson123456[.]ddns[.]net 178.32.72.136:2550 Here is another example of an email that most users get claiming that they (the user) has something that they need to action on. In this case it is a malicious Java file. Thankfully most email gateways block these types of files from every reaching the user base. Let’s dig in. The Java file has the following characteristics: File Name: payment..jar Size: 118KB MD5: f4b463e4df4ef274a198bfb07ed3e6cd SHA256: f4c93ab532e53274bd97c00fccba3b231de0832e743879380f7af7bf81aef60f Virustotal Link: http://www.virustotal.com/en/file/f4c93ab532e53274bd97c00fccba3b231de0832e743879380f7af7bf81aef60f/analysis/ Detection Ratio: 25 / 54 First Submitted: 2016-02-07 21:28:02 UTC Malwr link: http://malwr.com/analysis/Y2FmYjEwNGM0MjM5NDBmYWI3YTdjYjJkOTRjY2M5OWY/ Since this is a Java file, I usually like to…

2016-02-01 Failed Dridex Word doc email

February 4, 2016 February 23, 2016Packet Analysis

Today while investigating the normal events of the day we got some employees that got sent some phishing emails (related to the latest round of Dridex) with a Word document attached. The email is shown below: The attached Word document has the following properties: The interesting thing about this Word doc, and a couple of the others that came in as well, was the fact that I could not extract the contents from the doc via 7Zip, and OfficeMalScanner did not recognize it as an OLE file either as you can see below: So I opened it up in Notepad++…

Malware Exercise 2016-01-07 Alerts On Three Different Hosts

January 22, 2016 February 23, 2016Packet Analysis

Hello and Happy New Year to you all. Now that the holidays are done, it is time to get back into the swing into things and start with the malware exercises. So here is another one from Brad (the first of the year actually). As usual, to find the artifacts from my investigation into this, please see my Github for this exercise here. The following are my results. – Date and time range of the traffic you’re reviewing. > 22:05:47 – 22:17:18 Duration: 00:11:31 – IP address, MAC address, and host name for each of the 3 computers in the…

SANS Holiday Hack Challenge – Part I

December 23, 2015 December 28, 2015Challenges, Packet Analysis

I figured that I would try and attempt to do the annual SANS Holiday Hack Challenge this year while things were slow at work (knock on wood). So after working on this for 2-3 days, I have managed to knock out the first of the questions: 1) Which commands are sent across the Gnome’s command-and-control channel? 2) What image appears in the photo the Gnome sent across the channel from the Dosis home? The way I got the answers for this first set of problems was not “creative” by any stretch of the imagination. If anything it was just manually…

Damn Malicious Word docs – Part 2

December 20, 2015 February 23, 2016Packet Analysis

So with the push of the Christmas season upon me and my family, it has taken some time to get back to this. So with that being said, I have come back to it only to find out that the malicious word doc is not working fully at the present time – most likely since the compromised server is no longer up/has been fixed. But here is the little bit that I got from running the word doc. After running the malicious word doc within my test VM, I could see a call being made to an IP address of…

Damn Malicious Word docs – Part 1

December 11, 2015 February 23, 2016Packet Analysis

So the purpose of this post is because I could not remember how to extract the script from a malicious Word document. Damn old age and lack of coffee! Like anyone in a SOC role, you most likely get a lot of emails sent to you (or your distro) for odd/weird/humorous emails that people are not sure about. It is up to you and the team in the SOC to figure out if the email is malicious or not. So yesterday someone sent in an email from someone else saying that they would like to work for the company and…

Malware Exercise 2015-11-24 Goofus and Gallant

December 9, 2015 February 23, 2016Packet Analysis

So this one has a great comical backstory – how the user (ironically from the SOC) Tom brought his personal laptop in and managed to get his system infected while looking for a shotgun to go hunting with. Outside of making me and one of my co-workers laugh at the scenario (and then another one asking if this could be based on a real event – lol), there is one thing that I learned from this and it was from reading the answers. Brad explains how he went about finding the start of the infection chain from working backwards using…

Malware Exercise 2015-11-06 Email Roulette

November 15, 2015 February 23, 2016Packet Analysis

So here is my write-up of the latest malware exercise from Brad. Needless to say, his description of the event that lead up to the infection is hilarious. Another great exercise to say the least. As usual, if you spot something off or something that I could improve on, drop me a comment below. Summary of the Investigation ============================== – Date and time of the activity. > 2015-11-06 @ 16:22 – The infected computer’s IP address. > 10.3.66.103 – The infected computer’s MAC address. > Dell 00:24:e8:2d:90:81 – The infected computer’s host name. > STROUT-PC – Domains and IP addresses…

Malware Exercise 2015-10-28 Midge Figgins Infected Her Computer

November 5, 2015 February 23, 2016Packet Analysis

So here is the latest one from Brad – another good exercise to say the least! One thing to note about this one is that I had some issues extracting objects from the PCAP using Wireshark. In those cases I was able to use Captipper to extract out the HTTP object. Also, I am re-organizing my Github so the individual files from the different labs can be downloaded individually and not as one huge download. **Update 06/11/2015 – So after reading Malware Kiwi’s blog post with his results, and talking to some of the guys at work that did the…