34 lines
1.5 KiB
Text
34 lines
1.5 KiB
Text
|
rule gen_macro_ShellExecute_action
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "VBA macro technique to call ShellExecute to launch payload"
|
||
|
|
note = "This rule only works on VT or systems that perform macro subfile extraction"
|
||
|
|
author = "John Lambert @JohnLaTwC"
|
||
|
|
date = "2019-01-08"
|
||
|
|
reference = "https://twitter.com/StanHacked/status/1075088449768693762"
|
||
|
|
hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
|
||
|
|
hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
|
||
|
|
hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
|
||
|
|
hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
|
||
|
|
hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
|
||
|
|
hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
|
||
|
|
hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
|
||
|
|
|
||
|
|
reference_hash8 = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
|
||
|
|
hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
|
||
|
|
|
||
|
|
id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"
|
||
|
|
strings:
|
||
|
|
$com1a = "00A0C91F3880"
|
||
|
|
$com1b = "C08AFD90"
|
||
|
|
$com2a = "00A0C90A8F39"
|
||
|
|
$com2b = "9BA05972"
|
||
|
|
$s3 = "ShellExecute" fullword
|
||
|
|
$s4 = "GetObject" fullword
|
||
|
|
condition:
|
||
|
|
filesize < 1MB
|
||
|
|
and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452) //File start with Attribute
|
||
|
|
and all of ($s*)
|
||
|
|
and (all of ($com1*) or all of ($com2*))
|
||
|
|
}
|