This is a documentation on what I have done training at the SOC Analyst Fundamentals course on letsdefend.io. Let'sdefend.io is a good platform for blue team training.

On this report, I will be triaging the Excel 4.0 Macros vulnerability - Phishing Mail Detected.

Here's the full details on this Excel 4.0 Macros vulnerability For your reference.

I can see that a suspicious behaviour called the SOC146 - Phishing Email Detected -Excel 4.0 Macros. Figure above, able to view the SMTP address, Destination Address, Source address and E-mail Subject.

Reference : wikipedia

iroto.dll

iroto1.dll

research-1646684671.xls

After unzipped the files then I scan these files into Virustotal.com to get an overview of the malicious files and do analysis from details provided.

All of the 36 security vendors or antivirus detected that the file was malicious

We can see that the file is trojan malware.

Any.run is an interactive malware analysis sandbox this is where the dynamic analysis is utilized. Here's the full report from Any.run

The file was executed in a sandbox environment, and it executed malicious processes such as EXCEL.EXE.

The behavior graph shows under all processes, indicators are presented, which give an idea about the activity of a specific process. In this case, the excel.exe has two regsvr32.exe command-line programs.

nws.visionconsulting.ro

royalpalm.sparkblue.lk

ctldl.windowsupdate.com

Now we will check if someone opened the malicious file or link by examining the C2 addresses

URL: https://royalpalm.sparkblue.lk/vCNhYrq3Yg8/dot.html

URL: https://nws.visionconsulting.ro/N1G1KCXA/dot.html

Proceed to endpoint security then containment of the LarsPRD user it is the victim. After that can proceed to investigate the victim's workstation.

I have the option to look on the endpoint security features which are Processes, network action, terminal history and browse history.

I can see that the regsvr32 commands were executed on the victim's machines in the terminal history

Above are the two malicious IPs communicating with the victim's machine

It is shown that Processes regsvr32.exe run by excel.exe known to be the parent process. The command line is ;

As a result of the sandbox analysis of the Excel file attached to the e-mail, it is seen that it is harmful. In the sandbox analysis, c2 addresses are obtained. When c2 addresses are searched through log management, it is seen that there is access, therefore it is understood that the malicious excel file is run. When the source address is determined on Log Management and searched on Endpoint Management, it is observed that it is a LarsPRD device. When the Browser History and Network Connections of the LarsPRD device are examined, it has been clarified that the LarsPRD device communicates with malicious addresses. When LarsPRD's CMD History is examined, it is observed that the regsvr32 command, which is included in Excel 4.0 macros, is run.

When was it sent?

What is the email's SMTP address?

What is the sender address?

What is the recipient address?

Is the mail content suspicious?

Are there any attachment?

Yes

Yes

Delivered

Opened

Delete

Opened

Next