John Hammond Explores Complex Cyber Attack Chain Starting with Suspicious Email

In this video, John Hammond explores a complex and sophisticated attack chain that begins with a suspicious email. The email in question mentions a search for the tool "anydesk" and redirects to a link leading to "anydisk.inc". John suspects that this link could be the result of malicious advertising on Google, a technique known as "malvertising".

By visiting the provided link, John discovers a blank page with a single button that immediately triggers a file download. By analyzing the page's source code, he finds that the content is encoded in base64 and uses XOR operations to decrypt the actual content. By decoding and analyzing the JavaScript, John reveals that the page mimics a CloudFlare verification to deceive users.

When the "Verify you are human" button is clicked, it does not follow the usual CloudFlare behavior. Instead, it opens a Windows Explorer application, which is unusual and suspicious. By examining the JavaScript code, John discovers that the page uses redirections and browser detections to force the user to use Chrome or Microsoft Edge. He also identifies a fake "Cloudflare ray ID" generated dynamically to make the page more credible.

The final redirection leads to a URL that uses a specific Windows protocol handler, "search-ms", to open a search in Windows Explorer. This search points to a network SMB share, which contains a suspicious PDF file. In reality, this file is a Windows shortcut (.lnk) that executes malicious code.

To safely analyze the .lnk file, John uses a Kali Linux virtual machine. He discovers that the .lnk file executes a batch script that downloads a malicious PDF file from a remote server. This PDF file is actually an MSI installer containing several malicious components, including a JS file and an executable.

Using tools like Detected Easy and decompression techniques, John extracts the components of the MSI installer. He finds that the JS file is a cleanup script that deletes temporary files, while the executable is protected by a packer known as "Private EXE Protector". This packer obfuscates the code to make analysis more difficult.

By dynamically analyzing the malware's behavior in a controlled environment, John discovers that the malware is actually a variant of "MetaStealer", known for stealing personal information and browser credentials. The malware uses techniques to bypass User Account Control (UAC) and adds exclusions to Windows Defender to avoid detection.

This video provides a fascinating insight into the techniques used by cybercriminals to deceive users and distribute malware. It also highlights the importance of in-depth analysis and the use of specialized tools to understand and counter these threats.

To watch the full video and learn more about this detailed analysis, visit: https://www.youtube.com/watch?v=EZ6TEjx7JLw