lucebac

Reversing; Malware Analysis; Coding; (retired) @FluxFingers member

[FluxFingers @fluxfingers]

The Hacklu 2022 CTF is over!

Thank you for playing!

Of course special congrats to the top 3 teams! 🥳 🏆
🥇 organizers
🥈 justCatTheFish
🥉 💦

CTF: https://t.co/rbPY4FAEo3

Challenges will still be up for a while. See you next Year!

#hacklu #ctf @fluxfingers

[FluxFingers @fluxfingers]

Less than 24h until Hacklu CTF 2022 and the registration is now open! Sign up at https://t.co/7RrfeQJISn and prepare yourself for the finest hacking.
#Hack_lu #CTF

[Chad Tilbury @chadtilbury]

Windows Registry Analysis: Tasks https://t.co/1rjxNOh6bL >> WOW! This is an incredible resource documenting the intricate details recorded in the registry for scheduled tasks. While event logs are an easier place to ID evil tasks, sometimes only the registry is available.

[lucebac @lucebac]

It's been in the making for a (very long) while but I'm happy to finally share the results of my latest side project: digging into the Windows Task Scheduler to find out what information the keys and values in the TaskCache subkey hold. Enjoy!

[G DATA Advanced Analytics GmbH @gdata_adan]

New Blog Post: "Windows Registry Analysis - Today's Episode: Tasks"

We dug into the Windows Task Scheduler and the Registry to find out how the Task Scheduler stores it's data in the Registry.

These are our results: https://t.co/TNqSPHun60

#windows #tasks #registry

[G DATA Advanced Analytics GmbH @gdata_adan]

New blog post: What the Pack(er)?

We had a look at how the #cobaltstrike drops were delivered by #emotet during the last weeks and found something we think is worth a share.

https://t.co/bhrgcES2B8

[G DATA Advanced Analytics GmbH @gdata_adan]

We have reason to assume with high confidence that #Emotet is active again and currently distributed via #Trickbot https://t.co/2jjRyoCmcI

[FluxFingers @fluxfingers]

Hacklu CTF 2021 is now live at https://t.co/7RrfeQJISn! Markets are open, stonks must go up! #CTF #Hack_lu

[lucebac @lucebac]

This is one of the times I gratefully recall @anders_fogh 's life advice "if you really want to understand something, write a parser for it"

[lucebac @lucebac]

New blog post on my latest findings in the #trickbot ecosystem published this morning @ https://t.co/xxI6VAnQGK

[G DATA Advanced Analytics GmbH @gdata_adan]

New Blogpost: Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers
https://t.co/Qw52dzDhGK

[lucebac @lucebac]

@malware_traffic @GaborSzappanos When I last checked, mshare did not use any kind of exploit but mworm did. Not sure about tabDll though, did not look into it very deeply.

[lucebac @lucebac]

@GossiTheDog @schrotthaufen @struppigel Then I don't know, I'm sorry

[lucebac @lucebac]

@kamiljdudek @GossiTheDog @schrotthaufen @struppigel https://t.co/GpteGsfbsk

[lucebac @lucebac]

@GossiTheDog @schrotthaufen @struppigel I may have an answer to the non-admin to SYSTEM elevation: if the infected machine is part of an infected network, the elevated trickbot may stem from one of the worm modules that uses one of the Eternal* exploits (I guess it's EternalBlue but I mix up the names regularly)

[lucebac @lucebac]

@GossiTheDog @schrotthaufen @struppigel I may have an answer to the non-admin to SYSTEM elevation: if the infected machine is part of an infected network, the elevated trickbot may stem from one of the worm modules that uses one of the Eternal* exploits (I guess it's EternalBlue but I mix up the names regularly)

[lucebac @lucebac]

@kamiljdudek @GossiTheDog @schrotthaufen @struppigel Well, as it is called 'bypass', I assume the position of the slider doesn't matter at all because UAC is not triggered. But I'm not too deep into UAC (bypasses) so this is just educated guessing.

[lucebac @lucebac]

@GossiTheDog @schrotthaufen @struppigel I may need to add: that's the only thing I currently remember that trickbot uses to elevate itself.

[lucebac @lucebac]

@GossiTheDog @schrotthaufen @struppigel Uhm...yes?! That's exactly for what you need those UAC bypasses

[lucebac @lucebac]

@schrotthaufen @GossiTheDog @struppigel That's at least what they did a few months ago - but as this bypass is still unfixed, I suspect they still use it. Although I have not checked for the last couple of months.

[lucebac @lucebac]

@schrotthaufen @GossiTheDog @struppigel UAC-Bypass via CMLuaUtil->ShellExec