ANY.RUN<p>🚨 <a href="https://infosec.exchange/tags/XWorm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>XWorm</span></a> leverages LOLBAS techniques to abuse <a href="https://infosec.exchange/tags/CMSTPLUA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CMSTPLUA</span></a></p><p>CMSTPLUA is a legitimate Windows tool that can be exploited for system binary proxy execution using <a href="https://infosec.exchange/tags/LOLBAS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LOLBAS</span></a> techniques, bypassing security controls like <a href="https://infosec.exchange/tags/UAC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UAC</span></a>, and executing <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malicious</span></a> code, putting organizations at risk. </p><p>⚙️ With Script Tracer in <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> Sandbox, a SOC team can analyze scripts more efficiently. It simplifies script breakdowns, making it easier to understand their behavior and get key insights. <br>The <a href="https://infosec.exchange/tags/script" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>script</span></a> embedded in the INF file is used to coordinate an execution chain: <br>1️⃣ EXE starts cmstp.exe which is used to launch a <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malicious</span></a> script from an <a href="https://infosec.exchange/tags/INF" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>INF</span></a> file. <br> <br>2️⃣ CMSTPLUA ➡️ mshta.exe ➡️ cmd.exe ➡️ EXE ➡️ PowerShell <br>– <a href="https://infosec.exchange/tags/MSHTA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MSHTA</span></a> loads a <a href="https://infosec.exchange/tags/VBScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VBScript</span></a> from memory to run an executable and shuts down the <a href="https://infosec.exchange/tags/CMSTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CMSTP</span></a> process. <br>– EXE launches <a href="https://infosec.exchange/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PowerShell</span></a> to add itself to <a href="https://infosec.exchange/tags/MicrosoftDefender" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MicrosoftDefender</span></a> exceptions. <br> <br>3️⃣ Finally, it runs the XWorm <a href="https://infosec.exchange/tags/payload" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>payload</span></a> from the <a href="https://infosec.exchange/tags/System32" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>System32</span></a> directory and adds itself to the Scheduled Task for persistence. <br> <br>👨💻 Check out the analysis and see Script Tracer in action: <br><a href="https://app.any.run/tasks/9352d612-8eaa-4fac-8980-9bee27b96bce/?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_term=130225&utm_content=linktoservice" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/tasks/9352d612-8ea</span><span class="invisible">a-4fac-8980-9bee27b96bce/?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_term=130225&utm_content=linktoservice</span></a> </p><p>Living-off-the-Land techniques have been leveraged for years to execute malicious operations using legitimate system utilities. <br>Use these TI Lookup search queries to find similar samples and improve the efficiency of your organization's security response:<br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_content=linktoti&utm_term=130225#%7B%2522query%2522:%2522commandLine:%255C%2522%255C%255C.inf%255C%2522%2520AND%2520imagePath:%255C%2522cmstp%255C%255C.exe$%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_content=linktoti&utm_term=130225#%7B%2522query%2522:%2522commandLine:%255C%2522%255C%255C.inf%255C%2522%2520AND%2520imagePath:%255C%2522cmstp%255C%255C.exe$%255C%2522%2522,%2522dateRange%2522:180%7D</span></a><br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_content=linktoti&utm_term=130225#%7B%2522query%2522:%2522commandLine:%255C%2522mshta%2520vbscript:%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=cmstplua&utm_content=linktoti&utm_term=130225#%7B%2522query%2522:%2522commandLine:%255C%2522mshta%2520vbscript:%255C%2522%2522,%2522dateRange%2522:180%7D</span></a></p><p>Analyze latest <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> and <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>phishing</span></a> threats with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> 🚀</p><p><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>