Hopefully the Practical Maldocx Analysis Workshop is a good start for everyone attended to poke around with maldocx! 😄. #FIRSTCON18
2
6
phew! having a good time with the training on maldoc!. Sorry if you have to learn too much of file formats!.😅 and thank for joined the training. #honeynet17
Cyber threat intel need to be take as a cynical approach, wait until you got access to the samples before drawing your own conclusion.
What would be your value of threat intel analysis now if after two months it was completely having diff’ attributes n you have no say on it?
Please speak up when people smearing the wrong picture against your absolute finding on pointing Marcus to your NK/Lazarus’s link discovery
The latest attribution of the Wannacry now is to Marcus.Update your IoC/threat intel folks!. Errr,can those also updating your blog to?😏
Some even have lengthy codes diff and snippets similarity comparison to justify the attributions to the Lazarus.Turn out this for lulz eh?
1
So, i thought before this wannacry was attributed to North Korea/Lazarus by few respected security researchers. not happening now eh?
Check at word/_rels/document.xml.rels from the docx (using rtf format) file when extracting it. This is not CVE-2017-0199 eh. /cc @HaifeiLi
4
as found by @pjcampbe11, the trick used is by loading external an OLE object from the docx to load a doc with macro
3
@msftsecurity can you please update on this sig?.The script didn’t drop #Wannacry binary.virustotal.com/en/file/a22ac…
1
1
As of now, we didn’t aware of any email attachment/vbs script related to the Wannacry yet. If anyone of you do know, do share, pls.
The confusing between the Wannacry spread via email attachment (HTA->Wannacry) is due to this.”Microsoft TrojanDownloader:VBS/WannaCrypt“
1
