Forensic Blogs

An aggregator for digital forensics blogs

March 21, 2019 by Harlan Carvey

A Minimal LNK

Yeah, so I've written about LNK files before, but I wanted to take it a step further and explore just how much of the specification is required for a functioning LNK file.

Step 1
I used VBS to create a "bare-bones" LNK to run calc.exe.  I like to have something visual when testing this sort of thing.

The resulting LNK file is 890 bytes in size, and here's what the metadata for the file looks like:

guid               {00021401-0000-0000-c000-000000000046}
mtime              Wed Apr 11 23:34:36 2018 Z
atime              Wed Apr 11 23:34:36 2018 Z
ctime              Wed Apr 11 23:34:36 2018 Z
basepath           C:\Windows\System32\calc.exe
shitemidlist       My Computer/C:\/Windows/System32/calc.exe
**Shell Items Details (times in UTC)**
  C:2018-04-11 21:04:34  M:2018-10-11 21:39:08  A:2018-10-11 21:39:08 Windows (9)
  C:2018-04-11 21:04:34  M:2018-12-20 22:46:22  A:2018-12-20 22:46:22 System32 (9)
  C:2018-04-11 23:34:38  M:2018-04-11 23:34:38  A:2018-04-11 23:34:38 calc.exe (9)
vol_sn              22D3-06AE
vol_type           Fixed Disk
hotkey              0x14
showcmd          0x4

***LinkFlags***
HasLinkTargetIDList|IsUnicode|HasLinkInfo|HasRelativePath

***PropertyStoreDataBlock***
GUID/ID pairs:
{446d16b1-8dad-4870-a748-402ea43d788c}/104
{46588ae2-4cbc-4338-bbfc-139326986dce}/4       SID: S-1-5-21-3855314428-4085452759-4066589348-1000

***KnownFolderDataBlock***
GUID  : {1ac14e77-02e7-4e5d-b744-2eb1ae5198b7}
Folder: CSIDL_SYSTEM

***TrackerDataBlock***
Machine ID                   : enzo
New Droid ID Time        : Tue Sep 18 10:39:24 2018 UTC
New Droid ID Seq Num  : 7175
New Droid    Node ID     : 5c:26:0a:24:29:6f
Birth Droid ID Time       : Tue Sep 18 10:39:24 2018 UTC
Birth Droid ID Seq Num : 7175
Birth Droid Node ID       : 5c:26:0a:24:29:6f

Okay, that is a LOT of stuff that's created in an LNK file, based on the following .vbs script:

set w = CreateObject("Wscript.shell")
set l = w.CreateShortcut("\foo2.lnk")
l.TargetPath = "c:\windows\system32\calc.exe"
l.Save

Step 2
Write code that creates a bare-bones LNK file header.  By "bare-bones", I mean one with the time stamps and any extraneous metadata zero'd out.

Step 3
Write code that goes to the LNK file created in step 1, and strips out just the linktargetIDlist, or "shell item ID list".  Zero out all of the time stamps in the shell items, and just for giggles, change the version value within the shell items.  Append this linktargetIDlist to the header created in step 2.

The resulting LNK file appears below:









The LNK file is 389 bytes in size, and functions perfectly well, no matter where I put it within the file system.  I double-click it, it launches the Calculator, as expected. 

However, this is what the metadata now looks like:

guid               {00021401-0000-0000-c000-000000000046}
shitemidlist       My Computer/C:\/Windows/System32 /calc.exe
**Shell Items Details (times in UTC)**
  C:0                   M:0                   A:0                  Windows (10)
  C:0                   M:0                   A:0                  System32  (10)
  C:0                   M:0                   A:0                  calc.exe  (10)
hotkey             0x0
showcmd         0x1

***LinkFlags***
HasLinkTargetIDList|IsUnicode

The result of this process is a functioning LNK file with minimal metadata.  No disk or volume info, no SID, no MAC address, none of the things we'd look for when analyzing a weaponized LNK file.

I put some of what was used in the creation of these LNK files on GitHub.

Read the original at: Windows Incident ResponseFiled Under: Digital Forensics

March 5, 2019 by Harlan Carvey

Book Writing Misconceptions

You have to admit, our industry is fraught with misconceptions.  Misconceptions and misunderstandings about business practices, about what things should be versus what they really are, about what some data represents, misconceptions about how many emails some people get, and misconceptions about how "busy" people are. The list goes on. From my own perspective, I get it.  I've been in work-from-home positions since about 2006, but even when I was working in an office or "cube-farm", my world view was somewhat limited. As such, I really try to ask and find out before I make an assumption about something...I try.  That doesn't mean that I always succeed.  But I do think that it's human nature to make some assumptions about things.

From an external perspective, over the years I've received emails and messages that have started off, "...I know you're probably too busy to answer this...", but that's never been the case.  Ever.  In more than a few instances, I've responded in under an hour, and in cases where the exchange has been about RegRipper plugins, I've returned a working plugin in under an hour, and then proceeded on to provide something a bit more polished, usually in under 4 hrs.  This is simply meant to illustrate my point, that someone who doesn't have any insight into my daily work life will assume that I'm "too busy", but that's simply their perspective, developing in isolation from any meaningful input.

Okay, that being said, on to the part of this post that deals with writing books.  I'll be the first to admit that when I started down the road of publishing my first book I had what turned out to be a few pretty big misconceptions about what working with a publisher would do for me, and I'm here to share them.

Before I get started, however, let me be clear...I'm not asking for anything.  I'm not writing this in hopes of getting feedback, nor to get anyone to change what they do, nor to suddenly pick up a banner and charge forth.  Not at all.  I'm simply pulling together stuff I've had sitting around in draft form, and I thought I'd put it out there.  If this shines a light for someone, great. 

Also, I've cancelled my contract for book number 10, which was to be titled, "Practical Windows Investigations". The content of this book had been shared here and here.

Okay, then...let's go.

Book Writing
I didn't embark on this journey to obtain notoriety or fame.  I started down this road because I had found the books on my topic(s) of interest wanting...I couldn't find any books containing the content that I wanted in bookstores. As such, I decided that I wanted to put together a book that I would want to take off the shelf of a book store, and proceed to check out.  In most of the cases to that point, I had seen titles that contained the words "Windows" and "forensics", taken the book down and thumbed through it, and then put it back, dissatisfied with the content.  I did ultimately purchase several of the books, but that was because I wanted something in front of me to remind me, "not this".

You don't get rich writing books, especially books in a genre such as DFIR.  This is not a condemnation of the community, it's a simple fact.  Simply put, the topic is far too niche.  What you do get out of it is a bit of taxable income which seems great before taxes, but come March and April is another part of the paperwork that you need to be sure that you have in order.  This is not a complaint, it's simply a fact.

At one point, years ago, what I was doing and writing caught the attention of someone at Microsoft, and they used part of their team budget to provide me with an MSDN account.  This allowed me to get access to newer operating systems (this was pre-Windows 7) and applications, in order to answer questions like, "...what if you do that with the newer OS/application?"  However, he moved on from his role and there was no more interest from Microsoft, and the subscription lapsed.

Marketing
Maybe the biggest misconception I had when I started, and held even during the early days of my publishing "career", was that somehow the publishing company was going to the marketing driver for the book(s), and that they'd be wildly successful because of that.  I thought that somehow, maybe at some point, I'd write something that would get the attention of Microsoft, and through those marketing efforts, I'd somehow "level up" and embark on a new and exciting career path.  Again, that was a pretty big misconception on my part.

Okay, now for a marketing "war story".  Keep in mind, I'm not a marketing person, but at one point, I was due to speak at a fairly big conference ("big", as in within the DFIR community), and I noticed that there was a total of about half a dozen folks attending that same conference who all had published titles under the publisher's imprint.  And those titles included the word, "forensics", as did the title of the conference.  I reached to the publisher and asked if there were plans to sell books at the conference.  After all, this is what one would call a "target-rich environment".  Set up a table, have books available, and have the authors come sign books after their speaking event.  While the publishing company did have a relationship with the conference vendor, it turned out that there were no plans to do anything with respect to that conference.  After a back-and-forth, and an incredulous email or two from me, the publisher decided to their credit that while they were on a family vacation in the city, they would bring a couple of boxes of books and set up a table.  All of the authors in attendance rallied, and stopped by the table at various times to sign books that had just been purchased...pick up the book from the table, pay for it, shuffle a few steps to the right and get it signed by the author, who was just speaking on the podium a few minutes ago.  By the time the event was complete, the publisher had only a few books left.

I never understood why this had not been part of the plan.  When I had asked about the marketing plan for previous books, I was told at one point that the publisher had a list of 101 "big names in the industry", to whom they would send books and hope for a review.  I got the list and noted that most of the names on the list had no interest in host-based, nor Windows, digital forensic analysis.

The publisher does not ask me about attending conferences for book signings.  Sounds cool, I know, but it's not something that was done.  Would it make sense for the publisher's marketing department to contact authors about conferences focused on the community (digital forensics, IR, threat response/intel, etc.), maybe help get them a speaking slot, and then have those speakers spend time at the publisher's table signing books?  Yes, it would...but perhaps due to very limited marketing budgets, it doesn't happen as much as you'd think.  Again, a big misconception on my part.

In my experience, all of the marketing for published books needs to be done by the author, through whatever social media networks they have.  The other step I've taken to promote the books is, over time, I've developed a position where I've been able to negotiate some changes to the default contract; one of them has been the number of complimentary copies of books I receive.  When I get them, I then send signed copies to those folks in the industry who've had the greatest impact on the book being published, and others I give away.

Follow-on Editions
Another misconception of mine, based on the language in the contracts I signed, was that the publisher might "find value" in a book and come to me about writing a follow-on edition to a book.  It turns out that this was never the case.  WFA 2/e?  That was something I pushed, as it was with editions 3 and 4.  The same was true with WRF 2/e.  None of the follow-on editions were the result of the publisher coming to me and suggesting/requesting the new edition, due to the success of the previous edition or requests they'd received that a follow-on was needed/due, etc. 

Similarly, the creation of follow-on editions hasn't been something that's been requested or pushed by the community.  For the most part, if an edition needs to be updated, if anyone contacts me about it, that's all they say.  "It's out of date", or "it needs to be updated".  When I ask for specifics, along the lines of "where would you like it to go?" or "what topics would you like to see addressed?", that's where the exchange comes to a grinding halt.

Another aspect of the follow-on editions that likely led to a drop in sales was a move to standardized cover art.  As a concept, this was a good idea, but the execution led to considerable confusion.  What happened was that most of the titles used similar cover formatting, and while the words were different, the colors were similar.  For example, only two shades of green were used, so when I took copies of the newly published Windows Registry Forensics to a conference as give-aways, one of the recipients told me that he already had the book.  As it turned out, he had Windows Forensic Analysis, but the cover art and colors were so similar, he couldn't tell the difference between the two books (yes, even though the words on the book were different) without looking closely at the words.

Having copies of my books on my bookshelf, side-by-side, all with similar cover art and color looks pretty cool.  Add Brett's books right beside them and to me, it looks impressive.  However, in practice, it made the books difficult to distinguish and likely lead to missed sales, as casual observers saw the design and color, decided that they already had a copy, and moved on.

Feedback
After I had completed IWS and it had been "on the streets" for about a month or so, I received a survey from the publisher.  The questions were centered around requesting feedback regarding my experience with the production of the book.  Well, I'll tell you that my responses and comments were not what one would call "glowing", and at the end of the survey, I checked the box, "yes, I would be willing to discuss my responses...".  I never heard back.  This was my ninth published book, albeit the first under this particular publisher (this one had purchased my previous publisher).  I assumed (incorrectly, again, it seems) that my considered comments would have some level of credibility, and that sending me the survey was something more than simply pro forma and rote.

Royalties
Guess what?  Writing DFIR books does not get you to a point where you can retire as soon as your first book is published.  Or even your second or third.  Lots of folks in the community assume that because they enjoyed the book or because they have the book, everyone has it and the author is living in a mansion between Dean Koontz and Stephen King.  Nothing could be further from the truth.

While I'm happy that several of my books have been translated into foreign languages (looks good on my bookshelf), the fact of the matter is that in one case, I made $20 on the deal.  Before taxes.  Publishers sell the right to translate the book for a set fee, and the author gets a royalty on that fee, not on each of the books actually sold in that language.  No, this wasn't a shock to me, as I'd read the contract.  Honestly, I hadn't expected any of the books to be translated into another language.  I'm simply sharing this to clear up a misconception.

Conclusion
After all of this, I had to ask myself, why am I signing over my intellectual property to someone who's not really interested in it, has no interest in supporting the continued development of it, and at the end of the day just made it harder than it needed to be to get a book published.

I've tried three times over the years to get the publishing company I was working with to move in a direction that made the process for authors in the DFIR community a lot smoother to get a book published, from cradle to grave.  The plan I laid out cost the publisher nothing to implement, and the first time I brought it up there were a lot of misconceptions; it seemed that the publisher could not fathom the idea, and filled in what they saw as "gaps" with assumptions.  By the time I got the editor on my side and championing the idea, she left the company and I had to start all over again.  I realize that you can't change a 500 year old business model overnight, and I wasn't trying to, but it became clear that the publisher did not want to move in the direction of increasing the number and quality of DFIR books they were publishing, so why bother?

My thought was that I could act as a liaison for new authors, to help them understand the process and set expectations, and help them overcome some of the hurdles they would encounter.  In short, to help new authors get published and ultimately have a wider range of material and topics covered and available.

The Community
There's another side to this that isn't talked about, and it's the misconception(s) held by the vast majority of the "community".   Most of the folks I've engaged with over the years seem to have the belief that if someone gets a book published that they're somehow "famous", an "expert", and far "too busy" to be bothered with a call or an email.  That "busy", in their minds, seems to translate into "rolling in work".  "Busy" is a badge of honor that many seek out, but I've been working pretty hard over the past year to abolish my own use of the word, even in casual conversation.  This is due to the fact that even if I'm working hard on something...a report, creating the smallest weaponized LNK file possible, whatever...sometimes taking a break to either address a request or tell them I'll reply later is a good distraction.

The honest truth is that I'm somehow "famous" or a "rock star" simply not the case.  I still have to apply for jobs, just like everyone else.  I still have to submit to CfPs to speak at conferences, just like everyone else.  I do not get calls or requests to perform actual analysis work, and at one point (right after my third book was published), I was literally turned down for a job simply because I had published books.  That's right; I was told, "...we can't afford you...", even though we had not gotten to the part of the interview process where we were discussing compensation, and HR hadn't even asked me about my current salary.

Several years ago, I was contacted by an attorney via LinkedIn, and asked to do some work, which I did pro bono.  I wasn't the first, nor only person contacted, but I was likely the first one to respond.  It was a fascinating case (because it was real world) and the result was that based on my report, the judge decided to drop the case.  The fact is that the person who reached to me had no idea who I was, and had simply taken a chance on contacting me based on my social media profile.

My point is simply that I've been told many, many times that someone did not reach out to me because they thought I was "too busy".  This is true no matter how many times I've dispelled that myth.  In some cases, I've turned a request for a new RegRipper plugin (or an update to an older one) around in an hour, and returned something a bit more polished in four hours.  I've answered questions, responded to emails, and been on phone calls...when asked.

Read the original at: Windows Incident ResponseFiled Under: Digital Forensics

February 24, 2019 by Harlan Carvey

LNK Files

Update, 28 Feb: Just a quick note...this post is not about tools.  I do not mention any tools in the post, and the content isn't about one tool being better than another. I do mention using a hex editor, but that is simply to verify finds from whichever tool is used.  In the first example below, every parsing tool available would've returned the exact same time stamps, and I would have (and recommended) used a hex editor to confirm the finding. At the time I'm writing this update, this post has been viewed 1258 times, and not one question about tools has been posted as a comment. This post is about LNK file metadata, what it means, and how it can be used in analysis. Thanks.

I know, I know...yet another blog post on LNK files...yeah.  I get it.  But some new things popped up recently that I wanted to take advantage of, and they ended up here.

I had an opportunity to look at several LNK files recently, and I wanted to dig a bit deeper into their metadata.  Most available write-ups make mention of the LNK file, but tend to gloss over the file and move right to the embedded command and the next stage download.  I wanted to take a closer look at what's in the LNK file, because after all, this is something created within the adversary's environment that they're sending out.  In a lot of ways, it's like free money, so why not make the best use of what you have available, and squeeze every little bit out of the data that you have?  Maybe it's just me, but when the adversary gives you something, it's hardly a "little bit".

Consider this: several years ago, the folks at JPCERT/CC said that LNK files give us a view into the attacker's development environment; this was, and still is, a great idea, so let's see if we can not only replicate what they did (with respect to metadata extraction) but also see if we can't squeeze just a bit more out of the files, and see  what we can learn about the adversary's development environment, and maybe even see what we can learn about the tools they use to create the LNK files.

Steroids
I ran across two write-ups on LNK files recently; perhaps it would be more correct to say two write-ups on the same (or very similar) LNK file.  I found this write-up at D3xt3r's Malware Lab (blog includes a hash), and this write-up on Max's blog (blog includes a link to download the sample).  While D3xt3r's write-up is dated 16 Feb 2019, Max's doesn't have a date as part of the published material, but it does appear to have been published in Feb 2019, as well.  This is to say that they're both fairly recent posts, and as such, the LNK file itself may be fairly recent, as well.

Anyway, I wanted to take a look at a few things associated with the LNK file metadata that weren't discussed in either blog post, specifically what we could learn by going really deep in parsing the files.  One of the first things that I looked at was the shell item ID list, shown below:

shitemidlist       My Computer/C:\/Windows/system32/cmd.exe
**Shell Items Details (times in UTC)**
  C:0                   M:0                   A:0                  Windows (8)
  C:0                   M:0                   A:0                  system32 (8)
  C:0                   M:0                   A:0                  cmd.exe (8)

As we can see from the above output, I parsed the shell item ID list, but the time stamps embedded within the individual shell items (the creation, modification, and last accessed times of the resources) appear to all be zeros.  Using a hex editor, I verified this quite easily, and in fact, the bytes at the locations for the time stamps within each of the shell items are all zeros.  Interestingly enough, the LNK file mentioned here also has the shell item time stamps zero'd out, so this is likely not a unique finding.  However, it's unclear whether this is the result of the tool used to create the LNK file, or of anti-forensic/obfuscation efforts taken after the LNK file was created.

We also see that the version information for the shell items is "8", indicating that the platform is Windows 2008, 7, or 8 (per section 6.5 here).  This gives us some additional (beyond what the JPCERT/CC folks discussed) insight into the development environment used by the adversary.

Now, let's take a look at the contents of the PropertyStoreDataBlock, shown below:

***PropertyStoreDataBlock***
GUID/ID pairs:
{46588ae2-4cbc-4338-bbfc-139326986dce}/4       
         SID: S-1-5-21-1243223150-2135741377-3118647425-500
{f29f85e0-4ff9-1068-ab91-08002b27b3d9}/6

As we can see,there are two GUID/ID pairs, the first of which points to a Unicode string that is a SID.  This is fairly common, in that we not only see the GUID/ID pair populated with a SID in a good number of LNK files, but we can use native tools (PowerShell, etc.) on Windows systems to create LNK files that contain this property set.  In this instance, the RID points to the default Administrator account for the system.  For the second property, the GUID indicates that it's a Summary Information Property Set, and the ID indicates that it's a comment.  Looking at the contents of the property set itself (via a hex editor), there don't appear to be any visible strings.

Interestingly, the LNK file does not appear to have a TrackerDataBlock, and as such, there is no machine ID (system NetBIOS name) embedded in the LNK file.  Again, this is pretty easy to verify via a hex editor.

What we have so far is a pretty interesting view into the manufacture of this LNK file.  There are some 'normal' elements of the file structure that exist, and there are other elements that we expect to see, but have been removed.  This is only one file, so without more insight, anything regarding the "why" is simply speculation and assumption.  What we do know at the moment is that steps were taken, either during the manufacturing process or afterward, to remove elements of the file structure, and the removal of those elements did not impact the function of the LNK file itself.

Finally, the D3xt3r post also includes a link (no pun intended) to this TrendMicro post from 2017.  The TM post indicates that, at the time, the use of LNK files to download malware was a "rising trend".

Cb
I also ran across this write-up from Carbon Black, dated 11 Feb 2019. The LNK file discussed in the Cb blog post contains some interesting metadata.  For example, this file happens to contain a description field, as shown below:

description        AVI

I can't say that I've often seen a description field within an LNK file that's been populated.  However, I should note that the LNK file from the 2018 campaign described here did have a description field of "ds7002.pdf"; the LNK file from the 2016 campaign did not.

In addition, we can see from the shell item ID list (below) that the shell items contain time stamps, and that the version numbers embedded within the shell items indicate that the system is a Windows 8.1 or 10 system.

shitemidlist       My Computer/C:\/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
**Shell Items Details (times in UTC)**
  C:2018-04-11 21:04:34  M:2018-11-16 21:29:56  A:2018-11-16 21:29:56 Windows (9)
  C:2018-04-11 21:04:34  M:2018-11-21 17:32:02  A:2018-11-21 17:32:02 System32 (9)
  C:2018-04-11 23:38:22  M:2018-04-11 23:38:22  A:2018-06-28 23:05:46 WindowsPowerShell (9)
  C:2018-04-11 23:38:22  M:2018-06-28 23:04:20  A:2018-06-28 23:04:20 v1.0 (9)
  C:2018-04-11 23:35:28  M:2018-04-11 23:35:28  A:2018-04-11 23:35:28 powershell.exe (9)

Looking at the PropertyStoreDataBlock (below), we see a SID, as well as another property.

***PropertyStoreDataBlock***
GUID/ID pairs:
{446d16b1-8dad-4870-a748-402ea43d788c}/104
{46588ae2-4cbc-4338-bbfc-139326986dce}/4       
    SID: S-1-5-21-1607665944-3235443811-1991609163-1001

Looking at the SID, we see that in this case, the RID is "1001", indicating a user account was used to create the LNK file (as opposed to the built-in administrator account, with a RID of 500).  In fact, we know from the RID that this was the second user account created on the system.

Looking up the other GUID, it appears to be a System.VolumeID property; I'm still looking for information on how to parse this property field.

Finally, we have the TrackerDataBlock (below):

***TrackerDataBlock***
Machine ID                     : x10-slim
New Droid ID Time         : Sun Jul 29 22:57:38 2018 UTC
New Droid ID Seq Num  : 5969
New Droid    Node ID     : e8:9e:b4:3a:a3:ea
Birth Droid ID Time         : Sun Jul 29 22:57:38 2018 UTC
Birth Droid ID Seq Num  : 5969
Birth Droid Node ID        : e8:9e:b4:3a:a3:ea

As we can see from the TrackerDataBlock, the NetBIOS name of the system on which the LNK file was created is "x10-slim". Looking up the MAC address OUI (i.e., e8:9e:b4) indicates that it belongs to "Hon Hai Precision Ind. Co.,Ltd.", which was also mentioned in the JPCERT/CC article. Through the course of discussions of "toolmarks", one of the topics that came up was that a common virtual machine may be used by actors; the fact that a VM is used is supported by the OUI lookup, but something that hasn't been addressed is how common this may be.

RAT
I also ran across a Proofpoint blog post from August 2017 that was very interesting, and not just because of the use of Game of Thrones as the lure.  In this particular case, the LNK file was embedded within the .docx lure file

First, let's take a look at the shell item ID list (below):

shitemidlist       My Computer/C:\/WINDOWS/system32/WindowsPowerShell/v1.0/powershell.exe
**Shell Items Details (times in UTC)**
  C:2006-05-22 17:08:04  M:2007-12-06 05:29:12  A:2007-12-06 05:29:12 WINDOWS (3)
  C:2006-05-22 17:08:04  M:2007-12-04 00:44:06  A:2007-12-04 00:44:06 system32 (3)
  C:2007-09-21 00:56:32  M:2007-09-21 00:56:32  A:2007-09-21 00:56:32 WindowsPowerShell (3)
  C:2007-09-21 00:56:32  M:2007-12-03 06:20:46  A:2007-12-03 06:20:46 v1.0 (3)
  C:2009-07-13 23:49:08  M:2009-07-14 01:39:22  A:2009-07-13 23:49:08 powershell.exe (8)

In this case, the version of "3" from the shell items indicates a Windows XP or 2003 system.  And yes, I did catch (and verify) that the version info for the final shell item ("powershell.exe") is indeed "8".  This seems to indicate that the LNK file was created on an older platform.

Skipping past the encoded Powershell command, we see a couple of times of interest.  First, the PropertyStoreDataBlock (below):

***PropertyStoreDataBlock***
GUID/ID pairs:
{0c570607-0396-43de-9d61-e321d7df5026}/3
{46588ae2-4cbc-4338-bbfc-139326986dce}/4       
   SID: S-1-5-21-3345294922-2424827061-887656146-1000
{dabd30ed-0043-4789-a7f8-d013a4736622}/100
{b725f130-47ef-101a-a5f1-02608c9eebac}/10
{28636aa6-953d-11d2-b5d6-00c04fd918d0}/30

Okay, this LNK file has 5 items in this data block, which is unusual in itself.  We see the SID, which as with the LNK file from the Carbon Black post, is for a user account.  We also see a number of other GUID/ID pairs, as well, and I think that this may be the result of the EnableTargetMetadata flag having been set in the LNK file.  I say this because if you read the description of the flag (here), it says:

The shell link attempts to collect target properties and store them in the PropertyStoreDataBlock (section 2.5.7) when the link target is set.

I'm not 100% clear on what this means, but it seems to say that target properties are stored when the target of the LNK file is "set".  I guess maybe another question to consider is, was the flag specifically set, and if so, what tool or application was used to create the LNK file?

Moving on, we see that this particular LNK file has a code page value identified in the metadata, as shown below:

***ConsoleFEDataBlock***
Code page: 936

The code page is identified as "simplified Chinese", which makes sense because the campaign was thought to have a Chinese nexus.  However, what I have to wonder is how many times a code page is seen within LNK files.  For example, neither of the LNK files discussed here appeared to contain code pages.  I rarely see write-ups that mention LNK files that also mention a code page entry.

Is it possible that this field was modified as a "false flag" or "red herring"?  Sure.  When looking at any single metadata field with a file structure in isolation, the possibility exists that it was modified.  We've seen evidence, just in this blog post, of either a manufacturing process that creates the files in the state that we see them, or an "after market" process that removes the missing elements from the file structure.  But what we're not seeing is the exploration of these findings in the context of the larger campaign.  Are the actors creating other "false flags"?  If so, how pervasive are they?  Are the LNK file elements linked to other campaigns, possibly even ones associated with different actors?

Finally, the TrackerDataBlock contains a machine ID of "john-win764".  Used in conjunction with the SID and volume serial number (in this case, "CC9C-E694"), a VirusTotal retro-hunt might turn up other examples of similar LNK files.

Final Thoughts
Some thoughts come to mind as a result of looking at these files.  First off, there's a good bit of metadata that can be used to do research on campaigns, particularly through individual archives, as well as VirusTotal (re: retro-hunt).

I know some folks have said, "...yeah, but it's easy to change those fields...".  Sure, I agree to an extent, but there would be a 'cost' associated with that.  The Proofpoint team addressed this in their post.  However, what I'm referring to is parsing files already collected, ones that have been archived by teams following the campaigns and collecting data, or are available from other archival sources (VirusTotal, etc.).  If those files are tied to specific campaigns, or attributed to specific actors, then you may have something there.  Not only can you see if and how the files have changed over time (like the FireEye folks did), but what if LNK files with similar metadata appear across different campaigns, and are used by different actors?  What does that tell us?

Further, what this sort of analysis shows is that there's a lot going on underneath the MITRE ATT&CK technique, specifically, "Initial Access, Spearphishing Attachment".  In fact, quite a few sub-techniques and even specific technical details seem to pop right out.  Just look at what we've seen so far; some LNK files are sent as attachments themselves, but in other cases, the LNK files are embedded in a lure document.  Embedded commands differ (WMIC, Powershell, etc.), as does the level of obfuscation and encoding. Some LNK files contain embedded commands with some serious obfuscation, while some contain no obfuscation whatsoever.  We could create an entire matrix just for weaponized attachments.

The JPCERT/CC article described some work done in clustering LNK files based on some of the available metadata around different attacks, which was very interesting.

Additional Resources
FireEye blog post, re: FIN7 - mentions LNK "toolmarks"
PodCast with Nick Carr, discussing "toolmarks"
2018 NCSC Advisory - discusses not only the use of iconfilename fields in LNK files to maintain persistence across password changes, but also includes a very basic Yara rule for detecting the 'weaponized' LNK file (I should note that none of the metadata was shared)

Read the original at: Windows Incident ResponseFiled Under: Digital Forensics Tagged With: lnk

  • 1
  • 2
  • 3
  • …
  • 64
  • Next Page »

About

This site aggregates posts from various digital forensics blogs. Feel free to take a look around, and make sure to visit the original sites.

  • Contact
  • Aggregated Sites

Suggest a Site

Know of a site we should add? Enter it below

Sending

Jump to Category

All content is copyright the respective author(s)