{"id":3303,"date":"2015-10-16T17:20:37","date_gmt":"2015-10-16T17:20:37","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3303"},"modified":"2015-10-16T18:18:14","modified_gmt":"2015-10-16T18:18:14","slug":"enter-sandbox-part-10-removable-devices-clickbait-file-names","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/10\/16\/enter-sandbox-part-10-removable-devices-clickbait-file-names\/","title":{"rendered":"Enter Sandbox \u2013 part 10: Removable devices &#038; clickbait file names"},"content":{"rendered":"<p>Infection of removable drives is an old trick and no point explaining what it is. What is\u00a0interesting\u00a0though is looking at creativity of guys who leverage this infection vector and not the ones that\u00a0exploit the autorun.inf mechanism (yawns!), but\u00a0the one that focuses on social engineering.<\/p>\n<p>Assuming that a potential victim of &#8216;removable device infection&#8217; is typically not a very computer savvy individual\u00a0is actually quite\u00a0easy. We all know that\u00a0it&#8217;s the guys like these that are a typical pray for malware authors.<\/p>\n<p>But are they the only ones?<\/p>\n<p>There is so many things one can do to place clickbaitfiles on the removable drive that the victim will end up clicking. It is stronger than us. Whether a rookie or a pro.\u00a0You have seen it, I have seen it &#8211; the guys clicking, clicking&#8230; until it works. I have done it too.<\/p>\n<p>Infection via a removable device is still a perfect social engineering platform and I&#8217;d say it is not going away anytime soon.<\/p>\n<p>Looking at some of the sandboxes samples I have analyzed I created a short list of tricks I have spotted so far (send me more if you know others, and care to share).<\/p>\n<ul>\n<li>hide the folder, create an .exe with the same name and ensure the .exe is using a\u00a0folder icon<\/li>\n<li>use &#8216;current&#8217; and &#8216;directory up&#8217; file names\u00a0i.e. &#8216;..exe&#8217; and &#8216;&#8230;exe&#8217;<\/li>\n<li>use important-looking file names, also in foreign languages<\/li>\n<\/ul>\n<p>\u5306\u5220(\u91cd\u8981\u8d44\u6599).exe<\/p>\n<ul>\n<li>leverage desktop.ini to change the appearance of the folder (f.ex. bin folder)<\/li>\n<\/ul>\n<pre>[.ShellClassInfo]\r\nCLSID={645FF040-5081-101B-9F08-00AA002F954E}<\/pre>\n<ul>\n<li>use various file extensions: .exe, .scr, .pif, .lnk<\/li>\n<li>double .exe (.exe.exe), triple .exe\u00a0(.exe.exe.exe)<\/li>\n<li>intriguing names (sex&amp;pr0n in general, controversy&amp;scandal)<\/li>\n<li>use attractive looking icons &#8211; yup, it&#8217;s thats imple<\/li>\n<li>Fake Recycler folders<\/li>\n<li>obviously, a randomized autorun.inf is a norm now<\/li>\n<\/ul>\n<pre>[AutoRun]\r\n;FLvfB ysQiGKArLcs \r\nsheLl\\open\\commAnD = ukxfqq.pif<\/pre>\n<pre>;fWJoARTstov kivfsp \r\nSHeLL\\oPEn\\dEfault=1\r\n;tCcl bcaolB WdIa BdqhbkeGrp\r\nShell\\explorE\\COmmand= ukxfqq.pif\r\n;ngFiihrOUk \r\nopen =AutoRun.exe\r\n;KyGpw\r\nshEll\\AutOpLAY\\COMMaND=ukxfqq.pif\r\nshell\\1=Open\r\nshell\\1\\Command=AutoRun.exe\r\nshell\\2\\=Browser\r\nshell\\2\\Command=AutoRun.exe\r\nshellexecute=AutoRun.exe\r\n;YtGyagvMMf ceqdP ymhOtYeaQn<\/pre>\n<p>Look at the screenshot below.<\/p>\n<p>Be honest.<\/p>\n<p>What you would NOT click?<\/p>\n<p>mind you &#8211; it is good ol&#8217; Windows XP!<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removable.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3304\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removable-300x141.png\" alt=\"removable\" width=\"300\" height=\"141\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removable-300x141.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removable.png 870w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>and same &#8211; on Windows 7<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removablew7.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3305\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removablew7-300x179.png\" alt=\"removablew7\" width=\"300\" height=\"179\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removablew7-300x179.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/10\/removablew7.png 938w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Update<\/strong><\/p>\n<p>What does the topic of this post have in common with sandboxing?<\/p>\n<p>It would be cool for sandboxes to highlight these artifacts (if they don&#8217;t, yet)&#8230;<\/p>\n<p>If any sample drops\u00a0its copy on a removable drive or another well-known file associated with social engineering i.e.\u00a0exhibits one of the behaviors described above (and more, subject to more analysis) the &#8216;maliciousness&#8217; score can easily go up.<\/p>\n<p>Everyone wins. I hope \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Infection of removable drives is an old trick and no point explaining what it is. What is\u00a0interesting\u00a0though is looking at creativity of guys who leverage this infection vector and not the ones that\u00a0exploit the autorun.inf mechanism (yawns!), but\u00a0the one that &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/10\/16\/enter-sandbox-part-10-removable-devices-clickbait-file-names\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,35,28,39,15,19,46,9,44,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3303"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3303"}],"version-history":[{"count":6,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3303\/revisions"}],"predecessor-version":[{"id":3311,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3303\/revisions\/3311"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}