Full transcript
0:00Did you do your taxes? Well, I did, but
0:03just last month at the end of March, I
0:06got an email from Zoom. Zoom stating IRS
0:10document invited you to view document.
0:14Apparently,
0:14securedocs.review@umgs.online
0:18wanted to send along some tax documents.
0:21Now, if it's not already obvious, that
0:23is not the IRS, nor would we expect that
0:26to come from Zoom. This is a fishing
0:29email. A little bit crafty though,
0:31right? Hey, this is coming from
0:32realzoom.us,
0:34official legitimate Zoom, leveraging the
0:36Zoom docs capability, which I didn't
0:39know was a thing. Apparently, you can
0:40just send documents to people and
0:42that'll land in their inbox. Think like
0:44a Google Drive or Google Docs file share
0:46or Dropbox. And this open button
0:48literally takes you to docs.zoom.us.
0:51But we can pretty well presume, taking
0:53advantage of tax season and that
0:55uncertainty, hackers are trying to send
0:57out malware. So, in this video, we'll
0:59take a look at what that malware really
1:01was from this fake Zoom-based IRS tax
1:05lure. And now, because this was some
1:07time ago, that document in Zoom docs is
1:10no longer available, but I did take a
1:11screenshot when it was still live.
1:13Ultimately, it just presented you with a
1:15button that once you clicked it, it
1:17would drive your web browser to this
1:19website. The URL and domain here is
1:21snukko.work,
1:23which is clearly an official website of
1:25the United States government. Here's how
1:27you know. And you got all the fancy
1:29Internal Revenue Service, US Department
1:31of Treasury, your tax document is ready
1:33for download. Looks official, looks like
1:35their website, but this button here to
1:37download your tax document as a PDF did
1:40not download a PDF file. Instead, it
1:43downloaded a file called
1:45IRS_tax_document.js.
1:49Now, nerds and geeks are probably
1:50familiar that .js sounds a lot like
1:53JavaScript, but we're expecting this to
1:55run on your computer, on your endpoint,
1:57on your Windows operating system. And
2:00that will invoke JScript, kind of like
2:02some Microsoft Windows dialect that can
2:04run locally, naturally on Windows. Now,
2:07to make sure I don't accidentally
2:08detonate this thing, I am operating
2:10under Remnux, the reverse engineering
2:12malware Linux distribution, and I
2:14created a directory here in my terminal
2:16for us to work in, and I've opened up
2:18that IRS_tax_document.js,
2:21and it looks like this. All minified,
2:24crammed onto one line, and so much so
2:28that Sublime Text, my text editor, can't
2:30even get the syntax highlighting right.
2:31But obviously, this looks pretty bad,
2:33right? This is obfuscated code, or
2:35mangled and manipulated to be super
2:38confusing that a human analyst, like a
2:40security researcher or security
2:42operations center analyst, can't quite
2:44make sense of. We do see what looks like
2:46a big variable, an array of a lot of
2:49different base64 encoded strings or
2:52data, and we could carve those out and
2:54make some sense of them, but we also see
2:56calls to WScript. Lot of different
2:58indicators of that to use the Windows
3:01script engine and host. Again, that is
3:03activated on your Windows endpoint, and
3:06it's pretty clear that this is malware.
3:09Now, I got to be honest, I hate looking
3:12at JavaScript or JScript code,
3:14especially when it's obfuscated, trying
3:15to analyze or reverse engineer. It's
3:17just gross. It looks like a mess. So, to
3:20try and understand this further, maybe
3:21like a knee-jerk reaction, I'm going to
3:23be looking for tools that can help make
3:25sense of this thing. One of the very
3:26well-known tools is DE4JS,
3:29and we could just like slap in in their
3:31web interface what this might be able to
3:33make sense of, but it doesn't really do
3:35a whole lot. Like it beautifies it and
3:37cleans it up. So, okay, there's some
3:38more white space and different lines
3:40here, but the variables are still kind
3:42of a mess. It hasn't base64 decoded some
3:45of those strings or values. This isn't
3:47super helpful. So, we keep looking
3:49around on Google. We try to find some
3:51other resource or tool when we paste
3:53that in, but oh, it says, "Hey, your
3:54code looks like it's been obfuscated
3:56using obfuscator.io."
3:58This is very well-known. This is very
3:59common for JScript or JavaScript
4:02obfuscation. If I want to bring you to
4:03another tool to try that out, we paste
4:05it in here, deobfuscate, but again, it
4:08it it's not super helpful compared to
4:10what it could be. Now, you got to think
4:12of this as like an analysis and triage
4:15perspective. Cuz say this were to hit a
4:16real victim, someone were to fall for
4:18this, and a security operations center
4:21analyst were to investigate and try and
4:23understand what happened here, make
4:24sense of this malware, they need answers
4:27pretty quick, and fumbling around with
4:28the tools to try to deobfuscate this is
4:31annoying, and we need to move fast, cuz
4:33there's a billion other alerts going
4:35off, and we got to move on the next
4:36signal in the queue. So, you know what
4:38tool would be really good at making
4:40sense of code? What could give us a
4:41little bit more superpowers here? You
4:44guessed it, AI. And honestly, there's
4:46nothing wrong with that. We could crap
4:47this into Codex, Claude Code, whatever.
4:49Honestly, I took the high road, made it
4:50easy, just gave it all Chat GPT, asking
4:53honestly more for resources, like other
4:55tools that we could try to make sense of
4:57this thing. I'm a big proponent of using
4:59AI still to learn or get more exposure
5:01to new technologies, more solutions to
5:03solve problems. And the robot suggested
5:06WebCrack, which maybe you're familiar
5:08with, but it's not one that again, I
5:09have a knee-jerk reaction to. There are
5:11a couple of other options here, and
5:13again, I just wanted to learn and see
5:14what else is available. A lot of these
5:16have command line tools and other
5:18capabilities, but they even have some
5:19sweet suggestions to use AI to help
5:22clean things up. It offered some
5:24references and resources, and we could
5:25go kind of take a closer look at all
5:27these on GitHub if we wanted to. We
5:29could download the NPM library or the
5:31node package to be able to get this
5:33thing in action locally, but they make
5:35it easy for us again with the quick
5:37online playground. Since we're still
5:39experimenting inside of our virtual
5:41machine, I don't have any issue playing
5:42with these things. We could try to run
5:44that code off GitHub or use some of
5:46these online utilities here. So, let me
5:49paste in the original obfuscated code,
5:51and we have some buttons to toggle on or
5:53off what sort of efforts and actions we
5:56want the tool to do, even determine how
5:58we sort of mangle or work with variable
5:59names, but let me click start here, and
6:02this looks a lot better. That unraveled
6:05the base64 strings, put them all in
6:07place. We haven't quite cleaned up our
6:09variable names quite yet, and maybe we
6:11do just let AI figure that out. But
6:13let's clean this up just a little bit
6:15further and then dig into what exactly
6:17is this thing going to do. But real
6:19quick, while we're talking about AI and
6:21how it kind of gives you an Iron Man
6:23suit for a lot of this technical malware
6:25analysis work, investigations and
6:27triage, and your security operations
6:29center can move at machine speed, let me
6:31take a quick second to tell you about
6:33the sponsor of today's video, Panther.
6:35It's the complete AI security operations
6:38center platform. Tons of cybersecurity
6:41tools help analysts move faster, but
6:43Panther is built to do something
6:45different, scale human expertise across
6:48security operations. Because Panther
6:51brings together the data lake, detection
6:53engine, and AI all within one unified
6:56platform. So, agents can work with full
6:59context across your environment. Not
7:02just summarizing alerts, but actually
7:04investigating incidents, classifying
7:06risk, actively tuning detections, and
7:09proactively expanding coverage. Other
7:12teams using Panther are seeing 90%
7:14faster investigations, 70% faster
7:17detection tuning, and significantly less
7:20alert noise. It's AI in the SOC done the
7:23right way. If you want to see what a
7:25closed-loop AI SOC actually looks like
7:28and see how it can completely change
7:30your security posture for the better,
7:32check out Panther with my link below in
7:34the video description, jh.live/panther.
7:38Huge thanks to Panther for sponsoring
7:40this video.
7:42All right. So, let's get back to where
7:44we were. We have a pretty well
7:46deobfuscated JScript sample and malware
7:50here now. Uh some of our variable names
7:52though aren't still super clear as to
7:54what they are or what they do, and we
7:56were thinking we could just let AI help
7:58on that front. Remember, Chatty G was
8:00saying maybe we could try something like
8:01Humanify to use an abstract syntax tree
8:04and AI to rename variables and clean up
8:06code, sort of like a final pass. So,
8:09Humanify JS looks like kind of a neat
8:11tool here over on GitHub. Uh we'll clean
8:14up a lot of the code and properly rename
8:16variables to make sense, to be a little
8:18bit more readable, but it really kind of
8:20requires an API key. Some of the usage
8:23here, depending on the model or API that
8:25you kick this over to, you will need to
8:27hook up an API key. I'm cognizant though
8:30that AI usage is usually pay-as-you-go
8:32or like usage-based cost. So, why not
8:35just throw it right back at Chat GPT?
8:38And it was able to clean things up to
8:40have a little bit more logical renaming
8:42of these different variable names for
8:44each part as they are used and
8:45referenced throughout the code. So, back
8:47over in my virtual machine now, I do
8:50have the deobfuscated version, and this
8:53is going to be a lot easier to read and
8:55us make sense of. We're defining a big
8:57anonymous function, getting some wrapper
8:59objects and variables to work with shell
9:02commands and the file system, all thanks
9:04to WScript like we saw previously,
9:06expanding a temporary directory
9:09environment variable to see where we
9:10could put a log file to disable and
9:14install.log is the way that we track the
9:16operations here, and a convenience
9:18function to actually write to that log
9:20or log something here. Now,
9:23I'm going to be real with y'all. I don't
9:24know
9:25this looks and feels, it's got a little
9:28bit of that smell that maybe this whole
9:30thing, this payload, is like AI vibe
9:32coded in its own right. Cuz there's a
9:34lot of like debugging output that
9:36doesn't need to be here to accomplish
9:39the objective, you know, actually fire
9:41off a continued payload. We loop through
9:43our arguments, we track those down, and
9:45then we check if we are running as an
9:48administrator, whether or not this was
9:49invoked with /elevate, which uses UAC,
9:53or the user account control, to restart
9:56this script and run it once again if it
9:59hasn't already been ran with admin
10:01privileges or with the {slash} elevate
10:03argument. They log it here how they're
10:05using cscript.exe
10:07and that's the command line interpreter
10:09on your Windows host built-in native
10:11included with Windows. That's just how
10:13it happens to fire and run this JScript
10:16code. They mix that with the run as
10:19command here so they can use that
10:21{slash} elevate argument and then
10:23actually pop up and ask for your
10:25administrator privileges. Do you want to
10:27run this like UAC pop-up user account
10:30control? Then they disable smart screen
10:33which is kind of neat. They have admin
10:36privileges so they can write to the
10:37Windows registry at the HK local machine
10:40hive and they just set smart screen
10:43enabled to off.
10:45>> [laughter]
10:45>> Whether or not they were admin or not,
10:46they could still write to HKCU or the HK
10:49current user. That should always have
10:51write privileges for your own local
10:53account, the user you are currently
10:55running as. And these little tweaks tell
10:57Windows, look, don't analyze things with
11:00smart screen, one of your security
11:02mechanisms. And then it goes through a
11:03loop to be able to actually set these
11:06and toggle these in the registry. You
11:07can see these shell run commands with
11:10gross, obvious, pretty clear alarm bells
11:13go off reg add commands. Your EDR
11:16should, goodness gracious, track that
11:19thing down if you got some good security
11:21posture there. Also cute see though,
11:23they set a group policy registry key for
11:26smart screen off the best that they can
11:28and then we download and install an MSI
11:31file or Microsoft installer.
11:34And there it is.
11:37We should have known, Screen Connect.
11:39Here's our hacker's IP address hardcoded
11:42in with the quick and easy guest access
11:44connection for a Screen Connect remote
11:47control capability so that they can
11:49continue to operate now on this infected
11:52computer. They put it inside of their
11:53temporary directory, they go ahead and
11:55stage it all, download it and then run
11:58with PowerShell here, bake in another
12:01PowerShell script to actually have that
12:03downloaded. I don't know why they'd
12:04pivot from JScript to just inline use
12:08PowerShell, literally staging a whole
12:10another file on disk, download.ps1,
12:14and then they run the command to run the
12:17script. So this is stupid, right? This
12:19is
12:19>> [laughter]
12:19>> I don't want to say all AI vibe coded
12:21malware slop, but I think that's it.
12:24They even use the PowerShell command lit
12:27to unblock file though, which is kind of
12:30neat. Just in case like the alternate
12:32data streams ADS for a zone identifier
12:34to say, oh, this came from the internet,
12:36we can't trust it. They say, no, force
12:38trust it. We'll automatically unblock it
12:40for you. We run MSI exec with quiet and
12:44no restart and then it'll automatically
12:46kick off and run Screen Connect as their
12:49command and control and that's the end
12:50of the script. Maybe 360 lines as a
12:53little JScript stager, little PowerShell
12:55in between for some reason, to run
12:58Screen Connect. Now, Screen Connect, if
13:01you're not familiar, very well-known
13:03remote access solution with good
13:05intentions, right? This is used for a
13:07remote support, troubleshooting,
13:08debugging, helping your teammates, your
13:10coworkers, being able to control their
13:12computer to fix things, to solve
13:14problems. But because it lets you
13:16control their screen, because it gives
13:18access to the file system, because you
13:20can run programs and really do whatever
13:22you'd like, it can be taken advantage of
13:26by threat actors and hackers. I always
13:29get a little bit squeamish talking about
13:30Screen Connect because, look, I'm good
13:32buddies with some of the folks over at
13:33ConnectWise. They have some incredible
13:34people there. They're smart. It's just
13:36an unfortunate reality that Screen
13:38Connect kind of runs rampant as one RMM
13:42solution, remote monitoring and
13:43management, and that doubles as a C2
13:47command and control like remote access
13:50Trojan, remote access tool, rat. I'm not
13:54trying to be mean to my friends. I'm
13:56sorry. I just think that's the reality
13:59of the landscape right now. There are a
14:00lot of on-premise like cracked or
14:02illegitimate installations kind of been
14:04running rampant, 72% of all RMM abuse in
14:072025, and I think we're still seeing
14:10uptick. So for funsies, we can go see
14:13how this thing might look. While the
14:15original Zoom Docs file from the
14:17phishing email was down,
14:20Screen Connect instance is still up and
14:22active and that is that. So what do you
14:26do? Screen Connect does have one
14:28interesting distinction though because
14:30sometimes the relay to make connections
14:33can be decoupled or separated from,
14:35okay, this kind of control panel and
14:37access. If we go to their script.ash
14:41ashx
14:43file, it exposes some other info like,
14:46hey, maybe some extension GUIDs or
14:48identifiers for or extensions they might
14:50have installed and that includes their
14:52config just as well. Here I'll zoom in a
14:55bit so you can see the K key value
14:58encoded encrypted. For fingerprint sake,
15:00you could see the version and the relay
15:02could very well be included in the H
15:04like host parameter and P for the port.
15:07So that is on the same IP address that
15:10we've seen on port 8041. That could be
15:12variable though. That could have been
15:13completely different however they kind
15:15of set up some of the infrastructure
15:16from what I understand. So hey, don't
15:19fall for a Zoom Docs phishing email
15:22text-based lure JScript PowerShell rat
15:26for Screen Connect to be installed onto
15:28your computer. Don't fall for the fish,
15:30don't fall victim to how they stage
15:33their post-exploitation and more damage
15:35done. But do learn some of those tricks,
15:37some of those tools, some of that triage
15:39process for analysis and investigation.
15:41And hey, don't be shy, sprinkle in a
15:43little bit of AI in there to help out.
15:44Please do give some love to today's
15:46video sponsor. Big shout out to Panther,
15:47they do seriously cool stuff. And thanks
15:49so much for watching. See you in the
15:51next video.