Comments (3)
Thanks for the compliment!
Currently DOCs are disabled due to various calling problems that can occur. It would assume that you have a DOC viewer already associated with the filename. Plus, in almost all cases, you would have to manually enable Macros or do other manual operations after launching the file. In that case, it's easiest to just copy the file in and do nothing else.
Once copied in, you can then interact with the VM, manually run the DOC, ensure it detonates, then wait out the timer (or cancel it).
However, if there's examples where "running" a DOC file, or other non-PE files, would automatically cause malicious activity to occur then I can look at adding that functionality.
from noriben.
I have been analyzing malicious office files (e.g. doc, rtf, xls, xlsx, etc.) on a Win 7 sandbox that has Noriben on it. I start noriben.py first, and then I open the malicious document. Procmon captures all the good stuff for an analyst (e.g. PowerShell commands, dropped files, etc.).
Statistically, malicious office files dominate the scene because of the use of using windows scripting files embedded into the macros (wmic, PowerShell, mshta, etc.)
To avoid manually "enabling" macros on an office file Microsoft allows macros to run without user interaction (see the link below).
from noriben.
I was able to find a way to do this, but it's not great.
By testing for an executable run, and monitoring for an error, it then switches to "start", which lets Windows open a file with its associated program. If this fails or not, Noriben will continue running. I've tested it with Word documents, and unknown files (system pop-up to choose an app appears).
Output looks like:
[CreateProcess] python.exe:3252 > "%WinDir%\system32\cmd.exe /c start 4.docx" [Child PID: 1276]
Pushing this up now
from noriben.
Related Issues (20)
- Procmon needs permisison to "make changes on this computer" HOT 1
- Registry lenght exceeded HOT 14
- question regarding procmon.pmc configuration file name and extenstion HOT 1
- How to whitelist System:4 process? HOT 4
- I've kept the ProcmonConfiguration.PMC name because that's what SysInternals has always referred to it as. I don't want people to think that this is using an entirely new file format when they may already have PMC's lying around. HOT 3
- Malware - encrypting the.pml HOT 2
- Chinese characters in log HOT 2
- Noriben can't load the CSVfile made by procmon HOT 13
- Empty text and timeline file generated by Noriben HOT 16
- Pledgie Link HOT 1
- procmon.exe path problem HOT 3
- PML file being encrypted by malware HOT 2
- ValueError: could not convert string to float: '3\xa0256' HOT 14
- I've been playing with this issue for awhile, and apologies for the lengthy delay. It's an issue of the backing file being encrypted, but Procmon does have the ability to use virtual memory for the live data. Do you have a sample that you can test against, or provide hash for so I can test? HOT 10
- New issue - VM running Windows 11 Pro HOT 5
- Exiting with error code: 8: Error creating PML HOT 3
- hashlist and csv creation issues HOT 1
- this issue is back. See below HOT 4
- CLosing Noriben HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from noriben.