So I'm going to open up another tool, which is an amazing tool called CyberChef.
I love CyberChef.
CyberChef is awesome.
You can actually go out online to its GitHub site and run it,
or you can actually download the HTML file and run it locally,
which is great.
Yeah, you can run your own instance of it.
So all I'm doing is I took that Base64 encoded string,
I copied it in here, and up here on the right,
we see the Input.
That's where I pasted it.
And down here on the bottom right is the Output.
That's what's going, that's where our decoded stuff is going to be.
Now what CyberChef does is it has, I don't know,
maybe like 100 different what it calls recipes of different ways that you can
decode or manipulate the input and then get it at the output,
and you can do multiple recipes at the same time.
So if, let's say, we had a string that was was Base64 encoded,
and then it was like, let's say,
zlib compressed or some other type of obfuscation,
we could first Base64 decode it, and then we could set it,
then we could do the decompression, or the secondary,
or whatever it is, and we can do as many as we want.
And that's what makes cyber stuff so powerful.
And I see it says BAKE right there, and I've used it before.
So it's cool.
You make a recipe, and you bake it up.
You know what I mean?
So what I'm going to do here is I'm just going to select the From Base64,
drag it over here, and when I let go of the mouse button,
watch the Output portion of the screen because it's going to change,
and it's going to show us the decoded PowerShell.
There we go.
So here we see the decoded PowerShell.
Now you see that there is dots in between.
That just means that we're dealing with Unicode
strings as opposed to an ASCII string, which we could go in and we could modify.
But I think we can still see what's going on here pretty well.
It's the extra bits that UTF uses versus ASCII.
If we look at this, we can see that it's creating a new Web Client object,
it's going out, we see stuff related to proxy and credentials,
but at the very bottom here, we see something that says d.
o.
w.
n.
l.
o.
a.
d.
S.
t.
r.
I.
n.
g, and then we see a URL.
So even if you don't know how to write code in PowerShell,
and I will admit, I suck at PowerShell,
but you can at least look at this and see where it's saying d.
o.
w.
n.
l.
o.
a.
d.
S.
t.
r.
I.
n.
g, and then a link out to a Pastebin site.
And so you can at least infer from this that when the user downloads,
or I'm sorry, when the user opens up the document,
it's going to launch this PowerShell, and it's going to download this document,
or whatever this is, whatever this is on Pastebin.
Now if you look above that, you'll see IEX,
and that is a PowerShell command for executing whatever is after that.
So if you're familiar with JavaScript--- Invoke-Expression.
---yeah, Invoke-Expression.
If you're familiar with JavaScript, they have the eval command,
which evaluates anything that's given to it within JavaScript.
Same concept here.
It's going to evaluate.
So probably what's going on here is this PowerShell is going to
download this Pastebin file and then execute it,
so it's probably more PowerShell that it's going to execute.
Yeah, and you can see there's a semicolon at the end too,
which generally indicates that on the same line,
there's going to be another command.
So this is a really good example too because we're
talking about fileless malware,
yet there is a file that is the source of the fileless malware.
Yeah, exactly.
So there is the file that's going on here.
We've got that documented.
We could start tracing through, but this code here that gets downloaded,
that's downloaded into memory.
That's not saved to a file anywhere.
So the defender would have to go out and hope that this is still there,
this Pastebin site is still there,
and download it on their own and start to recover it or hope that they have,
it's HTTPS, so hope that they're decoding SLL traffic in the network,
which is pretty rare.
So after this point, if this site is no longer there,
then you may be out of luck.
So the fileless part here, because this isn't actually the exploit,
this is just the stage area that's pulling down the actual exploit,
so it's loading--- Exploit, or malware, or something.
---so it's loading that exploit or malware into memory.
Yes.
So what if you have Macros disabled, does that help here?
It does.
So if you had Macros disabled back here in our documents,
this code right here would never run.
You need to have the Macros enabled, and even if you have Macros enabled,
the user, at least with modern versions of Office,
they get a little security warning saying that do
you want to enable this content?
But the user is going to click Yes.
They always click Yes.
Yeah, that's exactly what I was going to say.
It's the same as saying that we can run a batch
script to bypass execution policy.
The policy of disabling the Macros still allows you to enable them
as the user generally because a lot of Excel sheets have a whole
bunch of macros that someone made a lot of effort to make to make
your spreadsheet look awesome, and they're necessary,
but so they're going to click Yes all the time.
And attackers know this, and they know that they want to try to trick the users.
And so often, these phishing documents, they have,
all that's in there outside of the macro is this really big image
that says this document has been encrypted.
Enable Macros in order to see the contents.
And for most users, that's enough to trick them into doing it.
That makes sense.