diff --git a/yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml b/yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml index e458cec..c0ba77e 100644 --- a/yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml +++ b/yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml @@ -21,7 +21,7 @@ Detection: Resources: - Link: https://bartblaze.blogspot.com/2019/03/run-applications-and-scripts-using.html - Link: https://twitter.com/bartblaze/status/1107390776147881984 - Acknowledgement: +Acknowledgement: - Person: Bart - Handle: @bartblaze + Handle: '@bartblaze' --- diff --git a/yml/LOLUtilz/OtherBinaries/aswrundll.yml b/yml/LOLUtilz/OtherBinaries/aswrundll.yml index 72414cc..ce11b14 100644 --- a/yml/LOLUtilz/OtherBinaries/aswrundll.yml +++ b/yml/LOLUtilz/OtherBinaries/aswrundll.yml @@ -1,20 +1,18 @@ Name: aswrundll.exe Description: This process is used by AVAST antivirus to run and execute any modules Author: Eli Salem -Created: 19\03\2019 +Created: 2019-03-19 Commands: - - Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" + - Command: "\"C:\\Program Files\\Avast Software\\Avast\\aswrundll\" \"C:\\Users\\Public\\Libraries\\tempsys\\module.dll\"" Description: Load and execute modules using aswrundll Usecase: Execute malicious modules using aswrundll.exe Category: Execute Privileges: Any OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: -- Path: C:\Program Files\Avast Software\Avast\aswrundll -Code_Sample: -- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"] + - Path: C:\Program Files\Avast Software\Avast\aswrundll Resources: - - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research - Acknowledgement: + - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research +Acknowledgement: - Person: Eli Salem - handle: https://www.linkedin.com/in/eli-salem-954728150 + Handle: https://www.linkedin.com/in/eli-salem-954728150