90 lines
2.8 KiB
Markdown
90 lines
2.8 KiB
Markdown
---
|
|
name: analyzing-malicious-iso-and-container-files
|
|
description: 'Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads
|
|
past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables,
|
|
LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container
|
|
delivery file, or find payloads hidden inside a disk image attachment.'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- malware-analysis
|
|
- iso
|
|
- container
|
|
- delivery
|
|
- mark-of-the-web
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1553.005
|
|
- T1204.002
|
|
- T1027
|
|
d3fend:
|
|
- D3-FCR
|
|
- D3-FA
|
|
references:
|
|
- 'MITRE ATT&CK T1553.005 Mark-of-the-Web Bypass — https://attack.mitre.org/techniques/T1553/005/'
|
|
- 'ISO 9660 file system — https://wiki.osdev.org/ISO_9660'
|
|
---
|
|
|
|
# Analyzing Malicious ISO and Container Files
|
|
|
|
## When to Use
|
|
|
|
- You have an ISO/IMG/VHD attachment suspected of smuggling a payload (LNK + hidden DLL/EXE/script)
|
|
past MOTW and scanners.
|
|
- You need to enumerate contents and flag hidden/executable entries without mounting the image.
|
|
|
|
**Do not use** mounting/auto-run to inspect — that can trigger the lure. Parse the container's
|
|
directory records statically.
|
|
|
|
## Prerequisites
|
|
|
|
- The container file (read inertly). Optional: `pycdlib` for full ISO parsing (the script falls
|
|
back to signature/string carving if absent).
|
|
|
|
## Safety & Handling
|
|
|
|
- Never mount or open the container interactively; carve statically. Defang any URLs found.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Identify the container type
|
|
|
|
```bash
|
|
python scripts/analyst.py inspect sample.iso
|
|
```
|
|
|
|
Detects ISO 9660 (`CD001`), UDF, FAT/VHD signatures and reports the format.
|
|
|
|
### Step 2: Enumerate entries and flag payloads
|
|
|
|
Lists embedded file signatures (`MZ`, `PK`, LNK `\x4C\x00\x00\x00`, script headers) and flags
|
|
hidden/executable/decoy entries.
|
|
|
|
### Step 3: Assess the lure chain
|
|
|
|
A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document
|
|
the relationship.
|
|
|
|
### Step 4: Extract and route
|
|
|
|
Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.
|
|
|
|
## Validation
|
|
|
|
- The container format is identified by signature.
|
|
- Hidden executables/LNKs/scripts are enumerated with offsets.
|
|
- The lure→payload relationship is documented.
|
|
|
|
## Pitfalls
|
|
|
|
- Mounting the image and triggering the lure.
|
|
- Missing payloads in less-common container formats (VHDX, UDF) without the right parser.
|
|
- Overlooking hidden-attribute files that the file manager would not show.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
|
|
- ATT&CK T1553.005 and ISO 9660 references (linked in frontmatter).
|