Adam

Beyond good ol’ Run key, Part 97 http://www.hexacorn.com/blog/2018/12/26/beyond-good-ol-run-key-part-97/ … #DFIR #malware

surprisingly, I survived #Whammageddon

Quiz question: when was the last time you burnt CD/DVD? me: ~2009/2010

Enter Sandbox part 22: CTF - Capturing The ... False (Positive Artifacts) http://www.hexacorn.com/blog/2018/12/25/enter-sandbox-part-22-ctf-capturing-the-false-positive-artifacts/ … #DFIR #malware - not all artifacts are malicious, even if half of the internet and printed books claim so

Enter Sandbox part 21: Intercepting Buffers #2, Abusing the freedom of buffers, after their release http://www.hexacorn.com/blog/2018/12/22/enter-sandbox-part-21-intercepting-buffers-2-abusing-the-freedom-of-buffers-after-their-release/ … #DFIR #malware #sandbox

Beyond good ol’ Run key, Part 96 http://www.hexacorn.com/blog/2018/12/21/beyond-good-ol-run-key-part-96/ … #DFIR #malware not sure if it works, just documenting a possibility for a Wallet DLL on win10

Enter Sandbox part 20: Intercepting Buffers, f.ex. Python code from compiled binaries http://www.hexacorn.com/blog/2018/12/21/enter-sandbox-part-20-intercepting-buffers-f-ex-python-code-from-compiled-binaries/ … #DFIR #malware #sandbox

if you still own a facebook account you are doing it wrong

Using Virtual Machine tools for Guest OS fingerprinting http://www.hexacorn.com/blog/2018/12/19/using-virtual-machine-tools-for-guest-os-fingerprinting/ … #DFIR #malware #sandbox

One of the most annoying things when you buy tickets online is that they come packed with a lot of gfx that we don't want to print. If you don't have a proper software that allows to edit PDF to remove pics and change color remember that WinWord reads PDFs and allows to edit them

Enter Sandbox part 19: The string theory is cool, but the practice is not http://www.hexacorn.com/blog/2018/12/16/enter-sandbox-part-19-the-string-theory-is-cool-but-the-practice-is-not/ … #DFIR #malware #sandboxes

I fought the Autoruns, and Autoruns won http://www.hexacorn.com/blog/2018/12/16/i-fought-the-autoruns-and-autoruns-won/ … #DFIR #malware sometimes things don't work the way we want them too, but it's always worth trying...