Week of June 17, 2024

Elastic Security Labs discovered a new in-the-wild technique, GrimResource, that uses specially crafted MSC files to execute arbitrary code in Microsoft Management Console (mmc.exe) with minimal warnings. The technique exploits an old XSS vulnerability in apds.dll and combines it with DotNetToJScript to achieve code execution, evading static detection. It was used to deliver Cobalt Strike via a stealthy .NET loader called PASTALOADER.

A proof-of-concept tool named tearson demonstrates DLL injection and API hooking to bypass virtual machine detection and reporting in Pearson LockDown Browser. The tool intercepts GetProcAddress, report_post, and HidCheckVM functions to prevent the security software from detecting VM environments and sending reports. This highlights a weakness in the endpoint security agent's integrity checks.

A proof-of-concept tool named Anti-Tamper-Killer-LoGiC.NET-1.5 was published on GitHub, designed to strip the anti-tamper protection from LoGiC.NET version 1.5. The tool allows users to drag and drop protected files to remove the anti-tamper mechanism, potentially enabling reverse engineering or modification of .NET applications obfuscated with LoGiC.NET.