Create Analysis_2020-02-08.md

Additional Analysis/Neutrino/Analysis_2020-02-08.md

@@ -0,0 +1,62 @@
+# Neutrino physics 101 
+## Table of Contents
+* [Malware analysis](#Malware-analysis)
+  + [The initial vector](#Initial)
+  + [Loader](#loader)
+* [Threat Intelligence](#Intel)
+  + [](#Sub_Intel)
+* [Cyber kill chain](#Cyber-kill-chain)
+* [Indicators Of Compromise (IOC)](#IOC)
+* [Yara Rules](#Yara)
+* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
+* [Links](#Links)
+  + [Original Tweet](#tweet)
+  + [Link Anyrun](#Links-Anyrun)
+  + [Ressources](#Ressources)
+
+<h2>Malware analysis <a name="Malware-analysis"></a></h2>
+<h3>The initial vector<a name="Initial"></a></h3>
+
+<h6>The initial vector is an RTF file who use a well-know vulnerability (CVE-2017-11882) for execute a js script (1.a) form the package of OLE objects.</h6>
+<p align="center">
+  <img src="">
+</p>
+<p align="center">
+    
+
+<h2>Threat Intelligence</h2><a name="Intel"></a></h2>
+
+<h2> Cyber kill chain <a name="Cyber-kill-chain"></a></h2>
+<h6>The process graph resume cyber kill chains used by the attacker :</h6>
+<p align="center">
+  <img src="">
+</p>
+<h2> Indicators Of Compromise (IOC) <a name="IOC"></a></h2>
+<h6> List of all the Indicators Of Compromise (IOC)</h6>
+
+|Indicator|Description|
+| ------------- |:-------------:|
+
+<h6> The IOC can be exported in <a href="">JSON</a></h6>
+
+<h2> References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a></h2>
+
+|Enterprise tactics|Technics used|Ref URL|
+| :---------------: |:-------------| :------------- |
+
+<h6> This can be exported as JSON format <a href=""</a></h6>
+<h2>Yara Rules<a name="Yara"></a></h2>
+<h6> YARA Rules are available <a href="">here</a></h6>
+<h2>Links <a name="Links"></a></h2>
+<h6> Original tweet: </h6><a name="tweet"></a>
+
+* [https://twitter.com/JAMESWT_MHT/status/1225796259845414912](https://twitter.com/JAMESWT_MHT/status/1225796259845414912) 
+
+<h6> Links Anyrun: <a name="Links-Anyrun"></a></h6>
+
+* [impor.doc](https://app.any.run/tasks/454fe6a2-e2d0-4fa3-ba1d-78e2c7372ddd)
+
+<h6> Resources : </h6><a name="Ressources"></a>
+
+* [URLhaus Neutrino](https://urlhaus.abuse.ch/browse/tag/Neutrino/)
+* [VB2019 paper: Rich Headers: leveraging this mysterious artifact of the PE format](https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/)