Yuna Liu

Published research

Detection

Deep Dive into mshta.exe: Abuse of a Windows Native Tool in the Attack Chain

mshta.exe is a legitimate, built-in Windows tool for running HTA applications; its high system privileges make it a favorite LOLBin loader for attackers. Using a copy-paste phishing case impersonating NotebookLM, this report breaks down how attackers load a remote HTA and reshape the process chain via a scheduled task to evade mshta-to-powershell detection, and catalogs forensic artifacts — RunMRU, PowerShell history, and Prefetch — that can reconstruct the activity.

Campaign

Silver Fox APT Campaign Analysis: Fake LINE Delivery via SEO Poisoning and Impersonation Sites

Silver Fox drops malicious installers via SEO poisoning and a fake LINE download site: victims land on a phishing page ranked below the official download page, an external script and short link pull a malicious archive, and after extraction the payload escalates via UAC, injects Chrome's elevation_service.exe through direct Native API syscalls, installs a SYSTEM-level persistence service, and injects sihost.exe to beacon to C2 43.102.44[.]165.

Vulnerability

Analyzing CVE-2024-51324: From Vulnerability Principle to PoC

CVE-2024-51324 is an improper-privilege-management flaw (CWE-269) in Baidu Antivirus's BdApiUtil.sys (v5.2.3.116083): once loaded, any user can ask the kernel to terminate an arbitrary process (including EDR/AV) via IOCTL 0x800024B4. This report covers the principle through a working PoC, the stealth of its kernel-level termination, and detection via tracing driver loads with sc.exe.