Inspired by today’s date and ShadowHammer, I created an Excel spreadsheet that will list all the interfaces on your Windows machine (using GetIfTable).
One of the properties that is listed, is the MAC address, and it is compared with a list of MAC addresses found in sheet “List”. As a PoC, I populated that sheet with the initial ShadowHammer list published by @SkylightCyber.
And I got a hit on one of my laptops:
00:50:56:C0:00:08 is a generic MAC address used by VMware for the “VMware Virtual Ethernet Adapter for VMnet8” (VMware Workstation is installed on that machine). So no, that laptop was not targeted by the ShadowHammer actor: it’s a false positive (revised lists were published, one with 2 MAC addresses per line, and that’s where this MAC address appears now).
Enjoy! 😉
list-interfaces.zip (https)
MD5: B7DFF86AA0AFD83EF7796F12CEF46D6C
SHA256: 2AD35C825D1A5D9BCFF75C1374C238415C15BADA3CDB0A5EA7178DE4E1DEF0A2
Didier Stevens 
[…] list-interfaces.xlsm […]
Pingback by Overview of Content Published in April | Didier Stevens — Sunday 19 May 2019 @ 7:55