AV-Comparatives Malware Protection Test March 2022

[Arequire]

7-zip.

Unless something's changed since I last used it, 7-Zip absolutely removes MOTW upon extraction. The only two archivers I know that don't are Bandizip and Windows' built-in unzip utility (does it even have an official name?).

Edit: Just tested and 7-Zip does still remove MOTW.

 

[Anthony Qian]

Unless something's changed since I last used it, 7-Zip absolutely removes MOTW upon extraction. The only two archivers I know that don't are Bandizip and Windows' built-in unzip utility (does it even have an official name?).

Edit: Just tested and 7-Zip does still remove MOTW.

Thanks for testing. Just curious: since 7-zip removes MOTW, why CyberCapture can still be triggered and block some threats?

 

[Arequire]

Thanks for testing. Just curious: since 7-zip removes MOTW, why CyberCapture can still be triggered and block some threats?

Couldn't tell you. Are you sure it's triggering CyberCapture and not Deep Screen (or whatever Avast calls it nowadays)? The blue alert in @Andy Ful's previous post is Deep Screen while the red alert is CyberCapture. They work different; as far as I'm aware Deep Screen analyses the file locally on your system, while CyberCapture sends the file to Avast for analysis.

Edit: I was wrong about the blue alert being Deep Screen. See @Anthony Qian's post below.

 

[Andy Ful]

Thanks for testing. Just curious: since 7-zip removes MOTW, why CyberCapture can still be triggered and block some threats?

The CyberCapture sandbox was not triggered:

CyberCapture - FAQs | Official Avast Support

A list of frequently asked questions about CyberCapture in Avast Antivirus on Microsoft Windows.

support.avast.com

CyberCapture can recognize that the file was downloaded from the Internet when the file has got MOTW. One can force CyberCapture to use the sandbox for any EXE file by adding the MOTW. This is done for example by Hard_Configurator or RunBySmartscreen.

In theory, the malware can be undetected by the CyberCapture sandbox, but this happens very rarely (for malware with strong anti-sandbox features). But, you wrote in one of your posts that you saw many such samples - this seemed strange to me. Now we know that these samples did not have MOTW, so they were not analyzed in the CyberCapture sandbox.

 

[Anthony Qian]

Couldn't tell you. Are you sure it's triggering CyberCapture and not Deep Screen (or whatever Avast calls it nowadays)? The blue alert in @Andy Ful's previous post is Deep Screen while the red alert is CyberCapture. They work different; as far as I'm aware Deep Screen analyses the file locally on your system, while CyberCapture sends the file to Avast for analysis.

According to a senior user on Avast's forum, Deep Screen has been removed and integrated into CyberCapture. (how to activate deep screen avast)

The CyberCapture sandbox was not triggered:

View attachment 265993

CyberCapture - FAQs | Official Avast Support

A list of frequently asked questions about CyberCapture in Avast Antivirus on Microsoft Windows.

support.avast.com

CyberCapture can recognize that the file was downloaded from the Internet when the file has got MOTW. One can force CyberCapture to use the sandbox for any EXE file by adding the MOTW. This is done for example by Hard_Configurator or RunBySmartscreen.

In theory, the malware can be undetected by the CyberCapture sandbox, but this happens very rarely (for malware with strong anti-sandbox features). But, you wrote in one of your posts that you saw many such samples - this seemed strange to me. Now we know that these samples did not have MOTW, so they were not analyzed in the CyberCapture sandbox.

The fact that CyberCapture missed a lot of samples was noticed by a lot of Avast testers on a Chinese malware testing forum, not just by me.

In the case of the MBR killer sample, I'm pretty sure Avast's cloud-based automatic analysis system can't properly detect this kind of threat, because I've submitted similar samples to Avast before and had to wait hours for them to add a detection. If Avast's cloud-based automatic analysis system can classify a threat, a detection will be added within minutes, as we all know.

 

[Arequire]

According to a senior user on Avast's forum, Deep Screen has been removed and integrated into CyberCapture. (how to activate deep screen avast)

Ah. A different module does the scanning then. Thanks for letting me know.

 

[Andy Ful]

...
In the case of the MBR killer sample, I'm pretty sure Avast's cloud-based automatic analysis system can't properly detect this kind of threat, ...

There is no perfect sandbox, so it is possible. Anyway, you can check it by yourself by uploading the sample to OneDrive (online) and downloading the sample from OneDrive to the disk. The sample will get MOTW.
You can also use the Windows built-in unpacker to unpack the Zip file downloaded directly from the Internet (the MOTW will be transferred to the unpacked executable).

The fact that CyberCapture missed a lot of samples was noticed by a lot of Avast testers on a Chinese malware testing forum, not just by me.
...

The reason for that was probably using samples without MOTW. If you are a member of this forum, you can ask them about it.

 

[Anthony Qian]

There is no perfect sandbox, so it is possible. Anyway, you can check it by yourself by uploading the sample to OneDrive (online) and downloading the sample from OneDrive to the disk. The sample will get MOTW.
You can also use the Windows built-in unpacker to unpack the Zip file downloaded directly from the Internet (the MOTW will be transferred to the unpacked executable).

I think I’ll use Bandzip instead of 7-zip.

 

[likeastar20]

The CyberCapture sandbox was not triggered:

View attachment 265993

CyberCapture - FAQs | Official Avast Support

A list of frequently asked questions about CyberCapture in Avast Antivirus on Microsoft Windows.

support.avast.com

CyberCapture can recognize that the file was downloaded from the Internet when the file has got MOTW. One can force CyberCapture to use the sandbox for any EXE file by adding the MOTW. This is done for example by Hard_Configurator or RunBySmartscreen.

In theory, the malware can be undetected by the CyberCapture sandbox, but this happens very rarely (for malware with strong anti-sandbox features). But, you wrote in one of your posts that you saw many such samples - this seemed strange to me. Now we know that these samples did not have MOTW, so they were not analyzed in the CyberCapture sandbox.

And if an .exe does not have a MOTW, you can trick Avast by using RunBySmartscreen?

 

[Andy Ful]

And if an .exe does not have a MOTW, you can trick Avast by using RunBySmartscreen?

Yes.

 

[Trident]

What other users have observed about CyberCapture is true, it is not resistant to evasion and many times reports malware as safe only for behavioural blocking to remove it after. This means that they are able to properly classify the malicious behaviour but they haven’t been able to get to it.

CyberCapture is a small supplement in the whole Avast ecosystem (last line of defence) and is neither as essential nor it is well developed as business solutions that have been perfecting emulation for more than a decade. Eset LiveGuard is not any better. It has been confirmed by Marcos (Eset forum admin) that LiveGuard doesn’t simulate user activity for example. That was discussed on one of my statuses.

@Andy Ful not all vendors need the MOTW, some like Norton, Trend Micro, Check Point and McAfee use sensors to detect downloading behaviour/downloaded files. These do not depend on MOTW at all and will perform their scan flow regardless whether it is presented. Avast has decided to minimise the number of files emulated due to the substantial cost.

@Anthony Qian CyberCapture is not local at all. DeepScreen is local and attempts to perform local emulation whilst the behaviour is processed through online classifiers. CyberCapture attempts to place the malware in a more controlled environment. The logic upon the initial design was that human analysis will be performed when the automated one fails. Maybe this still is the case but human analysis will take some time.

 

[Andy Ful]

@Andy Ful not all vendors need the MOTW, some like Norton, Trend Micro, Check Point and McAfee use sensors to detect downloading behaviour/downloaded files. These do not depend on MOTW at all and will perform their scan flow regardless whether it is presented. Avast has decided to minimise the number of files emulated due to the substantial cost.

I would say that most AV vendors do not rely much on MOTW.
Microsoft Defender is an exception, but some features (like ASR rules) do not need MOTW at all.
Smart App Control does not need MOTW to protect PE files - it is required for non-PE files like scripts, disk images, etc.
Avast uses MOTW only in CyberCapture, but Hardened Mode does not rely on MOTW.

 

[Trident]

Avast uses MOTW only in CyberCapture, but Hardened Mode does not rely on MOTW.

Yeah, they clearly try to reduce the cost of emulation which is not surprising considering they offer free version.