Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998558" data-attributes="member: 32260">The initial CPL malware drops a DLL payload:C:\Antivirus.System.Update.KB16889415-_.cpl.dlland uses a Regsvr32 LOLBin to execute it.This is a well-known attack vector, so the AVs (not only Defender) have more chances to detect it behaviorally compared to the MSI attacks with a side loading method.The payload is a DLL so can be in theory detected by Defender&#039;s cloud-delivered protection - this is clearly stated in Microsoft&#039;s documentation (the support for MSI is not mentioned).Finally, the CPL vector is extremely rare, even compared to MSI. I could find on Malware Bazaar hundreds of MSI malware, and 0 CPL samples.So, even if we could find some samples undetected on VirusTotal or samples that could compromise Defender, the attacks via CPL files will not be as dangerous as in the case of MSI.Anyway, if someone has access to this sample it would be good to check how efficiently Microsoft can fight it.</blockquote>

[QUOTE="Andy Ful, post: 998558, member: 32260"] The initial CPL malware drops a DLL payload: C:\Antivirus.System.Update.KB16889415-_.cpl.dll and uses a Regsvr32 LOLBin to execute it. This is a well-known attack vector, so the AVs (not only Defender) have more chances to detect it behaviorally compared to the MSI attacks with a side loading method. The payload is a DLL so can be in theory detected by Defender's cloud-delivered protection - this is clearly stated in Microsoft's documentation (the support for MSI is not mentioned). Finally, the CPL vector is extremely rare, even compared to MSI. I could find on Malware Bazaar hundreds of MSI malware, and 0 CPL samples. So, even if we could find some samples undetected on VirusTotal or samples that could compromise Defender, the attacks via CPL files will not be as dangerous as in the case of MSI. Anyway, if someone has access to this sample it would be good to check how efficiently Microsoft can fight it. [/QUOTE]

Verification