Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 743594" data-attributes="member: 32260">It seems that the users should add SETTINGCONTENT-MS file extension to Designated File Types list.<a href="https://enigma0x3.net/author/enigma0x3/" target="_blank">enigma0x3</a>I did not test it with all ASR rules, but there is a clever way to bypass some ASR rules to execute cmd.exe via the malicious SETTINGCONTENT-MS file with the reference to AppVLP executable (used in MS Office for Application Virtualization)..EditI checked the POC and it is clear that SETTINGCONTENT-MS file can run cmd.exe without any help from MS Office. It can be also used as a replacement for LNK files to run the malware.</blockquote>

[QUOTE="Andy Ful, post: 743594, member: 32260"] It seems that the users should add [COLOR=rgb(184, 49, 47)][B]SETTINGCONTENT-MS[/B][/COLOR] file extension to Designated File Types list. [COLOR=rgb(0, 168, 133)][B][URL='https://enigma0x3.net/author/enigma0x3/']enigma0x3[/URL][/B][/COLOR] I did not test it with all ASR rules, but there is a clever way to bypass some ASR rules to execute cmd.exe via the malicious [COLOR=rgb(184, 49, 47)][B]SETTINGCONTENT-MS[/B][/COLOR] file with the reference to AppVLP executable (used in MS Office for Application Virtualization). . Edit I checked the POC and it is clear that [COLOR=rgb(184, 49, 47)][B]SETTINGCONTENT-MS[/B][/COLOR] file can run cmd.exe without any help from MS Office. It can be also used as a replacement for LNK files to run the malware. [/QUOTE]

Verification