Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 755183" data-attributes="member: 32260">This sample has DigiCert High Assurance EV Root CA, so should also bypass SmartScreen.Edit.@[USER=51905]Evjl&#039;s Rain[/USER] Confirmed SmartScreen bypass.&nbsp; I am not sure if the second SmartScreen bypass was real, because WD checks files on access when the folder is opened. The suspicious files are blocked by WD until the analysis will complete. So I suspect that the malware sample __-_.exe could be not checked by SmartScreen at all.By the way, he uses &#039;Run By SmartScreen&#039; in his tests. On the contrary to &quot;Run As SmartScreen&quot;, his treatment of the malware with document icon was correct. The&nbsp; &#039;Run By SmartScreen&#039; is intended for default-allow security setup and for all unsafe files in the Userspace (outside&#039; Windows&#039; and &#039;Program Files...&#039; folders). It checks more file extensions (BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, SCR, and VBE) via SmartScreen. Furthermore, if the file extension is dangerous (WSH, WSF, WSC, WS, VBS, VB, SHS, SCT, REG, PS1, PCD, MST, MSP, MSC, MDE, MDB, JS, JAR, ISP, INS, INF, HTA, HLP, CRT, CHM, BAS, ADP, ADE), then the file is blocked with notification. Other files, when &quot;Run By SmartScreen&quot;, are allowed to be opened.The proper usage of &quot;Run By SmartScreen&quot; is always opening the new files via the right-click Explorer context menu option (Run By SmartScreen). If that would be so, then most malware samples in @[USER=51905]Evjl&#039;s Rain[/USER]&nbsp; tests:<a href="https://malwaretips.com/threads/6-08-2018-16.85757/post-755188" target="_blank">https://malwaretips.com/threads/6-08-2018-16.85757/post-755188</a><a href="https://malwaretips.com/threads/3-08-2018-21.85688/post-754757" target="_blank">https://malwaretips.com/threads/3-08-2018-21.85688/post-754757</a>would be blocked with notification, except the popular types like documents, photos, media..I suspect that @[USER=51905]Evjl&#039;s Rain[/USER] intended to test forced SmartScreen itself, but not the &quot;Run By SmartScreen&quot; capabilities.</blockquote>

[QUOTE="Andy Ful, post: 755183, member: 32260"] This sample has DigiCert High Assurance EV Root CA, so should also bypass SmartScreen. Edit. @[USER=51905]Evjl's Rain[/USER] Confirmed SmartScreen bypass. I am not sure if the second SmartScreen bypass was real, because WD checks files on access when the folder is opened. The suspicious files are blocked by WD until the analysis will complete. So I suspect that the malware sample[SIZE=18px][B] __-_.exe[/B][/SIZE] could be not checked by SmartScreen at all. By the way, he uses 'Run [COLOR=rgb(184, 49, 47)][B]By[/B][/COLOR] SmartScreen' in his tests. On the contrary to "Run [COLOR=rgb(41, 105, 176)][B]As[/B][/COLOR] SmartScreen", his treatment of the malware with document icon was correct. The 'Run [COLOR=rgb(184, 49, 47)][B]By[/B][/COLOR] SmartScreen' is intended for default-allow security setup and for all unsafe files in the Userspace (outside' Windows' and 'Program Files...' folders). It checks more file extensions (BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, SCR, and VBE) via SmartScreen. Furthermore, if the file extension is dangerous (WSH, WSF, WSC, WS, VBS, VB, SHS, SCT, REG, PS1, PCD, MST, MSP, MSC, MDE, MDB, JS, JAR, ISP, INS, INF, HTA, HLP, CRT, CHM, BAS, ADP, ADE), then the file is blocked with notification. Other files, when "Run By SmartScreen", are allowed to be opened. [COLOR=rgb(184, 49, 47)]The proper usage of "Run By SmartScreen" is always opening the new files via the right-click Explorer context menu option (Run By SmartScreen).[/COLOR][B] If that would be so, then most malware samples in @[USER=51905]Evjl's Rain[/USER] tests: [URL]https://malwaretips.com/threads/6-08-2018-16.85757/post-755188[/URL] [URL]https://malwaretips.com/threads/3-08-2018-21.85688/post-754757[/URL] would be blocked with notification, except the popular types like documents, photos, media. . I suspect that [B]@[USER=51905]Evjl's Rain[/USER][/B] intended to test forced SmartScreen itself, but not the "Run By SmartScreen" capabilities.[/B] [/QUOTE]

Verification