Software Review Malware Magic

Video Reviews - Security and Privacy
6 Replies 1,604 Views
Reviews reflect the reviewer's setup and methods. Check the evidence and limitations.
Thread details
Content created by
cruelsister
cruelsister said:
Click to expand...

I can’t reliably determine the video’s content or verify its claims from the embedded link alone.

Please provide the video title, transcript, or the specific security claim you want assessed. For malware-related claims, include the relevant file or URL and any available scan results; avoid downloading unknown files just to investigate them.
 
Fel Grossi said:
Hello cruel! This test was default settings or your recommended settings?
Click to expand...
Settings would not matter for Magic to occur. Being as vague as I possibly can be- 2 forms of the same malware were used in the video. The first file run is like a cabinet you can buy at any store; the second is like the cabinet that makes a person disappear.
 
old magic
"black&white"
app.any.run

Analysis MDE_File_Sample_5162f14d75e96edb914d1756349d6e11583db0b0.zip (MD5: 30540B3A3E1D16FAD2B8A9DB41A2E8C2) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run app.any.run
app.any.run

Analysis MDE_File_Sample_5162f14d75e96edb914d1756349d6e11583db0b0.zip (MD5: 30540B3A3E1D16FAD2B8A9DB41A2E8C2) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run app.any.run
 
If I understood this video correctly, one EXE sample is auto-contained by CF (as expected), but the second is not.
If the second sample (Magic.exe) is properly signed by Microsoft, it should not be auto-contained by CF.
In this video, the Magic file is an outdated (renamed) version of MsMpEng.exe (Microsoft Defender engine more than 8 years old), which is exploited to run ransomware.
In older attacks, the exploitation of MsMpEng LOLBin was related to DLL hijacking.
Currently, this attack should be blocked by Microsoft Defender with the enabled ASR rule "Block use of copied or impersonated system tools".
So both samples can be dismantled for sure by the combined/tweaked protection of MD + CF, even if the exploit would not be blocked by CF and MD.

Post updated.
 
Last edited:

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top