App Review Malware Obfuscation Part 1

[cruelsister]

Content source

https://www.youtube.com/watch?v=x6STbXn365k

 

[Parkinsond]

The same outcome when using the full tools inside WHHL?
Here only configure defender is used; no Windows firewall harderning, no SRP, no WDAC!

 

[cruelsister]

The same outcome when using the full tools inside WHHL?

Same outcome with WHHL tools fully tricked out. A thing can't stop what a thing can't see...

 

[Parkinsond]

Same outcome with WHHL tools fully tricked out. A thing can't stop what a thing can't see...

This is true for AV, which has to see and identify the file as malicious to stop.

While SRP and PS constrained language mode do not have to see anything; they blindly block certain files (and PS capability) regardless of the file nature; a completely different method, which can be relied on to fill the gaps by defective AV detection (applies to all AVs, not MD alone).

Something similar to Kaspersky application control (when combined with WDAC), yet less refined.

 

[Jonny Quest]

@cruelsister I like your slower methodical approach, which is easier to follow and understand.

 

[Andy Ful]

Same outcome with WHHL tools fully tricked out. A thing can't stop what a thing can't see...

Could you provide a sample? It would be interesting to see how this sample could bypass RunBySmartScreen or WDAC.
Did it manage to bypass the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion"?
How could the initial shortcut land on the desktop where shortcuts are whitelisted by WHHLight? Normally, it will be located in the Downloads folder or on the flash drive and easily blocked by WHHLight restrictions.

 

[Andy Ful]

General note about the attack vector used in the video.

Such type of attacks has been successful against most of popular AVs/EDRs for some years.
The nice article about it can be found here:

Coding Malware in Fancy Programming Languages for Fun and Profit

It seems that Microsoft Defender in HIGH settings was too slow to mitigate the malware. However, such attacks can mainly be prevented by adding the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria". This ASR rule is similar to the Comodo way of blocking/containing executables in the Internet Security configuration. Of course, Comodo can easily block such attacks, except maybe in the Firewall config.

 

[Parkinsond]

Block executable files from running unless they meet a prevalence, age, or trusted list criteria

The most aggressive and protective one among ASR rules; it blocks the installer of PeaZip and Media player classic if recently released, just for being 1-day old and not that prevalent, in addition to not being signed of course.

 

[Andy Ful]

The most aggressive and protective one among ASR rules; it blocks the installer of PeaZip and Media player classic if recently released, just for being 1-day old and not that prevalent.

Yes, and that is why it can also block most evasive threats, too.

 

[Jonny Quest]

These malicious files aren't in the normal executable (exe) form, but instead can be from Utube videos, mp3's or txt files. They avoid detection by being heavily obfuscated.....

Is there any browser extension, any AV browser extension, NextDNS filter setting (Block NRD's) that would have the potential to stop this type of exploit at the browser level, as this file was already on the desktop?

 

[Andy Ful]

Is there any browser extension, any AV browser extension, NextDNS filter setting (Block NRD's) that would have the potential to stop this type of exploit at the browser level, as this file was already on the desktop?

The test scenario can be prepared by copying the archive from the flash drive to the Desktop, unpacking files on the Desktop, and running the shortcut.
If the file was originating from the Internet, opening the shortcut would trigger an alert. That is why it is necessary to use Run By SmartScreen for files originating from flash drives when using WHHLight on default settings. Otherwise, the malware executable should be blocked by WDAC.

 

[Andy Ful]

I think that the attack in the video can be similar to that one (two-year-old example used against student gamer community):

View attachment 1769364025661.png

• Lua51.dll – LuaJIT Runtime interpreter
• Compiler.exe – a thin compiled Lua loader
• Lua script – Malicious Lua script
• Launcher.bat – Batch script used to run Compiler.exe with the malicious script as parameter

However, instead of using the batch script, the shortcut was used.
If so, then for files originating from the Internet, most such attacks can be blocked by SmartScreen, SAC, or WDAC.

Edit.
SRP, WDAC, AppLocker, and SAC can mainly block such threats, also in the scenario from the video (it can depend on the settings).

 

[Parkinsond]

instead of using the batch script, the shortcut was used

To bypass the script rules of AppLocker.

 

[Andy Ful]

To bypass the script rules of AppLocker.

Not necessarily. Using shortcuts is more popular nowadays than two years ago. The attack can be blocked by the AppLocker even when using a shortcut.

 

[Parkinsond]

Using shortcuts is more popular nowadays than two years ago

Yes; alsmot all the new attacks start with LNK file.

The attack can be blocked by the AppLocker even when using a shortcut

But AppLocker has not rules for LNK files, only executable files, windows installers, package app files, and script files!

 

[Andy Ful]

But AppLocker has not rules for LNK files, only executable files, windows installers, package app files, and script files!

Yes, but it will block the compiled LUA loader (detected too late by MD in the video). Similarly, the malware can be blocked by the MD ASR rule noted by me (and by SRP, WDAC, SAC).

 

[oldschool]

If the file was originating from the Internet, opening the shortcut would trigger an alert.

How could the initial shortcut land on the desktop where shortcuts are whitelisted by WHHLight?

Your questions beg this question: Where does the file originate from? This is the issue I have with this kind of testing.

 

[Jonny Quest]

Your questions beg this question: Where does the file originate from? This is the issue I have with this kind of testing.

Which is why I posted my question as well. Or, in AV-Comparatives speak, Real World Protection cp. to Malware Protection.

 

[Divergent]

Your questions beg this question: Where does the file originate from? This is the issue I have with this kind of testing.

Fair warning, the last time I brought this up, it didn't go well for me. People can get a bit 'pile-on' about it.

 

[oldschool]

Fair warning, the last time I brought this up, it didn't go well for me. People can get a bit 'pile-on' about it.

No matter. People will be people.