Malware News Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation

[Parkinsond]

Content source

https://cybersecuritynews.com/microsoft-defender-stops-qnet-ransomware-attack/

The attack began after a user opened a malicious file, likely delivered through email or a browser download.

It launched mshta.exe, a legitimate Windows utility, which contacted attacker-controlled infrastructure to collect a remote payload and prepare persistent activity.

One flagged suspicious command activity connected to RunMRU registry use, while a correlation engine judged the combined behavior to be malicious rather than normal administration.

The final time from first detection to isolation was 128 seconds. The affected device lost internal and external network access, except for security-management traffic, ending its communication with the attacker-controlled service and leaving an auditable timeline.

Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation

A malicious file abused Windows mshta.exe to fetch a payload, enabling persistence, credential theft, and network compromise.

cybersecuritynews.com

 

[Parkinsond]

Can any firewall with prompts, such as WFC, abort the attack by denying mshta.exe internet connectivity?

 

[SeriousHoax]

Can any firewall with prompts, such as WFC, abort the attack by denying mshta.exe internet connectivity?

Yes, WFC/SimpleWall/etc. similar Firewall blocks first then show a prompt. They can't halt the connection while showing a prompt like a third-party AV firewall.

So looks like there wouldn't have been any second-stage payload if mshta.exe was blocked in the firewall.

The mshta.exe process contacted an attacker-controlled URL and retrieved a second-stage payload.

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET | Microsoft Security Blog

Microsoft Defender automatically isolated a compromised QNET endpoint in 129 seconds, stopping a multi-stage attack before the payload could persist or spread.

www.microsoft.com

 

[Jonny Quest]

Can any firewall with prompts, such as WFC, abort the attack by denying mshta.exe internet connectivity?

Yes, WFC/SimpleWall/etc. similar Firewall blocks first then show a prompt. They can't halt the connection while showing a prompt like a third-party AV firewall.

So looks like there wouldn't have been any second-stage payload if mshta.exe was blocked in the firewall.

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET | Microsoft Security Blog

Microsoft Defender automatically isolated a compromised QNET endpoint in 129 seconds, stopping a multi-stage attack before the payload could persist or spread.

www.microsoft.com

Which is the reason I quit using the free version of Glasswire, as the prompt came after the connection was established, and not before in blocking it like with WFC set to notify.

 

[stonjean633]

MS don't need 128 seconds if it was detected on the first second that malicious file arrived.
Lots of defenses failed here. Web,Email and even heuristics.

 

[SeriousHoax]

Which is the reason I quit using the free version of Glasswire, as the prompt came after the connection was established, and not before in blocking it like with WFC set to notify.

Isn't it the same for WFC? Maybe @Andy Ful can clarify.

 

[Andy Ful]

Isn't it the same for WFC? Maybe @Andy Ful can clarify.

I do not use WFC, but it probably can be configured to blosk/alert connections to the Mshta LOLBin. Similarly, this attack could be prevented by hardening the firewall to block outbound connections to popular LOLBins.

 

[SeriousHoax]

I do not use WFC, but it probably can be configured to blosk/alert connections to the Mshta LOLBin. Similarly, this attack could be prevented by hardening the firewall to block outbound connections to popular LOLBins.

I was mainly asking about the ability to hold a connection then ask the user and then allow/disallow the connection based on user's choice. When I used WFC the last time, it could show the pop-up asking but clicking allow doesn't mean the app will immediately start working, the pop-up was shown after the connection has already been blocked since as far I know, without using an separate and appropriate network driver, firewall apps can't hold the connection.
There's even a firewall app (forgot the name) that can do it but it requires disabling memory integrity to install their driver.