App Review Microsoft Defender vs Magniber

[wat0114]

By the way, UAC at the maximum level does not peep at all, including on initial run (should have included this tidbit in the video but it slipped my mind as I hate UAC!).

Also a fun fact- see the Windows Installer box that pops up on running the file? That is actually pretty much a fake as another copy is spawned elsewhere in the system that actually runs. So clicking Cancel for that Installer box just will kill the Fake while the actual malware is happily trashing the system.

Incredible! This malware sample was lethal in several ways

I also would have gotten rid of CF i I had to use those settings! The hardest thing to understand about CF is that Simple is Best, and that is almost counter-intuitive in the Security field.

This stands to reason. CF is powerful with all options utilized, but it carries a steep price in user management in both time and effort.

 

[ForgottenSeer 69673]

I must have missed it but which LOLBIN was used in this attack?

Thanks

ok I see it now. msiexec.

 

[Andy Ful]

The examples of Magniber activity:

Magniber (Malware Family)

According to TXOne, The Magniber ransomware was first identified in late 2017 when it was discovered using the Magnitude Exploit Kit to conduct malvertising attacks against users in South Korea. However, it has remained active since then, continually updating its tactics by employing new...

malpedia.caad.fkie.fraunhofer.de

Most examples are related to exploiting the vulnerabilities, except for the latest attacks (April 2022). The sample in this thread is related to the latest attacks and is based on the socio-technic method of malware delivery via fake updates (MSI files) distributed from fake warez and crack sites.

 

[Brahman]

 

[Andy Ful]

Comodo Firewall with CS settings is very powerful because it properly handles the attacks via unknown Portable Executable files (like *.exe, *.dll, etc.). After many years, Microsoft is going to include (optionally) similarly strong protection in Windows 11, which is called Smart App Control (SAC). Unfortunately, SAC is far less usable (for now) compared to CF.

Both SAC and CF can be probably defeated by the special fileless attacks which use custom script loaders to execute Portable Executable payloads or shellcode (avoiding standard APIs to create processes or load DLLs). I noticed that some MT members use additionally the SWH to prevent such types of fileless attacks, but it seems unnecessary at home. Such attacks are rare and almost absent in the attacks on home users. Currently, most fileless attacks can be prevented mitigated by the CF (CS settings) alone.

 

[Anthony Qian]

Magniber ransomware is contained in the DLL which does not have MOTW. So, it is beyond the scope of BAFS. But the initial MSI file can be detected via BAFS if directly downloaded from the Internet via Chrome web browsers (it will be also blocked by SmartScreen for Explorer). Unfortunately, in-the-wild samples are mostly downloaded in archives or disk images and BAFS (SmartScreen) does not work, anyway.
So, BAFS is triggered due to the delivery method. The same will be true for any ransomware (malware) delivered in this way. See for example:

Raspberry Robin gets the worm early

Raspberry Robin is a worm spread by external drives that leverages Windows Installer to download a malicious DLL.

redcanary.com

No. BAFS does not work for the Magniber MSI file. The Microsoft cloud-based automatic analysis system cannot detect even if the BAFS feature blocks the MSI for several seconds. Many Chinese users whose PCs are infected with Magniber are using Microsoft Defender.

 

[Andy Ful]

No. BAFS does not work for the Magniber MSI file.

I do not say that is impossible, but I cannot see any evidence for that (from your posts).

The Microsoft cloud-based automatic analysis system cannot detect even if the BAFS feature blocks the MSI for several seconds.

The MSI file is blocked for up to 1 minute and the automatic cloud-based analysis + postinfection detections can take even several minutes. So with fully working BAFS, there can be sometimes a several-minute window when the malware can infect the users.

Many Chinese users whose PCs are infected with Magniber are using Microsoft Defender.

Yes, that can happen with fully working BAFS. The ransomware attack usually uses many different initial samples, so even if one sample would infect only one user, there still can be several infected users with fully working BAFS. Anyway, the BAFS is still efficient if it can prevent one sample from infecting many users.
In some scenarios, BAFS + postinfection detection will not be efficient for example, when a hacker prepares one sample for one target - there is no gain from BAFS because, after the infection, one infected target is equal to 100% infected victims.

By the way how many infected users were confirmed?

 

[Local Host]

No. BAFS does not work for the Magniber MSI file. The Microsoft cloud-based automatic analysis system cannot detect even if the BAFS feature blocks the MSI for several seconds. Many Chinese users whose PCs are infected with Magniber are using Microsoft Defender.

You're wasting your time, move on.

This Magniber variant is months old and we all aware MD cannot defend you against it (as shown by CS video), no need to waste time arguing with delusional people.

This specific variant was targeted at W11 with MD enabled (so yes, it affects home users).

 

[Andy Ful]

Anthony Qian,

Although I cannot see any evidence that BAFS did not work in the Magniber campaign, I also cannot say how efficient was BAFS against this malware. From some reports, we know that Kaspersky and Comodo were more efficient. Kaspersky was able to recover the files and Comodo was able to contain the malware. It means that in theory both Kaspersky and Comodo could be 100% efficient. The Defender's efficiency was smaller for sure, even with fully working BAFS.

Edit.
@SeriousHoax sent me a sample (not Magniber) that was already recognized as malicious in the Defender's cloud, but BAFS did not work for it. I submitted it to Microsoft (waiting for an answer). So it is true that in some rare cases BAFS can skip something.

 

[Shadowra]

Chill guys

Personally I like @Andy Ful , because his tools are already quite good and his safety tips help a lot.

I also like @Anthony Qian (even if we shouted at each other when I was new here, with McAfee ^^ ) who follows Magniber closely and we discuss a lot in PM (thanks to you for the samples during my vacations, so I can play on VM too ^^ )

Concerning Microsoft Defender, I already managed to encrypt a VM with Magniber in MSI with the anti-ransomware.
I don't know what BAFS is, so I won't go into it.

Even if Kaspersky and ESET are the 2 AVs I see the most on VT (you can also put Comodo, but Sandbox), the other AVs are slow to block it.
I've already seen editors add it, but only in files... just change some parts of the malware or re-build it to bypass detection...

I think Magniber will be detected sooner or later, like any Ransomware (we remember the Locky wave in 2016, or GandCrab in 2017/2018) . It's enough that the editors will have found a strategy that lasts on the long term. Either in Remediation, or in AI Machine Learning with a clean detection.

 

[Kongo]

I don't know what BAFS is, so I won't go into it.

Block at First Sight - Comparable to ESET's LiveGuard.

 

[Shadowra]

Block at First Sight - Comparable to ESET's LiveGuard.

Thanks (we can also mention the "PDM:Trojan.Win32.Generic" detections of Kaspersky when it detects a malicious action)

 

[ScandinavianFish]

I don't know what BAFS is, so I won't go into it.

Enable block at first sight to detect malware in seconds - Microsoft Defender for Endpoint

Turn on the block at first sight feature to detect and block malware within seconds.

docs.microsoft.com

 

[Andy Ful]

I don't know what BAFS is, so I won't go into it.

You can think about BAFS as vaccinating by telepathy.
So, you can be infected by some pathogen and even die after a day. But, before you die your organism warns others by telepathy. So, in a short time, all people connected with you will be vaccinated against this particular pathogen.

In some cases this protection will be inefficient:

1. The attacker prepared the pathogen that could kill only you.
2. The pathogen mutates too quickly.
3. Some users can be still infected in places where telepathy cannot work.
4. The symptoms of the infection are too weak (you live long; no telepathy warnings).

 

[harlan4096]

In case of Kaspersky, I would say UDS detections (Urgent Detection System + KSN Untrusted marks)...

 

[wat0114]

Seems like the brain might be the best defense against Magniber and its variants? Just don't download from shady sites or plug in unknown usb drives?

 

[ScandinavianFish]

Seems like the brain might be the best defense against Magniber and its variants? Just don't download from shady sites or plug in unknown usb drives?

Tell that to the fact that pirated/cracked/torrented and other illegal software is the most common way home users get infected nowadays, its the biggest infection vector for ransomware and at times, all trojan infections.

 

[Andy Ful]

Seems like the brain might be the best defense against Magniber and its variants? Just don't download from shady sites or plug in unknown usb drives?

It is hard to protect people that want/need to use pirated content. They are exposed to sociotechnical attacks and there is no protection that could save most of them in the longer term.

 

[cruelsister]

Seems like the brain might be the best defense against Magniber and its variants? Just don't download from shady sites or plug in unknown usb drives?

Any security application should aspire to protect ALL types of users (no matter the intellect) from ALL types of malware (no matter the source). In my opinion blaming product failure on the user is neither wise nor productive.

 

[wat0114]

It is hard to protect people that want/need to use pirated content. They are exposed to sociotechnical attacks and there is no protection that could save most of them in the longer term.

Of course and understood, even when I made the post. And certainly nothing derogatory intended against users who download pirated software and torrents, because I'm sure most are fully aware of the potential consequences with this type of "Risk/Reward" online activity. Heck, I've been burned this way years ago in my Windows XP days, but of course I knew what I was getting into.