Advice Request MOTW dilemma

[piquiteco]

Never used VM before; I think it requires ample amount of RAM.

16GB minimum is recommended 32 GB

 

[Andy Ful]

A couple of hours ago, I performed full scan with MD.
It came out with a backdoor in Edge cache.

I recalled I was testing fresh samples from URLhaus and some of them triggered download which I have aborted immediately, but seems some code was residing in Edge cache.

I wondered, if MD could detect it by on-demand scan, why it did not detect it once it was downloaded in cache.
Looked for MOTW, it was absent; this explains why BAFS did not work.

Is there any method to make Edge add MOTW to files stored in cache?View attachment 288735

Such file artefacts were probably created by SmartScreen in Edge (download was prevented, so MotW is absent). They cannot be directly executed.

 

[Parkinsond]

Such file artefacts were probably created by SmartScreen in Edge (download was prevented, so MotW is absent). They cannot be directly executed.

SmartScreen did not stop download; it was aborted manually.
Actually SS was disappointing with URLhaus samples; no single detection.
McAfee webadvisor was good, followed by TrafficLight, and they were not perfect though; missed some URLs.

 

[Andy Ful]

SmartScreen did not stop download; it was aborted manually.

In this way, you did not test BASF and SmartScreen for downloads. You only tested the SmartScreen URL blocking of samples from the URLhaus website.
The URLs you tested were not used in the wild, so SmartScreen ignored them (even if the in-the-wild URL was blocked by SmartScreen).

 

[Parkinsond]

In this way, you did not test BASF and SmartScreen for downloads. You only tested the SmartScreen URL blocking of samples from the URLhaus website.
The URLs you tested were not used in the wild, so SmartScreen ignored them (even if the in-the-wild URL was blocked by SmartScreen).

SS did not react, either by blocking page load or blocking download; it only block download of simplewall installer

 

[Andy Ful]

SS did not react, either by blocking page load or blocking download ...

Did you let Edge fully download the files?

 

[Parkinsond]

Did you let Edge fully download the files?

No; I stopped it manually.
SS, for example, stops simplewall installer from starting download, even before I intervene.

 

[Andy Ful]

No; I stopped it manually.
SS, for example, stops simplewall installer from starting download, even before I intervene.

You cannot test SmartScreen in this way. You must wait until it stops downloading (successfully or not).
If you want to test URLs, you should use the in-the-wild URL used in the attack and not the URLhaus URL (which stores the file for download).

When connecting with in-the-wild URLs, the computer should be protected by a VPN.
Downloading/testing malware is dangerous - should be done in a special testing environment (specially prepared Virtual Machine) by trained users.

 

[Parkinsond]

Tried the same scenario with K; it detected threats immediately in Edge cache, without the need to perform a scan.
I have noticed that disabling encrypted connection scan without installing the extension render safe browsing functionless, inspite of being enabled.