Malware Analysis Signed Sample(WISE CLEANER CERT) Bypassed ASR Rule

[Sandbox Breaker - DFIR]

Signed Sample of SectopRat that passed ASR Rule (Block exe until file meets trust criteria)
The file is not signed properly and is using fake wise cleaner CERT.
I am worried how this file at the time was only was seen on 2 machine globally was allowed to run.


SHA 1: a15f053b71cda0497efdec08b4680267b936024d
Microsoft Claims file is SIgned by Lespeed (MAKER OF WISE CLEANER)

Xcitium at the time was able to block and contain it. File was deemed unknown at the time. So this signed trick did not work with xcitium

 

[Bot]

It's indeed alarming that this file managed to bypass the ASR Rule. This could potentially be due to a flaw in the trust criteria or an advanced evasion technique used by the malware. I suggest reporting this to Microsoft for further investigation. In the meantime, consider manually blocking the SHA-1 hash on your systems.

 

[Andy Ful]

If I recall correctly, the EXE files known in Microsoft Defender's ISG can be blocked by that ASR rule only in 24 hours.
After 24 hours, in almost all cases the malware is already detected by Microsoft Defender or dead in the wild (disappeared from the malicious servers or infected websites ). Of course, one can find such malware on Malware Bazaar or other repositories, but the chances of the in-the-wild infection are close to 0.
The method used by Microsoft is not perfect, but very efficient in practice.
Is this file still alive in the wild?

Edit.
A few years ago I made a funny thread about similar protection (for EXE and other malware):

Advice Request - Windows Defender Delay Protection.

Windows Defender Delay Protection is probably stronger than any antivirus Advanced Threat Protection (also that used in Microsoft Defender ATP in Enterprises). WDDP has an advantage that it can be easily understood and applied in a few minutes by most of the average users. So, let's forget...

malwaretips.com

 

[Sandbox Breaker - DFIR]

If I recall correctly, the EXE files known in Microsoft Defender's ISG can be blocked by that ASR rule only in 24 hours.
After 24 hours, in almost all cases the malware is already detected by Microsoft Defender or dead in the wild (disappeared from the malicious servers or infected websites ). Of course, one can find such malware on Malware Bazaar or other repositories, but the chances of the in-the-wild infection are close to 0.
The method used by Microsoft is not perfect, but very efficient in practice.
Is this file still alive in the wild?

Edit.
A few years ago I made a funny thread about similar protection (for EXE and other malware):

Advice Request - Windows Defender Delay Protection.

Windows Defender Delay Protection is probably stronger than any antivirus Advanced Threat Protection (also that used in Microsoft Defender ATP in Enterprises). WDDP has an advantage that it can be easily understood and applied in a few minutes by most of the average users. So, let's forget...

malwaretips.com

Yes @Andy Ful

Even another payload that loaded yesterday in our test env from same sample.

 

[Andy Ful]

Yes @Andy Ful

Even another payload that loaded yesterday in our test env from same sample.

Interesting.
Did you mean that the sample from the OP dropped a new payload? This would suggest that the initial malware is still alive in the wild (even if it is currently detected by MD).

 

[Sandbox Breaker - DFIR]

Interesting.
Did you mean that the sample from the OP dropped a new payload? This would suggest that the initial malware is still alive in the wild (even if it is currently detected by MD).

Correct

 

[Andy Ful]

Correct

I am curious if the sample from the OP can be still found somewhere in the wild.

 

[Andy Ful]

The sample from the OP is probably the payload delivered by another malware (parent malware), like:
https://www.virustotal.com/gui/file/78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007

It is interesting if that sample was blocked by the ASR rule.

I think that although the sample from the OP was initially undetected by Microsoft Defender after 24 hours (false negative), it is probable that the parent malware was blocked by the ASR rule by low prevalence (if it was not detected by Microsoft Defender). Next, someone submitted the payload to Microsoft, so it is currently detected.

 

[Sandbox Breaker - DFIR]

The sample from the OP is probably the payload delivered by another malware (parent malware), like:
https://www.virustotal.com/gui/file/78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007

It is interesting if that sample was blocked by the ASR rule.

I think that although the sample from the OP was initially undetected by Microsoft Defender after 24 hours (false negative), it is probable that the parent malware was blocked by the ASR rule by low prevalence. Next, someone submitted the payload to Microsoft, so it is currently detected.

Original sample. Was a fake chrome update page on a user.

5487cd6f476b90b544754f017329d9894d6513e3​

 

[Andy Ful]

Original sample. Was a fake chrome update page on a user.

5487cd6f476b90b544754f017329d9894d6513e3​

This is exactly the parent malware from my post.

 

[Sandbox Breaker - DFIR]

This is exactly the parent malware from my post.

Wow.

 

[Andy Ful]

The parent malware was undetected by Microsoft eight days ago (a week after it was first seen in the wild). So it is probable that it was blocked by ASR rule.

 

[Sandbox Breaker - DFIR]

Not at this endpoint. It ran through. 2 weeks ago

Not my endpoint. Lol