Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1014030" data-attributes="member: 32260">SWH vs. Batloader[URL unfurl=&quot;false&quot;]https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/dangerous-batloader-malware-dropper.118627/post-1011278[/URL][URL unfurl=&quot;false&quot;]https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html[/URL][ATTACH=full]271158[/ATTACH]Figure 4: Comparing ZLoader (most recent campaign) and BatLoader attack chainSWH can block such attacks in default settings via PowerShell restrictions (blocked script execution) or SRP restrictions for BAT scripts (level 2 in Figure 4).The Batloader can execute PowerShell malware embedded in the MSI file, but it does not execute the PowerShell code in memory via CmdLine. The malware uses the MSI PowerShellScriptInline custom action, so the malicious PowerShell script code is dropped to disk as PS1 script and executed during software installation.</blockquote>

[QUOTE="Andy Ful, post: 1014030, member: 32260"] [B]SWH vs. Batloader[/B] [URL unfurl="false"]https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/[/URL] [URL unfurl="false"]https://malwaretips.com/threads/dangerous-batloader-malware-dropper.118627/post-1011278[/URL] [URL unfurl="false"]https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html[/URL] [ATTACH type="full" alt="1670454018935.png"]271158[/ATTACH] [I]Figure 4: Comparing ZLoader (most recent campaign) and BatLoader attack chain[/I] SWH can block such attacks in default settings via PowerShell restrictions (blocked script execution) or SRP restrictions for BAT scripts (level 2 in Figure 4). The Batloader can execute PowerShell malware embedded in the MSI file, but it does not execute the PowerShell code in memory via CmdLine. The malware uses the MSI [I]PowerShellScriptInline[/I] custom action, so the malicious PowerShell script code is dropped to disk as PS1 script and executed during software installation. [/QUOTE]

Verification