Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 973399" data-attributes="member: 32260">It is possible that this particular attack could finish the STAGE 2 of infection (but would be stopped by Defender at STAGE 3):But the decisive infection starts at STAGE 3 via the script Net.vbs which is obfuscated. This could be blocked by the ASR rule.&nbsp;STAGE 3:[ATTACH=full]263840[/ATTACH]The full infection chain is very complicated to avoid detection. It is possible that some parts of the attack could be mitigated by the ASR rule &quot;Use advanced protection against ransomware&quot;. Furthermore, the complicated infection chain could be detected by the very aggressive cloud protection level used in MAX settings.I am not sure how this malware neutralization would be counted on Malware Hub. The system was compromised because the malware could connect to a malicious URL, download STAGE 1 payload, get persistence, and execute a few processes after reboot. But, it could not do anything truly malicious when ASR rules were enabled. The final payload (AsyncRAT) would not be injected, UAC would not be bypassed and Defender&#039;s settings would not be tampered, too.</blockquote>

[QUOTE="Andy Ful, post: 973399, member: 32260"] It is possible that this particular attack could finish the STAGE 2 of infection (but would be stopped by Defender at STAGE 3): But the decisive infection starts at [COLOR=rgb(184, 49, 47)][B]STAGE 3 via the script Net.vbs[/B][/COLOR] which is obfuscated. This could be blocked by the ASR rule. [B][SIZE=5]STAGE 3:[/SIZE][/B] [ATTACH type="full" alt="1643317933006.png"]263840[/ATTACH] The full infection chain is very complicated to avoid detection. It is possible that some parts of the attack could be mitigated by the ASR rule "Use advanced protection against ransomware". Furthermore, the complicated infection chain could be detected by the very aggressive cloud protection level used in MAX settings. I am not sure how this malware neutralization would be counted on Malware Hub. The system was compromised because the malware could connect to a malicious URL, download STAGE 1 payload, get persistence, and execute a few processes after reboot. But, it could not do anything truly malicious when ASR rules were enabled. The final payload (AsyncRAT) would not be injected, UAC would not be bypassed and Defender's settings would not be tampered, too. [/QUOTE]

Verification