Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 974196" data-attributes="member: 32260">SWH vs. PPAM (weaponized PowerPoint add-on)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/powerpoint-files-abused-to-take-over-computers.112292/[/URL][URL unfurl=&quot;true&quot;]https://www.joesandbox.com/analysis/548357/0/html[/URL]I have researched this malware via the JoeSandbox report because the available articles were not especially helpful.Infection vector (delivery stage in blue):Email ---&gt; PPAM add-on ---&gt; OLE, VBA macro ---&gt; Mshta LolBin ---&gt; script execution (from malicious URL)[ATTACH=full]264016[/ATTACH]SWH on default settings can block this attack on the delivery stage (VBA disabled). When the setting &quot;Paranoid Extensions&quot; is applied in SWH, the PPAM add-in will not be even executed by PowerPoint.How H_C_Hardening tools could prevent this attack?<ul>
<li data-xf-list-type="ul">ConfigureDefender HIGH - Mshta LOLBin will be blocked by ASR rule &quot;Block Office applications from creating child processes&quot;.</li>
<li data-xf-list-type="ul">FirewallHardening - Mshta LOLBin will be prevented to access the HTA script from a malicious URL.</li>
<li data-xf-list-type="ul">DocumentsAntiExploit tool - the initial macro will be blocked without notification.</li>
</ul></blockquote>

[QUOTE="Andy Ful, post: 974196, member: 32260"] [B][SIZE=5]SWH vs. PPAM (weaponized PowerPoint add-on)[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/powerpoint-files-abused-to-take-over-computers.112292/[/URL] [URL unfurl="true"]https://www.joesandbox.com/analysis/548357/0/html[/URL] I have researched this malware via the JoeSandbox report because the available articles were not especially helpful. [B]Infection vector (delivery stage in blue):[/B] [COLOR=rgb(41, 105, 176)][B]Email ---> PPAM add-on ---> OLE, VBA macro ---> Mshta LolBin ---> [/B][/COLOR][COLOR=rgb(184, 49, 47)][B]script execution (from malicious URL)[/B][/COLOR] [ATTACH type="full" alt="1643913113348.png"]264016[/ATTACH] SWH on default settings can block this attack on the delivery stage (VBA disabled). When the setting "Paranoid Extensions" is applied in SWH, the PPAM add-in will not be even executed by PowerPoint. How H_C_Hardening tools could prevent this attack? [LIST] [*]ConfigureDefender HIGH - Mshta LOLBin will be blocked by ASR rule "Block Office applications from creating child processes". [*]FirewallHardening - Mshta LOLBin will be prevented to access the HTA script from a malicious URL. [*]DocumentsAntiExploit tool - the initial macro will be blocked without notification. [/LIST] [/QUOTE]

Verification