Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 978585" data-attributes="member: 32260">SWH vs. Quakbot[URL unfurl=&quot;true&quot;]https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/[/URL]This attack vector is blocked with SWH ver. 1.1.1.1. SWH ver. 2.0.0.0 can block such attacks in Recommended Settings (including the DocumentsAntiExploit tool).This threat could bypass SWH versions prior to 1.1.1.1 on default settings. It used the Excel XLSB binary workbook which could abuse the DDE feature and Regsvr32 LOLBin. It was not related to macros (VBA or Excel 4.0).The infection chain (delivery stage in blue):Email interjection with URL ---&gt; download XLSB document packed in ZIP file ---&gt; open XLSB document (DDE) ---&gt; intermediate payload dropped and executed via Regsvr32 LOLBin ---&gt; ..... ----&gt; main payload injected to Explorer (C&amp;C server connections)How H_C_Hardening tools could prevent this attack?<ul>
<li data-xf-list-type="ul">ConfigureDefender HIGH - Excel will be blocked from using the Regsrv32 LOLBin by the ASR rule &quot;Block Office applications from creating child processes&quot;.</li>
<li data-xf-list-type="ul">FirewallHardening - cannot block this particular infection (payload is not downloaded from the Internet), but can block (LOLBins blocked) the abused Explorer from connecting the C&amp;C server.</li>
<li data-xf-list-type="ul">DocumentsAntiExploit tool - blocks DDE feature n Excel and Regsrv32 LOLBin will not run.</li>
</ul>Post updated to include the info related to SWH ver. 1.1.1.1 and later.</blockquote>

[QUOTE="Andy Ful, post: 978585, member: 32260"] [B][SIZE=5]SWH vs. Quakbot[/SIZE][/B] [URL unfurl="true"]https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/[/URL] [B]This attack vector is blocked with SWH ver. 1.1.1.1. SWH ver. 2.0.0.0 can block such attacks in Recommended Settings (including the DocumentsAntiExploit tool).[/B] This threat could bypass SWH versions prior to 1.1.1.1 on default settings. It used the Excel XLSB binary workbook which could abuse the DDE feature and Regsvr32 LOLBin. It was not related to macros (VBA or Excel 4.0). [B]The infection chain (delivery stage in blue): [COLOR=rgb(41, 105, 176)]Email interjection with URL ---> download XLSB document packed in ZIP file ---> [/COLOR][/B][COLOR=rgb(41, 105, 176)][B]open XLSB[/B][/COLOR][B][COLOR=rgb(41, 105, 176)] document (DDE) --->[/COLOR][/B] [COLOR=rgb(184, 49, 47)][B]intermediate payload dropped and executed via Regsvr32 LOLBin ---> ..... ----> main payload injected to Explorer (C&C server connections)[/B][/COLOR] [B]How H_C_Hardening tools could prevent this attack?[/B] [LIST] [*]ConfigureDefender HIGH - Excel will be blocked from using the Regsrv32 LOLBin by the ASR rule "Block Office applications from creating child processes". [*]FirewallHardening - cannot block this particular infection (payload is not downloaded from the Internet), but can block (LOLBins blocked) the abused Explorer from connecting the C&C server. [*]DocumentsAntiExploit tool - blocks DDE feature n Excel and Regsrv32 LOLBin will not run. [/LIST] [B][COLOR=rgb(0, 168, 133)]Post updated to include the info related to SWH ver. 1.1.1.1 and later.[/COLOR][/B] [/QUOTE]

Verification