Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 985880" data-attributes="member: 32260">SWH vs. Emotet campaign[URL unfurl=&quot;true&quot;]https://forensicitguy.github.io/shortcut-to-emotet-ttp-change/[/URL][URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/emotet-malware-infects-users-again-after-fixing-broken-installer.113427[/URL]Infection chain:Malspam (ZIP attachment or URL) ---&gt; LNK dropped (with hidden VBScript code) ---&gt; .vbs script created/executed ---&gt; script downloads DLL (Emotet) and run it via Regsvr32 LOLBinThe blue part of the attack is not malicious (but very suspicious) and is used to deliver the final malware (Emotet).SWH will block this attack on the delivery stage by blocking shortcuts (LNK files) in the UserSpace. Even if the user whitelisted this shortcut, the .vbs script would be blocked in UserSpace.The attack would be also blocked on the delivery stage by the FirewallHardening tool, because the outbound Internet connections for wscript.exe (VBScript Interpreter) are disabled.The attack is interesting, because when the user clicks the shortcut (LNK file) dropped to the disk, then the CmdLine embedded in the shortcut performs some unusual actions:<ol>
<li data-xf-list-type="ol">It reads the VBScript code embedded somewhere in the shortcut body;</li>
<li data-xf-list-type="ol">It writes this code to the .vbs script;</li>
<li data-xf-list-type="ol">It executes this script.</li>
</ol>These actions are suspicious because the shortcut is usually used to run the executable located somewhere on the disk and not to read something embedded in the shortcut to create &amp; execute the scripting code.</blockquote>

[QUOTE="Andy Ful, post: 985880, member: 32260"] [B][SIZE=5]SWH vs. Emotet campaign[/SIZE][/B] [URL unfurl="true"]https://forensicitguy.github.io/shortcut-to-emotet-ttp-change/[/URL] [URL unfurl="true"]https://malwaretips.com/threads/emotet-malware-infects-users-again-after-fixing-broken-installer.113427[/URL] [B]Infection chain:[/B] [COLOR=rgb(41, 105, 176)][B]Malspam (ZIP attachment or URL) ---> LNK dropped (with hidden VBScript code) ---> .vbs script created/executed --->[/B][/COLOR] [B][COLOR=rgb(184, 49, 47)]script downloads DLL (Emotet) and run it via Regsvr32 LOLBin[/COLOR][/B] The blue part of the attack is not malicious (but very suspicious) and is used to deliver the final malware (Emotet). SWH will block this attack on the delivery stage by blocking shortcuts (LNK files) in the UserSpace. Even if the user whitelisted this shortcut, the .vbs script would be blocked in UserSpace. The attack would be also blocked on the delivery stage by the FirewallHardening tool, because the outbound Internet connections for wscript.exe (VBScript Interpreter) are disabled. The attack is interesting, because when the user clicks the shortcut (LNK file) dropped to the disk, then the CmdLine embedded in the shortcut performs some unusual actions: [LIST=1] [*]It reads the VBScript code embedded somewhere in the shortcut body; [*]It writes this code to the .vbs script; [*]It executes this script. [/LIST] These actions are suspicious because the shortcut is usually used to run the executable located somewhere on the disk and not to read something embedded in the shortcut to create & execute the scripting code. [/QUOTE]

Verification