Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 985951" data-attributes="member: 32260">Post updated.SWH vs. IcedID &amp; Quantum ransomware[URL unfurl=&quot;false&quot;]https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/quantum-ransomware.113416/[/URL][URL unfurl=&quot;false&quot;]https://thedfirreport.com/2022/04/25/quantum-ransomware/[/URL]Infection chain (delivery stage in blue):Email with ISO attachment ---&gt; LNK + DLL dropped ---&gt; CmdLine in LNK --&gt; DLL executed (IcedID) via LOLBin (RunDLL32) ---&gt; Cobalt Strike ---&gt; Quantum ransomwareThis is a common infection chain against Enterprises, but the delivery method can be used also in widespread attacks. We can see that the ransomware is applied as a final payload and two other malware (IcedID and Cobalt Strike) were applied before. In the wild, the ransomware was executed 4 hours later.The shortcuts are often used to execute DLLs and scripts via LOLBins.SWH can block this attack on default settings at the delivery stage by blocking shortcuts in UserSpace. <s>If one does not use disk images to install software, then the ISO file type can be blocked in SWH (Settings &gt;&gt; Protected SRP Extensions) to prevent the malware at the beginning of the infection chain</s>.Edit.Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP.But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools.</blockquote>

[QUOTE="Andy Ful, post: 985951, member: 32260"] Post updated. [B][SIZE=5]SWH vs. IcedID & Quantum ransomware[/SIZE][/B] [URL unfurl="false"]https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware[/URL] [URL unfurl="false"]https://malwaretips.com/threads/quantum-ransomware.113416/[/URL] [URL unfurl="false"]https://thedfirreport.com/2022/04/25/quantum-ransomware/[/URL] Infection chain (delivery stage in blue): [COLOR=rgb(41, 105, 176)][B]Email with ISO attachment ---> LNK + DLL dropped ---> CmdLine in LNK --> [/B][/COLOR][COLOR=rgb(184, 49, 47)] [B]DLL executed (IcedID) via LOLBin (RunDLL32) ---> Cobalt Strike ---> Quantum ransomware[/B][/COLOR] This is a common infection chain against Enterprises, but the delivery method can be used also in widespread attacks. We can see that the ransomware is applied as a final payload and two other malware (IcedID and Cobalt Strike) were applied before. In the wild, the ransomware was executed 4 hours later. The shortcuts are often used to execute DLLs and scripts via LOLBins. [B][COLOR=rgb(0, 168, 133)]SWH can block this attack on default settings at the delivery stage by blocking shortcuts in UserSpace. [/COLOR][/B][S]If one does not use disk images to install software, then the ISO file type can be blocked in SWH (Settings >> Protected SRP Extensions) to prevent the malware at the beginning of the infection chain[/S]. Edit. Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP. But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools. [/QUOTE]

Verification