Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 989993" data-attributes="member: 32260">RunBySmartscreen vs. GuLoader[URL unfurl=&quot;true&quot;]https://www.fortinet.com/blog/threat-research/spoofed-saudi-purchase-order-drops-guloader[/URL][URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/new-chaos-ransomware-builder-variant-yashma-discovered-in-the-wild.113989/[/URL]GuLoader is delivered via EXE (NSIS) installer embedded in the ISO file, so it is a good example to show how RunBySmartscreen can help. This delivery method is pretty popular.Infection chain:Email with phishing URL ----&gt; ISO file downloaded via URL ----&gt; User opens ISO image ----&gt; User opens the file which is EXE malware instead expected PDF document.## Using RunBySmartscreen tool.Even if the ISO file is downloaded via Edge web browser, the SmartScreen will ignore it.After the ISO (optical disc image) file is downloaded the user opens it from the web browser and can see this:[ATTACH=full]266900[/ATTACH]At this moment (File Explorer opened) the RunBySmartscreen should be used. One has to use the mouse to right-click on the file to open the Explorer context menu and choose the &quot;Run By SmartScreen&quot; option (the user does not have to know what kind of file it is).&nbsp; This forces checking the EXE, MSI, COM, and SCR files by SmartScreen reputation - the safe executables are automatically executed. For other files, the info is displayed. The music files,&nbsp; photos, videos, etc. are automatically opened.In the case of the malicious EXE file (like in this example) the home user will see the well known SmartScreen alert:[ATTACH=full]266902[/ATTACH]Without RunBySmartscreen, the file embedded in the ISO file will be opened without SmartScreen check.See also another example of using RunBySmartscreen:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-980775[/URL]</blockquote>

[QUOTE="Andy Ful, post: 989993, member: 32260"] [B][SIZE=5]RunBySmartscreen vs. GuLoader[/SIZE][/B] [URL unfurl="true"]https://www.fortinet.com/blog/threat-research/spoofed-saudi-purchase-order-drops-guloader[/URL] [URL unfurl="true"]https://malwaretips.com/threads/new-chaos-ransomware-builder-variant-yashma-discovered-in-the-wild.113989/[/URL] GuLoader is delivered via EXE (NSIS) installer embedded in the ISO file, so it is a good example to show how RunBySmartscreen can help. This delivery method is pretty popular. Infection chain: Email with phishing URL ----> ISO file downloaded via URL ----> User opens ISO image ----> User opens the file which is EXE malware instead expected PDF document. [B]## Using RunBySmartscreen tool.[/B] Even if the ISO file is downloaded via Edge web browser, the SmartScreen will ignore it. After the ISO (optical disc image) file is downloaded the user opens it from the web browser and can see this: [ATTACH type="full" alt="1653421481446.png"]266900[/ATTACH] At this moment (File Explorer opened) the RunBySmartscreen should be used. One has to use the mouse to right-click on the file to open the Explorer context menu and choose the "Run By SmartScreen" option (the user does not have to know what kind of file it is). This forces checking the EXE, MSI, COM, and SCR files by SmartScreen reputation - the safe executables are automatically executed. For other files, the info is displayed. The music files, photos, videos, etc. are automatically opened. In the case of the malicious EXE file (like in this example) the home user will see the well known SmartScreen alert: [ATTACH type="full" alt="1653422670178.png"]266902[/ATTACH] Without RunBySmartscreen, the file embedded in the ISO file will be opened without SmartScreen check. See also another example of using RunBySmartscreen: [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-980775[/URL] [/QUOTE]

Verification