Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 995210" data-attributes="member: 32260">SWH vs. AstraLocker attack[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/astralocker-2-0-infects-users-directly-from-word-attachments.114578/#post-995130[/URL][URL unfurl=&quot;true&quot;]https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs[/URL]The attack is very primitive and well known. I doubt if such malware could infect the users under the protection of any popular AV. Anyway, it shows the method used a few years ago quite often.The malware uses the well known method to weaponize MS Word documents via embedding the malicious executable directly into the document (OLE method). This method is uncommon in the wild nowadays, because the user must click on the icon in the document and next allow to run the file:[ATTACH=full]267802[/ATTACH]The infection chain:Email attachment (Word document) ----&gt; user opens the document and clicks the icon (OLE) -----&gt; user presses Run button ---&gt; malware is executedThe malware is blocked by SWH 2.0.0.0 recommended settings:<ol>
<li data-xf-list-type="ol">No ConfigureDefender HIGH Protection Level: malware blocked after MS Office hardening via DocumentsAntiExploit tool.</li>
<li data-xf-list-type="ol">Defender + ConfigureDefender HIGH Protection Level: malware blocked by ASR rule.</li>
</ol>The malware is also blocked by default in Microsoft Office 365.</blockquote>

[QUOTE="Andy Ful, post: 995210, member: 32260"] [B][SIZE=5]SWH vs. AstraLocker attack[/SIZE][/B] [URL unfurl="true"]https://malwaretips.com/threads/astralocker-2-0-infects-users-directly-from-word-attachments.114578/#post-995130[/URL] [URL unfurl="true"]https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs[/URL] The attack is very primitive and well known. I doubt if such malware could infect the users under the protection of any popular AV. Anyway, it shows the method used a few years ago quite often. The malware uses the well known method to weaponize MS Word documents via embedding the malicious executable directly into the document (OLE method). This method is uncommon in the wild nowadays, because the user must click on the icon in the document and next allow to run the file: [ATTACH type="full" alt="1656686923905.png"]267802[/ATTACH] The infection chain: [COLOR=rgb(0, 168, 133)][B]Email attachment (Word document) ----> user opens the document and clicks the icon (OLE) -----> user presses Run button[/B][/COLOR] --->[COLOR=rgb(184, 49, 47)][B] malware is executed[/B][/COLOR] The malware is blocked by SWH 2.0.0.0 recommended settings: [LIST=1] [*]No ConfigureDefender HIGH Protection Level: malware blocked after MS Office hardening via DocumentsAntiExploit tool. [*]Defender + ConfigureDefender HIGH Protection Level: malware blocked by ASR rule. [/LIST] The malware is also blocked by default in Microsoft Office 365. [/QUOTE]

Verification