Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1001945" data-attributes="member: 32260">This year, Microsoft decided to block by default the macros in MS Office documents downloaded from the Internet. Although this mitigation can be overcome by the attackers, it also caused an increase in other attack vectors like using archives with shortcuts combined with DLL hijacking. One of the examples is the recently discovered campaign of BRONZE PRESIDENT:[URL unfurl=&quot;false&quot;]https://www.secureworks.com/blog/bronze-president-targets-government-officials[/URL]The infection chain:Phishing email ----&gt; RAR archive downloaded and unpacked by the user&nbsp; ---&gt; LNK file (masqueraded as PDF or DOCX) + hidden folder with payloads ---&gt; user opens LNK file ---&gt; DLL hijacking is startedThis attack method creates a legal process without child processes, so it can fool any protection based on monitoring EXE files and their child processes (some AVs use HIPS rules based on parent-child restrictions). Also, the protections based on the EXE file reputation lookup and many cloud sandboxes can be bypassed in this way.The user can see only something that looks like a document.[ATTACH=full]269056[/ATTACH]The RAR archive is required to fool the mail-scanning protection by using several subfolders with special characters.The shortcut file (NV 309-2022 HMA&#039;s departure.pdf.lnk) starts the DLL hijacking attack. The legal EXE (Opera.exe renamed to test.chm), malicious DLL, and another encrypted payload are located in the hidden folder with several subfolders:[ATTACH=full]269058[/ATTACH]Nowadays, this kind of attack via DLL hijacking can be easily used in widespread attacks on the home users.</blockquote>

[QUOTE="Andy Ful, post: 1001945, member: 32260"] This year, Microsoft decided to block by default the macros in MS Office documents downloaded from the Internet. Although this mitigation can be overcome by the attackers, it also caused an increase in other attack vectors like using archives with shortcuts combined with DLL hijacking. One of the examples is the recently discovered campaign of BRONZE PRESIDENT: [URL unfurl="false"]https://www.secureworks.com/blog/bronze-president-targets-government-officials[/URL] The infection chain: Phishing email ----> RAR archive downloaded and unpacked by the user ---> LNK file (masqueraded as PDF or DOCX) + hidden folder with payloads ---> user opens LNK file ---> DLL hijacking is started This attack method creates a legal process without child processes, so it can fool any protection based on monitoring EXE files and their child processes (some AVs use HIPS rules based on parent-child restrictions). Also, the protections based on the EXE file reputation lookup and many cloud sandboxes can be bypassed in this way. The user can see only something that looks like a document. [ATTACH type="full" alt="1662762034704.png"]269056[/ATTACH] The RAR archive is required to fool the mail-scanning protection by using several subfolders with special characters. The shortcut file (NV 309-2022 HMA's departure.pdf.lnk) starts the DLL hijacking attack. The legal EXE (Opera.exe renamed to test.chm), malicious DLL, and another encrypted payload are located in the hidden folder with several subfolders: [ATTACH type="full" alt="1662762358193.png"]269058[/ATTACH] Nowadays, this kind of attack via DLL hijacking can be easily used in widespread attacks on the home users. [/QUOTE]

Verification