Does it mean that when you run the original (not copied) WHHLight there is no UAC prompt?
WHHLight - simplified application control for Windows Home and Pro.
- Thread starter Andy Ful
- Start date
- Featured
Does it mean that when you run the original (not copied) WHHLight there is no UAC prompt?
A
Azazel
Since all the MS "Smart" stuff sounds familiar (at least in some way for me) it looks like this for you?
A
Azazel
I can see three possibilities:
- The WHHLight executable has got somehow a persistent positive reputation mark. On my computer, this is a case with ver. 1.0.0.8.
- Some other security interferes with WHHLight.
- The Windows built-in WDAC is spoiled in your system.
Do not run the file, but open its location in Explorer. Right-click on the file, choose Properties, tick the Unblock, and press OK.
Right-click on the file, again and choose Properties. You should see the file Properties without Unblock option:
Run the file H_C_2200(x64).exe. It should be blocked.
Last edited:
A
Azazel
A
Azazel
WHHLight vs. Raspberry Robin
(Smart App Control set to OFF)
https://malwaretips.com/threads/ras...ccess-to-windows-exploits.128932/post-1074940
https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
The attack was dangerous due to exploiting the vulnerability that allows a local attacker to escalate privileges to SYSTEM (Local Privilege Escalation). The exploit was sold on Dark Web forums several months before Microsoft and CISA released an advisory on active exploitation.
But in this post, I focus on the initial phase of the attack to show how WHHLight could prevent the attack in the wild.
Attack flow:
Such attacks via EXE files can be blocked when < WDAC > = ON in WHHLight.
The OleView.exe is a benign executable so it will be allowed by SmartScreen and WDAC ISG. But, the malicious DLL side-loading can be blocked by WDAC ISG.
Edit.
It is worth mentioning that DLL hijacking (0-day malware) can be a challenge for Microsoft Defender, even in MAX settings. The ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" does not cover this attack vector.
(Smart App Control set to OFF)
https://malwaretips.com/threads/ras...ccess-to-windows-exploits.128932/post-1074940
https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
The attack was dangerous due to exploiting the vulnerability that allows a local attacker to escalate privileges to SYSTEM (Local Privilege Escalation). The exploit was sold on Dark Web forums several months before Microsoft and CISA released an advisory on active exploitation.
But in this post, I focus on the initial phase of the attack to show how WHHLight could prevent the attack in the wild.
Attack flow:
Such attacks via EXE files can be blocked when < WDAC > = ON in WHHLight.
The OleView.exe is a benign executable so it will be allowed by SmartScreen and WDAC ISG. But, the malicious DLL side-loading can be blocked by WDAC ISG.
Edit.
It is worth mentioning that DLL hijacking (0-day malware) can be a challenge for Microsoft Defender, even in MAX settings. The ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" does not cover this attack vector.
Last edited:
WHHLight vs. Coyote Trojan
(Smart App Control set to OFF)
malwaretips.com
securelist.com
Attack flow:
The new aspects of the attack start after malicious DLL side-loading. The hashes of DLLs used in the attacks are included in the Securelist article. But, the initial malware (malicious Squirrel Installer) is skipped. Anyway, I found a few initial malware files on the VitusTotal:
9c6fc9e0854eaf5a0720caab1646f48c7992f6f4051438004598af89102a49eb
096d7765f278bb0de33fbfa0a15413a2432060d09c99f15c6ca900a6a8a46365
aedffb9cf780bb52c68586ceb238fcaf90253524f06a4a338edc6437409e51c5
3cbc282c6a51edff4e762267332e1ff2a503f7ba8a7b2a10c9ff404a7bda913b
All samples are unsigned and can be blocked by SmartScreen and WDAC ISG ( < WDAC > option must be set to ON).
(Smart App Control set to OFF)
New Coyote Trojan Targets 61 Brazilian Banks with Nim-Powered Attack
Sixty-one banking institutions, all of them originating from Brazil, are the target of a new banking trojan called Coyote. "This malware utilizes the Squirrel installer for distribution, leveraging Node.js and a relatively new multi-platform programming language called Nim as a loader to...
malwaretips.com
Coyote: A multi-stage banking Trojan abusing the Squirrel installer
We will delve into the workings of the infection chain and explore the capabilities of the new Trojan that specifically targets users of more than 60 banking institutions, mainly from Brazil.
securelist.com
Attack flow:
The new aspects of the attack start after malicious DLL side-loading. The hashes of DLLs used in the attacks are included in the Securelist article. But, the initial malware (malicious Squirrel Installer) is skipped. Anyway, I found a few initial malware files on the VitusTotal:
9c6fc9e0854eaf5a0720caab1646f48c7992f6f4051438004598af89102a49eb
096d7765f278bb0de33fbfa0a15413a2432060d09c99f15c6ca900a6a8a46365
aedffb9cf780bb52c68586ceb238fcaf90253524f06a4a338edc6437409e51c5
3cbc282c6a51edff4e762267332e1ff2a503f7ba8a7b2a10c9ff404a7bda913b
All samples are unsigned and can be blocked by SmartScreen and WDAC ISG ( < WDAC > option must be set to ON).
Last edited:
A
Azazel
WHHLight vs. DarkMe (New SmartScreen bypass, patched in February 2024).
https://malwaretips.com/threads/dar...en-zero-day-vulnerability.128999/post-1075365
https://www.trendmicro.com/en_us/re...-targets-traders-with-windows-defender-s.html
The previous patch does not cover the attack when an Internet shortcut points to another Internet shortcut.
Attack flow:
Spearphishing link -----> Compromised Server with Internet_shortcut1 on WebDav share ---> Internet_shortcut1 points to another Internet_shortcut2 -----> Internet_shortcut2 downloads/runs CMD script -----> malicious DLL downloaded and executed by LOLBin (RunDll32) ----> DLL downloads and runs secondary payloads
The attack can be prevented/mitigated as follows:
https://malwaretips.com/threads/dar...en-zero-day-vulnerability.128999/post-1075365
https://www.trendmicro.com/en_us/re...-targets-traders-with-windows-defender-s.html
The previous patch does not cover the attack when an Internet shortcut points to another Internet shortcut.
Attack flow:
Spearphishing link -----> Compromised Server with Internet_shortcut1 on WebDav share ---> Internet_shortcut1 points to another Internet_shortcut2 -----> Internet_shortcut2 downloads/runs CMD script -----> malicious DLL downloaded and executed by LOLBin (RunDll32) ----> DLL downloads and runs secondary payloads
The attack can be prevented/mitigated as follows:
- If < WDAC > is set to ON, the attack can be prevented because the WDAC policy in WHHLight blocks WebDav. Furthermore, any SmartScreen bypass based on skipping MOTW can only increase the WDAC ISG protection (ISG is more restrictive without the SmartScreen backend).
- WHHLight can fully mitigate this attack via SWH default settings (CMD script blocked).
- The attack can be fully mitigated by FirewallHardening (Recommended H_C settings), because the malicious DLL runs in the context of RunDLL32, and FirewallHardening settings block outbound connections of RunDLL32.
Last edited:
Where is the issue? This is a default Windows setting, but applied as a system-wide Administrator policy. You can also choose the SmartScreen Block setting in WHHLight.
WHHLight only prevents the user from turning OFF the SmartScreen.
A
Azazel
In DefenderUI I set Smartscreen to user and reverts to warn.
Specifically everytime I launch whhlight.
Specifically everytime I launch whhlight.
So do not change the "Warn" setting and everything will be OK.
A
Azazel
Such a possibility is disabled intentionally in WHHLight. The 'User' setting means that the application accepts the settings applied via Windows Security Center. So, it will also accept the OFF setting applied via Security Center. The OFF setting complicates the behavior of the WHHLight protection.
Why do you prefer the 'User' setting? Do you disable SmartScreen when using the computer?
A
Azazel
No, I do not disable smartscreen. But I like my system to be configurable through Windows Security Center.
Gandalf_The_Grey
Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Forum Veteran
The problem is that "warn" differs from "user" that was set by the high settings of ConfigureDefender, that causes some confusion.
You may also like...
-
-
Testing Windows Hybrid Hardening (new hardening application).
- Started by Andy Ful
- Replies: 253
-
Windows 11 Home OEM + Office 2021 Pro Plus OEM Bundle €23.80- Started by Brownie2019
- Replies: 4
-
Soft Organizer Pro from Chemtable for Free - Uninstall applications- Started by BigWrench
- Replies: 9
-
Windows 11 25H2/24H2 get 1000 Hz+ refresh rate support, File Explorer improvements, and more- Started by Parkinsond
- Replies: 9