Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1071588" data-attributes="member: 32260">WHHLight vs. AppInstaller[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/microsoft-disables-msix-protocol-handler-abused-in-malware-attacks.127972/[/URL][URL unfurl=&quot;false&quot;]https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/[/URL]The original attacks were performed by abusing the ms-appinstaller protocol handler. This method is now patched - Microsoft disabled that protocol by default.Anyway, a similar attack can be performed without using ms-appinstaller:Malicious URL or email attachment (ZIP, ISO, etc.) ---&gt; malicious MSIX package (digitally signed)&nbsp; ---&gt; AppInstaller runs malware from the MSIX package.SWH default settings in WHHLight block AppInstaller.[ATTACH=full]280828[/ATTACH]The blocked event can be seen in the EventViewer (System, Id = 10010).In WHHLight the APPX and MSIX packages are blocked by Exploit Protection and not by SRP. The ExploitProtection method allows the installation of UWP apps and desktop apps from Microsoft Store. The SRP method (used in H_C and SimpleWindowsHaredening) is more restrictive and allows only UWP apps from Microsoft Store.</blockquote>

[QUOTE="Andy Ful, post: 1071588, member: 32260"] [B][SIZE=5]WHHLight vs. AppInstaller[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/microsoft-disables-msix-protocol-handler-abused-in-malware-attacks.127972/[/URL] [URL unfurl="false"]https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/[/URL] The original attacks were performed by abusing the ms-appinstaller protocol handler. This method is now patched - Microsoft disabled that protocol by default. Anyway, a similar attack can be performed without using ms-appinstaller: [B]Malicious URL or email attachment (ZIP, ISO, etc.) ---> malicious MSIX package (digitally signed) ---> AppInstaller runs malware from the MSIX package.[/B] SWH default settings in WHHLight block AppInstaller. [ATTACH type="full" alt="1704972680574.png"]280828[/ATTACH] The blocked event can be seen in the EventViewer (System, Id = 10010). [COLOR=rgb(0, 168, 133)][B]In WHHLight the APPX and MSIX packages are blocked by Exploit Protection and not by SRP. [/B][/COLOR]The ExploitProtection method allows the installation of UWP apps and desktop apps from Microsoft Store. The SRP method (used in H_C and SimpleWindowsHaredening) is more restrictive and allows only UWP apps from Microsoft Store. [/QUOTE]

Verification