Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1072160" data-attributes="member: 32260">WHHLight vs. Phemedrone Stealer Campaign[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/information-stealer-exploits-windows-smartscreen-bypass.128384/#post-1072138[/URL][URL unfurl=&quot;false&quot;]https://www.trendmicro.com/en_us/research/24/a/cve-2023-36025-exploited-for-defense-evasion-in-phemedrone-steal.html[/URL]Attack flow (initial part of the attack):Cloud hosted malicious URL shortcut ---&gt; malicious CPL file executed via&nbsp; CVE-2023-36025 exploit ---&gt; PowerShell CmdLines download/execute secondary payloads ---&gt; .... ---&gt; Phemedrone StealerOn the unpatched Windows, the current WHHLight version blocks the attack via default SWH settings (CPL file is blocked).The attack could also be blocked at the next stage, because the default SWH settings block PowerShell CmdLines (crucial in the attack) by Constrained Language Mode (New-Object Net.WebClient). Furthermore, that particular attack could have been prevented by FirewallHardening (blocked outbound connections of PowerShell).REMARKThe exploit CVE-2023-36025 is already patched, so I removed the URL file extension from the default &quot;SRP File Types&quot;. I also added information in &quot;Paranoid Extensions&quot; about a non-typical way of adding the file extensions managed by DLLs:[ATTACH=full]280952[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 1072160, member: 32260"] [B]WHHLight vs. Phemedrone Stealer Campaign[/B] [URL unfurl="false"]https://malwaretips.com/threads/information-stealer-exploits-windows-smartscreen-bypass.128384/#post-1072138[/URL] [URL unfurl="false"]https://www.trendmicro.com/en_us/research/24/a/cve-2023-36025-exploited-for-defense-evasion-in-phemedrone-steal.html[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow (initial part of the attack):[/COLOR][/B] Cloud hosted malicious URL shortcut ---> malicious CPL file executed via CVE-2023-36025 exploit ---> PowerShell CmdLines download/execute secondary payloads ---> .... ---> Phemedrone Stealer On the [B]unpatched[/B] Windows, the current WHHLight version blocks the attack via default SWH settings (CPL file is blocked). The attack could also be blocked at the next stage, because the default SWH settings block PowerShell CmdLines (crucial in the attack) by Constrained Language Mode (New-Object Net.WebClient). Furthermore, that particular attack could have been prevented by FirewallHardening (blocked outbound connections of PowerShell). REMARK The exploit CVE-2023-36025 is already patched, so I removed the URL file extension from the default "SRP File Types". I also added information in "Paranoid Extensions" about a non-typical way of adding the file extensions managed by DLLs: [ATTACH type="full" alt="1705422464724.png"]280952[/ATTACH] [/QUOTE]

Verification