Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1073746" data-attributes="member: 32260">WHHLight vs. Ars Technica campaign.[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/ars-technica-used-in-malware-campaign-with-never-before-seen-obfuscation.128722/post-1073729[/URL][URL unfurl=&quot;false&quot;]https://arstechnica.com/security/2024/01/ars-technica-used-in-malware-campaign-with-never-before-seen-obfuscation/[/URL]Update February 2024:[URL unfurl=&quot;true&quot;]https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware[/URL]In this post, I will focus on the early stages of the infection flow (malware&#039;s new features will not be visible). The initial attack vector is very popular and the Ars Technica campaign is one of many examples.Attack flow (initial part):The user opens a shortcut from the infected flash drive&nbsp; ----&gt;&nbsp; the shortcut runs a PS1 script hidden on the flash drive&nbsp; ----&gt;&nbsp; the script decrypts and manages intermediate payloads&nbsp;&nbsp; ----&gt;&nbsp; EMPTYSPACE downloader is dropped and executedThe default SWH settings in WHHLight prevent the attack by blocking LNK shortcuts in UserSpace. Furthermore, if the shortcut was skipped in the attack, the PS1 script would be blocked anyway.Unfortunately, I could not find the PS1 samples, so I am not sure if the Powershell Constrained Language restrictions could prevent the script from creating intermediate payloads (decryption methods are usually blocked).Update February 2024:&nbsp; The recent code of explorer.ps1 can be found in the Madiant article. It uses the invocation method&nbsp; [System.Text.encoding]::UTF8.getstring(), which is blocked by Constrained Language mode.&nbsp; So, the script cannot even decode its active content and the attack fails. Full attack flow:[ATTACH=full]281285[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 1073746, member: 32260"] [B][SIZE=5]WHHLight vs. Ars Technica campaign.[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/ars-technica-used-in-malware-campaign-with-never-before-seen-obfuscation.128722/post-1073729[/URL] [URL unfurl="false"]https://arstechnica.com/security/2024/01/ars-technica-used-in-malware-campaign-with-never-before-seen-obfuscation/[/URL] Update February 2024: [URL unfurl="true"]https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware[/URL] In this post, I will focus on the early stages of the infection flow (malware's new features will not be visible). The initial attack vector is very popular and the Ars Technica campaign is one of many examples. [B][COLOR=rgb(184, 49, 47)]Attack flow [/COLOR][COLOR=rgb(0, 168, 133)](initial part)[/COLOR][COLOR=rgb(184, 49, 47)]:[/COLOR] [COLOR=rgb(0, 168, 133)]The user opens a shortcut from the infected flash drive ----> the shortcut runs a PS1 script hidden on the flash drive[/COLOR] ----> the script decrypts and manages intermediate payloads ----> EMPTYSPACE downloader is dropped and executed[/B] The default SWH settings in WHHLight prevent the attack by blocking LNK shortcuts in UserSpace. Furthermore, if the shortcut was skipped in the attack, the PS1 script would be blocked anyway. Unfortunately, I could not find the PS1 samples, so I am not sure if the Powershell Constrained Language restrictions could prevent the script from creating intermediate payloads (decryption methods are usually blocked). [B][COLOR=rgb(184, 49, 47)]Update February 2024[/COLOR][/B]: The recent code of explorer.ps1 can be found in the Madiant article. It uses the invocation method [System.Text.encoding]::UTF8.getstring(), which is blocked by Constrained Language mode. So, the script cannot even decode its active content and the attack fails. [B]Full attack flow:[/B] [ATTACH type="full" alt="1706701745479.png"]281285[/ATTACH] [/QUOTE]

Verification