Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1074349" data-attributes="member: 32260">WHHLight vs. SmartScreen bypass via the URL shortcut(Smart App Control set to OFF)The bypass was patched by Microsoft a few months ago. The articles refer to the samples haunted before this patch.[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/new-mispadu-banking-trojan-exploiting-windows-smartscreen-flaw.128818/post-1074333[/URL]Attack flow:URL shortcut ----&gt; malicious file downloaded without MOTW&nbsp; (SmartScreen bypass) ----&gt; file is executed without SmartScreen checkWithout the bypass, the file would be downloaded with MOTW (Mark of the Web), and the file could be executed with SmartScreen check.It is worth noting, that this bypass is not a bypass of Forced SmartScreen implemented in Hard_Configurator and WHHLight.In the H_C Recommended Settings, the file will be initially blocked, and the user must use &quot;Install By SmartScreen&quot; to run the downloaded file. But then, the custom MOTW is always added to the file and the file is executed with SmartScreen check.In WHHLight the file will be executed first without SmartScreen check. However, in WHHLight the SmartScreen is used as a smart whitelisting method for WDAC ISG. So, this SmartScreen bypass will always increase the protection level of WHHLight. The file will be blocked, so the user will apply &quot;Run By SmartScreen&quot; to manually bypass the WDAC ISG block. As in the case of H_C, the MOTW is always added to the file and the file will be checked by SmartScreen.</blockquote>

[QUOTE="Andy Ful, post: 1074349, member: 32260"] [B][SIZE=5]WHHLight vs. SmartScreen bypass via the URL shortcut[/SIZE] (Smart App Control set to OFF)[/B] The bypass was patched by Microsoft a few months ago. The articles refer to the samples haunted before this patch. [URL unfurl="true"]https://malwaretips.com/threads/new-mispadu-banking-trojan-exploiting-windows-smartscreen-flaw.128818/post-1074333[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR] URL shortcut ----> malicious file downloaded without MOTW (SmartScreen bypass) ----> file is executed without SmartScreen check[/B] Without the bypass, the file would be downloaded with MOTW (Mark of the Web), and the file could be executed with SmartScreen check. It is worth noting, that this bypass is not a bypass of Forced SmartScreen implemented in Hard_Configurator and WHHLight. In the H_C Recommended Settings, the file will be initially blocked, and the user must use "Install By SmartScreen" to run the downloaded file. But then, the custom MOTW is always added to the file and the file is executed with SmartScreen check. In WHHLight the file will be executed first without SmartScreen check. However, in WHHLight the SmartScreen is used as a smart whitelisting method for WDAC ISG. So, this SmartScreen bypass will always increase the protection level of WHHLight. The file will be blocked, so the user will apply "Run By SmartScreen" to manually bypass the WDAC ISG block. As in the case of H_C, the MOTW is always added to the file and the file will be checked by SmartScreen. [/QUOTE]

Verification