Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1074973" data-attributes="member: 32260">WHHLight vs. HijackLoader / IDAT Loader (attacks performed in Summer 2023)(Smart App Control set to OFF)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/hijackloader-evolves-researchers-decode-the-latest-evasion-methods.128881/post-1074714[/URL][URL unfurl=&quot;false&quot;]https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html[/URL][URL unfurl=&quot;false&quot;]https://www.crowdstrike.com/blog/hijackloader-expands-techniques/[/URL]Such attacks were done against institutions and organizations in Italy (not against home users). Anyway they include interesting attack vectors.Attack Flow (ClearFake)Compromised website ----&gt; browser fake update (APPX or EXE installer) ----&gt;&nbsp; HijackLoader[URL unfurl=&quot;false&quot;]https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/#h-malware-delivered-by-clearfake[/URL][URL unfurl=&quot;false&quot;]https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/[/URL]Attack Flow (TA544)[URL unfurl=&quot;false&quot;]https://yoroi.company/en/research/innovation-in-cyber-intrusions-the-evolution-of-ta544/[/URL][ATTACH=full]281483[/ATTACH]The first attack via the APPX file can be stopped by SWH default settings in WHHLight (AppInstaller is disabled, so APPX files are blocked).All samples of HijackLoader were unsigned or with malformed certificates so that SmartScreen could block them (as 0-day malware).In the second attack, the HijackLoader (Agenzia_Entrate_2023.exe) was loaded from the SMB share (no MOTW), so it is run without SmartScreen backend. As we know, this only triggers a more restrictive ISG check &amp; block.Finally, the second attack also uses the DLL hijacking method (properly signed legal EXE + DLL with malformed certificate) which can be blocked by WDAC ISG.If I would like to bypass the WHHLight, then the attack should look like this:Compromised website ---&gt; fake update ---&gt; HijackLoader (EXE or MSI file) properly signed with EV certificateNext, the attacker should additionally convince the user to bypass the WDAC, by using &#039;Run By SmartScreen&#039;.</blockquote>

[QUOTE="Andy Ful, post: 1074973, member: 32260"] [B][SIZE=5]WHHLight vs. HijackLoader / IDAT Loader (attacks performed in Summer 2023)[/SIZE] (Smart App Control set to OFF)[/B] [URL unfurl="false"]https://malwaretips.com/threads/hijackloader-evolves-researchers-decode-the-latest-evasion-methods.128881/post-1074714[/URL] [URL unfurl="false"]https://thehackernews.com/2024/02/hijackloader-evolves-researchers-decode.html[/URL] [URL unfurl="false"]https://www.crowdstrike.com/blog/hijackloader-expands-techniques/[/URL] Such attacks were done against institutions and organizations in Italy (not against home users). Anyway they include interesting attack vectors. [COLOR=rgb(184, 49, 47)][B]Attack Flow (ClearFake)[/B][/COLOR] [B]Compromised website ----> browser fake update (APPX or EXE installer) ----> HijackLoader[/B] [URL unfurl="false"]https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/#h-malware-delivered-by-clearfake[/URL] [URL unfurl="false"]https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/[/URL] [B][COLOR=rgb(184, 49, 47)]Attack Flow (TA544)[/COLOR][/B] [URL unfurl="false"]https://yoroi.company/en/research/innovation-in-cyber-intrusions-the-evolution-of-ta544/[/URL] [ATTACH type="full" alt="1707608444130.png"]281483[/ATTACH] The first attack via the APPX file can be stopped by SWH default settings in WHHLight (AppInstaller is disabled, so APPX files are blocked). All samples of HijackLoader were unsigned or with malformed certificates so that SmartScreen could block them (as 0-day malware). In the second attack, the HijackLoader (Agenzia_Entrate_2023.exe) was loaded from the SMB share (no MOTW), so it is run without SmartScreen backend. As we know, this only triggers a more restrictive ISG check & block. Finally, the second attack also uses the DLL hijacking method (properly signed legal EXE + DLL with malformed certificate) which can be blocked by WDAC ISG. If I would like to bypass the WHHLight, then the attack should look like this: [B]Compromised website ---> fake update ---> HijackLoader (EXE or MSI file) properly signed with EV certificate[/B] Next, the attacker should additionally convince the user to bypass the WDAC, by using 'Run By SmartScreen'. [/QUOTE]

Verification