Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1075382" data-attributes="member: 32260">WHHLight vs. DarkMe (New SmartScreen bypass, patched in February 2024).[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/darkme-malware-targets-traders-using-microsoft-smartscreen-zero-day-vulnerability.128999/post-1075365[/URL][URL unfurl=&quot;false&quot;]https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html[/URL]The previous patch does not cover the attack when an Internet shortcut points to another Internet shortcut.Attack flow:Spearphishing link -----&gt; Compromised Server with Internet_shortcut1 on WebDav share&nbsp; ---&gt;&nbsp; Internet_shortcut1 points to another Internet_shortcut2&nbsp; -----&gt;&nbsp; Internet_shortcut2 downloads/runs CMD script&nbsp; -----&gt;&nbsp; malicious DLL downloaded and executed by LOLBin (RunDll32)&nbsp; ----&gt; DLL downloads and runs secondary payloadsThe attack can be prevented/mitigated as follows:<ol>
<li data-xf-list-type="ol">If &lt; WDAC &gt; is set to ON, the attack can be prevented because the WDAC policy in WHHLight blocks WebDav. Furthermore, any SmartScreen bypass based on skipping MOTW can only increase the WDAC ISG protection (ISG is more restrictive without the SmartScreen backend).</li>
<li data-xf-list-type="ol">WHHLight can fully mitigate this attack via SWH default settings (CMD script blocked).</li>
<li data-xf-list-type="ol">The attack can be fully mitigated by FirewallHardening (Recommended H_C settings), because the malicious DLL runs in the context of RunDLL32, and FirewallHardening settings block outbound connections of RunDLL32.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 1075382, member: 32260"] [B][SIZE=5]WHHLight vs. DarkMe (New SmartScreen bypass, patched in February 2024).[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/darkme-malware-targets-traders-using-microsoft-smartscreen-zero-day-vulnerability.128999/post-1075365[/URL] [URL unfurl="false"]https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html[/URL] The previous patch does not cover the attack when an Internet shortcut points to another Internet shortcut. [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR] Spearphishing link -----> Compromised Server with [B]Internet_shortcut1 on [/B]WebDav share ---> [COLOR=rgb(226, 80, 65)]Internet_shortcut1 points to another Internet_shortcut2[/COLOR] -----> [B]Internet_shortcut2 downloads/runs [/B]CMD script -----> malicious DLL downloaded and executed by LOLBin (RunDll32) ----> DLL downloads and runs secondary payloads[/B] The attack can be prevented/mitigated as follows: [LIST=1] [*]If < WDAC > is set to ON, the attack can be prevented because the WDAC policy in WHHLight blocks WebDav. Furthermore, any SmartScreen bypass based on skipping MOTW can only increase the WDAC ISG protection (ISG is more restrictive without the SmartScreen backend). [*]WHHLight can fully mitigate this attack via SWH default settings (CMD script blocked). [*]The attack can be fully mitigated by FirewallHardening (Recommended H_C settings), because the malicious DLL runs in the context of RunDLL32, and FirewallHardening settings block outbound connections of RunDLL32. [/LIST] [/QUOTE]

Verification