Reply to thread

Message: <blockquote data-quote="Andy Ful" data-source="post: 1075857" data-attributes="member: 32260">WHHLight vs. Signed Malware(Smart App Control set to OFF)In WHHLight, the default WDAC settings are focused on blocking an initial EXE/MSI malware downloaded/executed by the user. The execution is often done with the SmartScreen backend and in most cases WDAC ISG allows files accepted by SmartScreen (even if the same files are blocked by WDAC ISG without SmartScreen backend).There is an important question: How effective can be SmartScreen against initial EXE/MSI malware?The answer is not easy because most EXE samples are not initial malware but payloads. Initial malware samples are more frequently signed compared to payloads. The unsigned malware has close to 0 chances to get a positive SmartScreen reputation. The signed files can get it via a highly reputable certificate.Attack flow:malspam ---->  email attachment ----> user opens an attachment and executes GuLoader (EXE file)  ---->  GuLoader downloads/executes payloadsGuLoader examples from the past:[URL unfurl="tfalse"]https://asec.ahnlab.com/en/55978/[/URL][URL unfurl="false"]https://www.crowdstrike.com/blog/guloader-malware-analysis/[/URL][URL unfurl="false"]https://www.trellix.com/blogs/research/guloader-the-nsis-vantage-point/[/URL]The attack can be easily stopped by WDAC ISG when the file does not have a Mark of the Web (MotW), because the SmartScreen backend is not triggered. In such a case ISG uses a very restrictive reputation. In another case (EXE file with MotW), ISG will use the SmartScreen reputation, and malware signed with a highly reputable certificate can bypass WDAC ISG.In my test, I chose the recent samples of GuLoader malware. It is used often as an initial malware to download/execute well-known malware (Remcos, Agent Tesla, Formbook, Lokibot, NanoCore, and more).I was surprised because 75% of GuLoader samples (35 total samples from February 2024) were digitally signed. Another surprise was that all samples were blocked by SmartScreen (when MotW was added by me) and by WDAC ISG (files with or without MotW).I checked the certificates. Each sample used a different certificate and all certificates were fake.Conclusion.The default WDAC ISG settings in WHHLight can be very efficient in blocking EXE malware (also digitally signed) used in widespread attacks.It does not mean that similarly high efficiency will be for highly targeted attacks on Enterprises, because of using highly reputable certificates.Edit.After adding 24 new samples, the result did not change much (59 total samples, 78% signed, all blocked, all signed with fake certificates).</blockquote>

Verification

Top