Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1082494" data-attributes="member: 99014">More is needed than opening the attachment, the attachment advises users to download a password-protected (in the case of APT29) archive. I was looking to find out how this archive is magically dropped, unpacked and content is ran as SVG default handler is your default browser, which will most likely be a chromium-based solution. Turns out it is not!&nbsp;User then needs to unpack the archive and run a weird script which initiates a whole billion-step attack. This highly fragmented attack can be prevented in many ways:<ul>
<li data-xf-list-type="ul">Of course, with H_C or similar solution that prevents certain LOLBins from executing. In my case, the bat and vbs will fail to run.</li>
<li data-xf-list-type="ul">By refusing to look at this “invoice” as the email definitely won’t be the monthly email you get from your ISP or whatever</li>
<li data-xf-list-type="ul">By using sophisticated behavioural blocking as no AMSI bypass stage is implemented (according to the infection chain graphic). The whole execution process is extremely anomalous.</li>
<li data-xf-list-type="ul">By using software with threat emulation</li>
</ul></blockquote>

[QUOTE="Trident, post: 1082494, member: 99014"] More is needed than opening the attachment, the attachment advises users to download a password-protected (in the case of APT29) archive. I was looking to find out how this archive is magically dropped, unpacked and content is ran as SVG default handler is your default browser, which will most likely be a chromium-based solution. Turns out it is not! User then needs to unpack the archive and run a weird script which initiates a whole billion-step attack. This highly fragmented attack can be prevented in many ways: [LIST] [*]Of course, with H_C or similar solution that prevents certain LOLBins from executing. In my case, the bat and vbs will fail to run. [*]By refusing to look at this “invoice” as the email definitely won’t be the monthly email you get from your ISP or whatever [*]By using sophisticated behavioural blocking as no AMSI bypass stage is implemented (according to the infection chain graphic). The whole execution process is extremely anomalous. [*]By using software with threat emulation [/LIST] [/QUOTE]

Verification