Thread by @DTCERT

#Qakbot once again had some surprises 🎁 for us this week. See below for a brief overview of what we found. 🧵 1/6

First and foremost, #Qakbot seems to have departed from their usual use of LNK files to trigger execution. Instead they now present .vbs or .js files at the root folder of the disk image 💿. 🧵 2/6

This alone would not be significant, since we have observed 🔍 .js and .vbs files in Qakbots infection chain before. Now however these files also contain a signature that apparently bypasses Windows MotW / SmartScreen warnings. 🧵 3/6

It most likely comes as a response to Microsoft's recent patch that propagates MotW to mounted ISO/IMG virtual disks

https://twitter.com/BillDemirkapi/status/1590062146486140928

🧵 4/6

The malformed Authenticode signatures that #Qakbot is now using have first been seen as part of the #Magniber ransomware. Here is a good writeup that explains how these signatures seem to confuse SmartScreen: blog.0patch.com/2022/10/free-m… 🧵 5/6

Hopefully, Microsoft will fix this issue soon. Until then, security teams should pay special attention ⚠️ to .js and .vbs files run via wscript.exe from a virtual disk drive! 🧵 6/6