I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

It looks like the downloaded FlashPlayer.hta file is actually just a benign fluke, and I’m hoping that it can’t be executed post detection – but we haven’t tried to execute the downloaded file, or to run the HTML app from the fake download page. And we also have several open threads where these fake update HTML apps aren’t being detected as malware on older versions of Windows – so I'm hoping that people have generally wised up to these fake updates and know enough to just close the page when it pops up.

Earlier versions of the FlashPlayer.hta file were “double-downloaders” that first launched a PowerShell script to download and lunch an encrypted JavaScript file (intermediate payload). The intermediate payload then launched an encoded PowerShell script that used shellcode to download and launch a final payload. So this is potentially a complex threat.

But since this thread was “escalated” by bhringer yesterday, we’ll need to concentrate on the dual issues of connecting to compromised domains on the supply side, and the issues with Defender’s processing of real-time detections on the delivery side (which now appears to be a general issue):

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/is-trojanjsflafisid-from-windows-10-defender-it/f0d42e70-7e7c-4d58-8941-6fd3ceb471d9

GreginMich

You sure that issue with the apparent inconsistent operation of Defender during download isn't just the obvious race condition that's always existed when using SmartScreen along with Defender?

This situation has always created interesting anomalies when the automatic operations performed by SmartScreen that hand off malicious file detection processes to Defender interact with those which happen seconds later as either the user's actions or Defender's automated filing system operations cause a potential second trigger.

This means that in some cases, the earlier events related to SmartScreen have already snatched the file itself from the user or Defender before it can actually be seen, often leaving a zero-filled file placeholder that's either locked (quarantine) or empty (corrupted).

This is nothing new and hasn't changed significantly since the early days of MSE, though there's likely been minor changes in the way these errors are displayed due to either filing system or other process changes to either SmartScreen or Defender themselves.  Since Defender has always seemed to be unaware that it's already processing the same file, I assume that's because it's specifically performing these operations in isolated processes, possibly to allow the most effective and fastest process to "win" regardless which one this might be.

As for the compromised domains, we already knew (which that article confirms) that the creation and so pace of change for these had exceeded that for any existing manual system to keep up with a few years ago.  This implies that protection needs to be either proactive (ad blocking) or handle this by blocking the false pages within the browser itself, before the malware content can become an issue.

How to identify a good page from a bad page is the problem with the latter, since it's typically a matter of the content, which is what this particular detection appears to be focused on as relates to the malicious JavaScript it contains.

Rob

Windows Defender SmartScreen is always turned off for this kind of testing, since it would otherwise block access to the eicar download. Could it have caused this issue had it been turned on? Most likely not.

I don’t have time to argue that it’s possible to break a malvertising supply chain, but it happens quite frequently; and it should be a major concern for any website that wants a “safe site” reputation.

OK, I just turned Windows Defender SmartScreen back on and retested; and now I have to correct myself. SmartScreen doesn’t block the eicar.com download – it merely allows the download of a 0 bytes eicar.com file:

And then it leaves its message in place when I switch back to the forum site:

GreginMich

OK, that's something I didn't see you state in your testing above, but I suspect that since SmartScreen is now integrated within Windows 10 it may not truly be possible to fully disable it's operation, though I don't really care either.

Breaking a malvertising chain has always been done by a major operation like Microsoft in cooperation with others, typically including international law enforcement.  With Microsoft providing the data required to identify the true perpetrators, as well as any C&C or other server resources when those are involved.  That's what Microsoft always does in these cases, while many run around dealing with peripheral effects as the investigation and data collection continues.

That's why I always take the workaround direction and ignore the noise, since those who don't know how to protect themselves might actually get successfully attacked during the typical delay that occurs.

As I stated above, nothing new other than a different type of detection for a new snippet of JavaScript likely relating to a new vulnerability.  We may learn something more about this tomorrow when the updates release.

Rob

Nothing new if you keep your eyes closed. Otherwise we have a malvertising issue on MSN webpages, and one that doesn’t leverage exploits according to the latest available analysis. And also a totally bizzare blocking behavior by both Windows Defender Antivirus and Windows Defender SmartScreen.

GreginMich