Container File Abuse (ISO, IMG, LNK)

file.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3  (Internet)

1. Victim downloads: malware.iso (has MOTW)
2. Victim double-clicks ISO (Windows mounts as virtual drive)
3. Files INSIDE ISO → No MOTW!
4. payload.exe runs without any security warning

┌─────────────────────────────────────────────────────────────┐
│ EMAIL                                                        │
│                                                              │
│ Subject: Invoice #2024-1234                                  │
│ Attachment: Invoice_Details.iso (or .img)                    │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│ ISO FILE CONTENTS                                            │
│                                                              │
│ E:\                                                          │
│ ├── Invoice.lnk          ← Visible, looks like document      │
│ ├── payload.dll          ← Hidden file                       │
│ └── data.txt             ← Decoy content                     │
│                                                              │
│ Invoice.lnk executes:                                        │
│ rundll32.exe payload.dll,EntryPoint                          │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│ EXECUTION                                                    │
│                                                              │
│ - No MOTW on extracted files                                 │
│ - No SmartScreen warning                                     │
│ - No Protected View                                          │
│ - DLL executes immediately                                   │
└─────────────────────────────────────────────────────────────┘

Visible Properties:
  Target: Invoice.pdf
  Icon: PDF document icon

Actual Command:
  C:\Windows\System32\cmd.exe /c powershell -ep bypass -w hidden -e [BASE64]

Target: %ComSpec% /c calc.exe
       → Expands to C:\Windows\System32\cmd.exe /c calc.exe

Target: C:\Windows\System32\cmd.exe                    [256 spaces] /c malware.exe
                                                       ↑
                                               Truncated in properties UI

HTML attachment → Downloads ISO → Contains LNK + DLL
LNK runs: regsvr32.exe payload.dll

ISO file → Contains LNK disguised as document
LNK runs: rundll32.exe data.dll,update

ISO file → Contains LNK + hidden folder with loader
LNK runs: PowerShell downloads next stage

Pivoted from macros to ISO after 10-month hiatus
LNK files invoking regsvr32 → Later moved to OneNote

Return-Path: <invoice@supplier-invoices.com>
Received: from mail.supplier-invoices.com (mail.supplier-invoices.com [198.51.100.55])
        by mx.target.com (Postfix) with ESMTPS id ISO001
        for <accounts@target.com>; Thu, 30 Jan 2025 10:15:22 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=supplier-invoices.com; s=mail;
        h=from:to:subject:date;
        bh=container123...;
        b=isosig456...
Authentication-Results: mx.target.com;
        dkim=pass header.d=supplier-invoices.com;
        spf=pass smtp.mailfrom=invoice@supplier-invoices.com;
        dmarc=pass (p=REJECT) header.from=supplier-invoices.com
From: "Accounts Payable" <invoice@supplier-invoices.com>
To: accounts@target.com
Subject: Invoice #INV-2025-0130 - Payment Required
Date: Thu, 30 Jan 2025 10:15:18 -0500
Message-ID: <iso-delivery-001@supplier-invoices.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="container-boundary"

--container-boundary
Content-Type: text/plain; charset=UTF-8

Please find attached the invoice for January services.

Best regards,
Accounts Payable

--container-boundary
Content-Type: application/x-iso9660-image; name="Invoice-INV-2025-0130.iso"
Content-Disposition: attachment; filename="Invoice-INV-2025-0130.iso"
Content-Transfer-Encoding: base64

[Base64-encoded ISO containing LNK and malware]
--container-boundary--

Block attachments:
- *.iso, *.img, *.vhd, *.vhdx
- *.lnk (shortcuts in email = always suspicious)
- Nested: *.zip containing *.iso
- Password-protected containers

Computer Configuration → Administrative Templates →
Windows Components → File Explorer →
"Do not allow mounting of virtual disks" = Enabled

.one file with embedded VBS/HTA/BAT
User double-clicks "attachment" icon
Script executes without MOTW warning

HTML attachment → JavaScript constructs ISO blob
→ ISO downloaded locally (may bypass MOTW depending on browser)
→ User manually opens downloaded ISO

outer.zip (MOTW on ZIP)
└── inner.iso (might lose MOTW on extraction)
    └── payload.lnk → malware (no MOTW)

Email body: "Password: invoice2024"
Attachment: protected.zip
└── malware.iso
    └── payload

event.type = "file_mount"
AND file.extension IN ("iso", "img", "vhd")
AND source.path CONTAINS "Downloads" OR source.path CONTAINS "Outlook"

process.parent.name = "explorer.exe"
AND process.name IN ("powershell.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe")
AND process.command_line CONTAINS drive_letter
AND drive_letter.type = "mounted_iso"

process.parent.command_line CONTAINS ".lnk"
AND process.name IN ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe")