SANS Stormcast

I detected an interesting phishing email this morning. It targets a major Belgian bank:

[This is a Guest Diary by Adam Nason, an ISC intern as part of the SANS.edu BACS program]

[This is a guest diary submitted by Varun Murdula]

Yesterday, a reader reported to us a malicious ZIP archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094[1]). Once unzipped, it contains a VHDX file that discloses a malicious JavaScript after being mounted (which is automatic on modern Windows OSs):

I like it when a fellow handler posts a diary entry about images with malicious content. Last one is Xavier: "The Evil MSI Background is Back!".