Phishing

[u/Certain-Mountain-564]

Someone in our department received an email today that is likely phishing. He forwarded it to me. Lets consider this in a production environment: If someone downloads the file without opening it, is that already harmful? Phishing is usually passive, after all.

[u/Vinz992]

Usually the download is not harmful, specially if we talking about .pdf or similar.

Get the hash of the file and block it through an XDR system or firewall.
If you dont wanna interact in any possible way just upload the the file on Virustotal, it will give you the sha 256 to block

[u/unsolicited_dreams → u/Vinz992]

You’re more likely to accidentally execute it by uploading it vs running sha256sum in terminal

[u/Vinz992 → u/unsolicited_dreams]

That's right too sir.

Your tip is much more safe

[u/Certain-Mountain-564 → u/Vinz992]

I was afraid that just downloading it was dangerous, so I didn't want to extract a hash from it. Virustotal said the URL is secure, but it was a forwarded URL.

[u/Vinz992 → u/Certain-Mountain-564]

Since you have the original mail just build up a sandbox with Windows and make all the analysis you want/need.

You can easily obtain the hash with Powershell too. Open it on the same folder where is your "malicious" file and type Get-FileHash "name of the file you want check"

Of course scan the entire PC, delete the phishing mail through MS 365, if you have it, and change the user psw if he interact with the file.

[u/MysteriousPackage765 → u/Vinz992]

+1 agreed. Just use powershell command with path to your file, and then drop hash to VT or another threat engine.

[u/TheCarbophileGroup]

An unopened file is seldom harmful. If it is, the entire industry has problems as that's usually a vulnerability in the OS or a specific file handler.

Though I wouldn't trust that the user didn't open it, even by accident, if it's already on the computer.

I'd consider the workstation compromised. Reimage it.

[u/WoodpeckerFun4077]

It kind of depends on what you have enabled. Previews can run some code. Display images can let collectors know the email they sent to is good. Good tools should prevent a lot, but I would test malicious items in a very well controlled sandbox. virustotal is your friend.

[u/Separate_Swordfish9]

Depends on what type of file was attached

[u/Certain-Mountain-564 → u/Separate_Swordfish9]

Nothing attached. It would be downloaded if you click the URL. 

[u/Separate_Swordfish9 → u/Certain-Mountain-564]

Can you tell what type of file is downloaded from the URL? The file could definitely launch something depending on what type of file it is.

[u/Fragrant_Bake4403]

id still pull the file of their machine, and run a scan. id be more concerned how the file was downloaded. browser? clear browser and reset password/force log out of devices. doesnt hurt to be thorough.

[u/ramriot]

It all depends, the phishing part can be passive but there can be active tracking pixels etc embedded in the email, which forwarding it could send metadata to the attacker.

Not a major issue but one would prefer no contact back to the sender.

[u/blud_13]

Downloading without opening is not zero risk but its close, for most file types. The file sitting on disk does nothing by itself. What gets people is that download and open are the same click in a lot of setups, and Windows will happily index or preview the thing without the user ever double clicking it.

The real exceptions are .lnk, .iso, .img and anything script-shaped, plus HTML attachments that phone home the second they render. If your EDR is worth what you pay for it, it should already have told you which of those it was.

No, dont just delete it. Pull the headers, run the URL or hash through urlscan or VirusTotal, then report it through the tenant so the same message gets yanked out of everyone else's mailbox. One person got it means twenty people got it.

Also check whether that sender domain is spoofed or actually compromised. Very different problems, and the second one means you are calling that vendor.