VHDX Containers Help Malware Slip Past First-Line Defenses
A malicious ZIP can get past the first pass because the dangerous code does not show up until Windows auto-mounts the VHDX inside it. The handoff then uses WMI to start PowerShell, which looks less like a direct script-to-shell launch and can evade the parent-child rules many defenders depend on.
SANS says the sample hid a JavaScript loader inside the mounted disk image, then used obfuscation and a WMI-to-PowerShell chain to stage Remcos. The report says the disk-image trick and the launch path together help bypass email scanning, file scanning, and simple process-lineage detections.
The pattern is old, but the packaging matters. If attackers keep reusing auto-mounted disk images as a container, defenders may see the later stages first and miss the delivery path that matters most.