Zone.Identifier ADS Deletion

A defense-evasion technique to remove the "Downloaded from Internet" mark from a freshly downloaded file. Windows appends an Alternate Data Stream (ADS) named Zone.Identifier to files fetched from the internet, marking them with zone ID 3 (Internet). Many sandboxes and EDR products use this ADS as a signal of untrusted origin. The dropper constructs the ADS path (%s:Zone.Identifier) and deletes it via DeleteFileW before executing the payload.

Detection / Fingerprint

• Wide-char string %s:Zone.Identifier in .rdata
• Sequence: CreateFileW → WriteFile → _snwprintf formatting Zone.Identifier path → DeleteFileW
• No other ADS manipulation observed in these samples

Observed In

• phorpiex campaign thin MSVC9 droppers ^[/intel/analyses/2ffc320332ff30d80c0a1da728aa59db136438338409cf01a96b71e488d21b67.html] ^[/intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html] ^[/intel/analyses/025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70.html]

Related Techniques

• wininet-urlmon-dual-download — the download path that produces the Zone.Identifier mark
• marker-file-mutex-gating — another filesystem-based evasion technique in the same campaign