Investigating the use of VHD files by cybercriminals

In recent investigations, I observed an adversary making use of a VHD attachment to a spear-phishing email being sent. VHD files are ‘Virtual Hard-Disk’ files. Originally the file format was introduced with Connectix Virtual PC and it can store the contents of a hard disk drive. Windows 7 and newer systems include the ability to manually mount VHD files. From Windows 8 and onwards, a user can mount a VHD by simply double-clicking on the file. Once mounted, a VHD disk image appears to Windows as a normal hard disk physically connected to the system. Why would an adversary use a VHD file? To launch a do…