In this article we'll go in an analysis of an encrypted malicious VBS script labeled as "Trojan.Script.Vbs-heuristic.druvzi".
The script is masked behind a fake "Chromium Update Helper loader" and there is also a fake reference to Microsoft to present it as licit.
As we can see in the function "syncProfile92" a XOR function is used to encrypt the actual content of the script with the key "79" (with the variable "checkStatus60").
The function "syncProfile92" takes as an argument the variable "syncProfile89" which is used to pass the content to encrypt and splitted with commas.
There is a For Each loop to encrypt the parts of the content related to the variable "initSystem52" with the use of the variable "verifyState59" which has references to the content passed with the variable "syncProfile89".
The variable "updateCache81" is concatenated with the converted String characters from the initial characters and then converted to integers types to complete the XOR encryption with the integers arrays.
The module "loadModule77" uses the variable "initSystem97" to perform a do-while loop until the difference Timer - initSystem97 moltiplicated to 1000 is lower than 1.
The function "checkStatus31()" is used for the arithmetic operator to deal with the variables "processUpdate68" and "verifyState14" with "Mod 256" take just the remainder from the division operation.
The function "verifyState72()" there's another loop construct with the variable "validateConfig27".
The module "updateCache61()" contains another loop but the function "initSystem68" executes the XOR encrypted script source code and at the line 49 we can see that if the length attribute of the variable "verifyState68" is bigger than 0 the request header for the malicious connection is initialized and used.
We can see infact later the "Send" function called with the variable "initSystem93" and in the following line 51 we can see that there is the check against the HTTP status code, if it's different from 200 (OK) the Exit function is called because it means the malicious URL is offline.
Otherwise, the download of the second stage malicious artifact is done and it is saved with the functions "Open", "Write" (related to the ResponseBody attribute), "SaveToFile" and "Close".
The SpecialFolders WScript.Shell COM property is used to gain persistence C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ as we can see later, there is also a CopyFile function calling if the file exists, at the end to clear traces the file itself is deleted. Boolean attributes are used to track the filesystem operations.
By decrypting the XOR-encrypted content we can see there is a GET request with a WinHttpRequest object with the useragent ADODB.Stream (ActiveX component used to manage data flows through VBA, ASP, VB6 scripts) and the references to Microsoft Edge Update, the script in this case is masked behind a fake Microsoft Edge Updater.
Then we have the evidence to the C&C URL that can be used to download the second stage script packed.vbs.
Unfortunately the URL is currently offline, so it's not possible to go further with the analysis of the dropped artifact threat.
The script is recognized as malicious by OSINT sources:
The URL in question has been analyzed for the first time today, also the malicious script itself.
Here we can see an evidence of the persistence in an execution detonation context:
We also have evidence that pixeldrain[.]com (which is a licit service) is abused to host and deliver several malicious artifacts:
IOCs:
- 0e85f8776c68237fe42e85901b16a05de595cde5f4b3faa77307925dc0405d0b
- 074f0eac37bc424bb3b60382599faa9cbcce1888
- b5cfc873208d082c5f49fd257f00d695
- hxxps[://]pixeldrain[.]com/api/file/TjWyKL3i\packed.vbs
- edge component update.vbs
- Edge Component Update.vbs
- Aruba_Business.pdf.vbs