Undetected JScript Dropper Installs Sage Ransomware

April 20, 2017 | Malware Analysis
Share this entry

A popular method to distribute malware (especially ransomware) is to send a JScript file (*.js) by E-Mail or prompt a user surfing the web to execute a file. The goal of this type of attack is to bypass filtering systems that warn users trying to open attachments with certain file extensions (e.g. .exe) or disallow those attachments altogether. In response, Google issued a ban on *.js file attachments in Gmail in February.
In most cases, JScript files are not the actual malware. They are a dropper, designed to “install” malware on the target system. This technique is difficult to detect through a signature-based approach because there are endless variations and custom obfuscations.
We recently saw an example of this technique used by a JScript dropper containing the Sage Ransomware 2.2 (you can read an overview of Sage Ransomware 2.0 here). The JScript Dropper was completely undetected by 0/55 AntiVirus products in VirusTotal at the time of our analysis.

JS-Dropper Virus Total Analysis

Figure 1: JScript Dropper Undetected in VirusTotal Analysis


This is not unusual. Whenever a new kind of malware appears in the wild, the first few hours are quite dangerous for users relying solely on traditional Antivirus products (demonstrated in Figure 1). Through VMRay Analyzer’s dynamic analysis we are able to see the malware’s full behavior. Malicious behavior is always malicious behavior, even if you add obfuscation on top of it.
We can already see suspicious behavior from the JScript dropper in Figure 2:
JScript-Dropper - Malicious Behavior

Figure 2: JScript Dropper Exhibiting Suspicious Behavior


The JScript dropper uses Scripting.FilesystemObject to work on local files, Wscript.Shell to execute other applications, and finally, an eval() function to execute a JScript payload. Pay attention to how lower and upper case characters were used randomly to evade weak detection systems. These behaviors are all red flags.
In Figure 3, we see the first eval() resolves to:
JS-Dropper - First Eval

Figure 3: JS-Dropper First Eval()


Figure 4 shows the second eval() resolving to another eval():
JS-Dropper - Second Eval

Figure 4: JS-Dropper Resolving to another Eval()


After unescaping the payload we get (Figure 5):
JS-Dropper - Unescaping Payload

Figure 5: Unescaping Payload


Executing the sample in VMRay Analyzer, we can see that the final payload is the latest version of Sage ransomware. Figure 6 shows Sage ransomware encrypting files on the system and demanding ransom to restore the files.
JS-Dropper - SAGE Ransomware Instructions

Figure 6: Sage Ransomware encrypting files and demanding ransom


Figure 7 shows VMRay Analyzer identifying malicious activity such as: modifying user files, overwriting the master boot record (MBR), and installing system service. As a result, this generates a high VTI score, indicating this is very malicious behavior.
JS-Dropper - Sage Ransomware - VTI Score

Figure 7: VMRay Analyzer determines the JS Dropper as malicious with a VTI score of 100/100


Watch our video analysis where we outline the malicious behavior carried out by the JScript Dropper:

Access the Full Analysis Report
References

About Emre Güler

Emre is a Malware Researcher at VMRay. Emre's primary responsibility is to identify new malware evasion techniques. Prior to joining VMRay, Emre worked as a student at the Institute for Internet Security in Gelsenkirchen, Germany for 3 years. He also works as a student at the Chair for Systems Security in the Ruhr University while pursuing his Master's degree in IT Security.


Share this entry

Website designed and developed by Raincastle Communications, Inc.

[Video] Analyzing a Malicious Microsoft Word Document Introducing the VMRay Analyzer Add-On for Splunk