NetSuite Javascript

[AlexLeadingEdge]

Hi guys,

This Javascript was picked up by Malwarebytes:

C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe C:\Users\jamesc\Downloads\mm_ue_conversations_button.js

When I look inside the Javascript file I see references to "NApiVersion 2.0" which is a part of the NetSuite Applications Suite, which is what our client uses extensively.

VirusTotal also doesn't pick it up:

https://www.virustotal.com/gui/file/daf80dca4face075bd0727a96c0d4188a5699189ecd9589b1caea8eadf313041

mm_ue_conversations_button.zip

[Porthos]

17 minutes ago, AlexLeadingEdge said:

This Javascript was picked up by Malwarebytes:

C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe C:\Users\jamesc\Downloads\mm_ue_conversations_button.js

Was this an exploit block? Malwarebytes does not detect script files in a scan.

[screen317]

Hello and thank you for submitting. We will need some kind of scan log or protection log that shows the detection to determine what is the proper course of action here.

All best,

Edited September 5, 2022 by screen317

[AdvancedSetup]

If you post back the following logs it will show us.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[AlexLeadingEdge]

Hi guys,

Here is the diagnostic report.

1448458172_MalwarebytesDiagnostics.zip

[AlexLeadingEdge]

15 hours ago, Porthos said:

Was this an exploit block? Malwarebytes does not detect script files in a scan.

Yes.

Name:  Malware.Exploit.Agent.Generic

Action Taken:  Blocked

Category:  Exploit

Type:  Exploit

[Porthos]

1 hour ago, AlexLeadingEdge said:

Category:  Exploit

Did you enable any non default policy's in the advanced exploit settings? For example penetration testing?

[AlexLeadingEdge]

15 minutes ago, Porthos said:

Did you enable any non default policy's in the advanced exploit settings? For example penetration testing?

Where do I see this in OneView or Nebula? I think the answer is 'no', but as I didn't set it up originally I cannot say without checking.

Everything except for Boot Process is turned on under Policies > Default > Protection Settings.

Edited September 5, 2022 by AlexLeadingEdge

[Porthos]

51 minutes ago, AlexLeadingEdge said:

Where do I see this in OneView or Nebula?

That I can not say as I am not familiar with the product. And also not familiar with the logs from it to advise further.

I can say that exploit protection has been more aggressive lately. and some times you have to change things to let somethings work correctly.

For example, anything that makes a call to C:\Windows\System32\WScript.exe to execute something is probably going to be blocked since malware can do the same.

If you have not tried, you could exclude mm_ue_conversations_button.js from the protection.

Also you can Submit  Business Support Ticket  as well.

Edited September 5, 2022 by Porthos

[AlexLeadingEdge]

20 minutes ago, Porthos said:

That I can not say as I am not familiar with the product. And also not familiar with the logs from it to advise further.

I can say that exploit protection has been more aggressive lately. and some times you have to change thins to let somethings work correctly.

For example, anything that makes a call to C:\Windows\System32\WScript.exe to execute something is probably going to be blocked since malware can do the same.

If you have not tried, you could exclude mm_ue_conversations_button.js from the protection.

Also you can Submit  Business Support Ticket  as well.

Thanks Porthos, I have opened a business support ticket.

[AlexLeadingEdge]

Is there a False Positives section for Business Customers?

[Porthos]

3 minutes ago, AlexLeadingEdge said:

Is there a False Positives section for Business Customers?

This is in the right section but I think support will have to offer you some changes to make so this stops being an issue.

34 minutes ago, Porthos said:

I can say that exploit protection has been more aggressive lately. and some times you have to change things to let somethings work correctly.

 

Edited September 5, 2022 by Porthos