Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 844361" data-attributes="member: 32260">Finally, something bypassed the WD on ConfigureDefender MAX Protection Level. As it could be guessed, this was a script (poy.js):[URL unfurl=&quot;true&quot;]https://app.any.run/tasks/a2ef6717-4cb4-4683-bf47-6daebad0a3b0/[/URL][ATTACH=full]229693[/ATTACH]The persistence was done in a standard way by dropping the shortcut sideb.lnk to the start folder. The shortcut can start JScript payload with a fake file extension (.dat) dropped to the user Temp folder. The malware also created the autorun registry key that can execute the shortcut with Windows start. It probably behaved as an info-stealer and did not run any payload during the test. If the poy.js malware did directly run the payload (dropped to the start folder), then it could be blocked by ASR rules. Congrats to Eset for the quick signature of poy.js malware.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Edit.Thank SeriousHoax, WD can detect this malware by signatures, now (WD deleted the malware after it has been unpacked):[ATTACH=full]229695[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 844361, member: 32260"] Finally, something bypassed the WD on ConfigureDefender MAX Protection Level. As it could be guessed, this was a script (poy.js): [URL unfurl="true"]https://app.any.run/tasks/a2ef6717-4cb4-4683-bf47-6daebad0a3b0/[/URL] [ATTACH type="full" alt="poy.png"]229693[/ATTACH] The persistence was done in a standard way by dropping the shortcut sideb.lnk to the start folder. The shortcut can start JScript payload with a fake file extension (.dat) dropped to the user Temp folder. The malware also created the autorun registry key that can execute the shortcut with Windows start. It probably behaved as an info-stealer and did not run any payload during the test. If the poy.js malware did directly run the payload (dropped to the start folder), then it could be blocked by ASR rules. Congrats to Eset for the quick signature of poy.js malware.:) Edit. Thank SeriousHoax, WD can detect this malware by signatures, now (WD deleted the malware after it has been unpacked): [ATTACH type="full"]229695[/ATTACH] [/QUOTE]

Verification