Command and Scripting Interpreter: JavaScript/JScript

Adversaries may abuse JavaScript and/or JScript for execution. JavaScript (JS) is a platform-agnostic scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.[1]

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.[2][3][4]

Adversaries may abuse JavaScript / JScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

ID: T1059.007
Sub-technique of:  T1059
Tactic: Execution
Platforms: Linux, Windows, macOS
Permissions Required: Administrator, SYSTEM, User
Data Sources: DLL monitoring, File monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Version: 1.0
Created: 23 June 2020
Last Modified: 25 June 2020

Procedure Examples

Name Description
APT32

APT32 has used JavaScript for drive-by downloads and C2 communications.[26]

Astaroth

Astaroth uses JavaScript to perform its core functionalities. [5]

Bundlore

Bundlore can execute JavaScript by injecting it into the victim's browser.[12]

Cobalt Group

Cobalt Group has executed JavaScript scriptlets on the victim's machine.[18][19][20][21][22][23]

FIN7

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.[24][25][24]

GRIFFON

GRIFFON is written in and executed as JavaScript/JScript.[11]

jRAT

jRAT has been distributed as HTA files with JScript.[9]

Leafminer

Leafminer infected victims using JavaScript code.[13]

Metamorfo

Metamorfo developed the payload using JavaScript.[10]

Molerats

Molerats used various implants, including those built with JS, on target machines.[17]

NanHaiShu

NanHaiShu executes additional Jscript code on the victim's machine.[6]

POWERSTATS

POWERSTATS can use JavaScript code for execution.[8]

Silence

Silence has used JS scripts.[14]

TA505

TA505 has used JavaScript for code execution.[15][16]

Xbash

Xbash can execute malicious JavaScript payloads on the victim’s machine.[7]

Mitigations

Mitigation Description
Disable or Remove Feature or Program

Turn off or restrict access to unneeded scripting components.

Execution Prevention

Denylist scripting where appropriate.

Restrict Web-Based Content

Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

Detection

Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source.

Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References

  1. OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.
  2. Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020.
  3. Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020.
  4. Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020.
  5. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019.
  6. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  7. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.
  8. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
  9. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  10. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  11. Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.
  12. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  13. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
  1. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019.
  2. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
  3. Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.
  4. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  5. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  6. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
  7. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  8. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.
  9. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.
  10. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.
  11. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  12. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.
  13. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.