We all know that VBScript has been deprecated and will be removed in future Windows releases. The PowerShell OSLicense module helps you activate licenses, query them, and more. In this blog post, I…

At a Glance Attribute Details Malware Family TASK#STOMP Threat Actor Unknown (Unconfirmed attribution) Target Victims Enterprise networks and corporate document repositories Delivery Vector Deceptive VBScript execution (initial delivery under investigation) Key Capabilities Continuous document theft, Wi-Fi password theft, clipboard capture, C2 failover Source Securonix Threat Research Executive Summary The newly discovered malware framework establishes persistent access on compromised Windows endpoints through scheduled tasks and startup files.

Microsoft stampft Visual Basic Script ein. Das Lizenzierungstool slmgr.vbs funktioniert dann nicht mehr. Nun kommt ein Ersatz-Skript.

The TASK#STOMP campaign begins with an encoded Visual Basic Script (VBScript) executed by wscript.exe, with the initial access vector likely being phishing or social engineering.

An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection.  In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence.  By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in.  Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel.  By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation.  As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well.  With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware.  A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication.  Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures.  According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran.  Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined.  The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#.  A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.

Reverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and VBScript persistence mechanisms.

Windowsを標的とするバックドア「TASK#STOMP」は、VBScript、PowerShell、スケジュールタスク、そしてランタイムでのC#コンパイルを組み合わせることで、堅牢な永続化を確立し、業務文書を継続的に窃取します。 このインプラントはスクリーンショットの取得、保存済みWi-Fiパスワードの抽出、クリ

Learn about the deprecation of Visual Basic Scripting edition.

Researchers analyzed TASK#STOMP, a Windows backdoor that hunts for business documents, exfiltrates them, and persists to steal new or modified files while also collecting Wi-Fi credentials, clipboard text, screenshots, and operator commands. Securonix says the malware uses multiple footholds, likely arrives via phishing with a ZIP or ISO/IMG attachment, and shows no clear attribution to a known APT. #TASKSTOMP #Securonix #WindowsScriptHost #VBScript #PowerShell

Microsoft has officially announced that VBScript (Visual Basic Scripting) has been deprecated and will be removed completely from all future Windows versions. VBScript is a scripting language that has been used since 1996 for various Windows tasks. After this update, all the scripts and tools that depend on VBScript will stop functioning. slmgr.vbs, a popular […] This article Use PowerShell OSLicense Module to manage Windows Activation first appeared on TheWindowsClub.com.

오늘은 結婚式のご招待 로 위장한 일본 사용자 대상 악성코드 분석을 진해 해 보겠습니다.해당 악성코드는 Windows HTA,MSHTML 환경에서 동작하는 난독화된 다운로더 및 MSI 설치 로더를 하는 악성코드 입니다.사용자 몰래 2차 VBScript를 메모리 복호화 하여 외부 서버에서 패키지를 내려받고 관리자 권한으로 UEMSAgent MSI 설치 하는 악...

Raymond en Sander duiken in een dijk aan nieuws: Windows Insiders op twee snelheden, VBScript met pensioen, Patch Tuesday breekt Excel en Grok komt naar Copilot. Plus een pittige beveiligingsupdate, een volle agenda en de saaiste productiviteitstip ooit. Nieuws Windows Insider-builds rollen 26H2 breed uit; 26H1 blijft voor Snapdragon X2, release previews voortaan tweewekelijks. VBScript verdwijnt uit Windows: slmgr.vbs wijkt voor PowerShell-module OSLicense. Patch Tuesday-nasleep: bijna 1000 lekken gedicht, Excel-plakken bleef stuk; twee noodpatches volgden. Eerste grote Windows/Surface-event in twee jaar op 7 oktober met Nvidia-ceo Jensen Huang. AI-stuk Grok komt naar Copilot, nog niet voor EU-klanten. Anthropics dreigingsrapport: statelijke...

米Microsoftは9月10日（現地時間）、公式ブログ「Windows IT Pro…

米Microsoftは9月10日（現地時間）、公式ブログ「Windows IT Pro Blog」で、Windowsのライセンス認証を自動化するスクリプトを「PowerShell」へ移行するよう呼び掛けた。ライセンス認証の自動化には「slmgr.vbs」が広く用いられているが、「VBScript」はすでに非推奨となっており、将来のWindowsからは削除される予定。そうなれば、「slmgr.vbs...

　米Microsoftは9月10日（現地時間）、公式ブログ「Windows IT Pro Blog」で、Windowsのライセンス認証を自動化するスクリプトを「PowerShell」へ移行するよう呼び掛けた。ライセンス認証の自動化には「slmgr.vbs」が広く用いられているが、「VBScript」はすでに非推奨となっており、将来のWindowsからは削除される予定。そうなれば、「slmgr.vbs」に依存した自動化も動かなくなってしまう。

Las organizaciones que usan la herramienta Slmgr.vbs deben migrar a PowerShell, ya que el lenguaje de casi 30 años empezó a desaparecer gradualmente de Windows. (Fuente: TechSpot) Microsoft anunció la depreciación del entorno VBScript hace algunos años, pidiéndoles a empresas y usuarios avanzados que migraran a sistemas de scripting más modernos. Ahora, la compañía advierte a las organizaciones que dependen de VBScript que la activación de Windows podría directamente volverse imposible una vez que el lenguaje desaparezca por completo.