I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The script is heavily obfuscated (i.e. not simply using execute), and I don't know how to begin to analyze it.
So far, i've tried the open source tool ViperMonkey, put it failed to trace the script.
Any suggestions?
You can try to use a text editor to insert lines that calls to MsgBox with some variables to print their contents, in order to de-obfuscate the script and understand it's logic.
Also there is probably a WMI query that enumerates some hardware or BIOS etc. to identify it is running in a virtualized environment.
Since WMI Query in VBS are done by first running GetObject I would try to look for calls to GetObject and then MsgBox-ing their return values, or the return values in the next few lines following GetObject. Then after identifying that query there should be a condition that exits if some string is found in there which indicates a virtualized environment.
A second approach would be to look for a call to WScript.Shell and try to work your way backwards to where the file that was executed was written.
Another option that could be causing this not work in your VM, is that the script is downloading the malware form a remote server which is no longer available, although it worked in the online sandbox environment a while ago (while it was still available), in this case you might be lucky if you are able to extract the URL that the script tries to download from and look it up in google/VirusTotal etc.
Good Luck.
Try running the following from the command line:
cscript /x .\malwaresample.vbs
That should open it up in Visual Studios and allow you to step through it.
