frida-wshook

frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript.

The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted scripting language. This allows it to support analyzing a few different script types such as:

• .js (JScript)
• .vbs (VBScript)
• .wsf (WSFile) (Initial support/testing. - Does not support specific jobs)

By default script files are run using cscript.exe and will output:

• COM ProjIds
• DNS Requests
• Shell Commands
• Network Requests

Warning!!! Ensure that you run any malicious scripts on a dedicated analysis system. Ideally, a VM with snapshots so you can revert if a script gets away from you and you need to reset the system.

Although common methods have been hooked, Windows provides numerous APIs which allow developers to interact with a network, file system and execute commands. So it is entirely possible to encounter scripts leveraging uncommon APIs for these functions.

Install & Setup

• Install Python 2.7
• Install the Frida python bindings using pip

pip install frida

• Clone (or download) the frida-wshook repository.

Supported OS

frida-wshook has been tested on Windows 10 and Windows 7 and should work on any Windows 7 + environment. On x64 systems CScript is loaded from the C:\Windows\SysWow64 directory.

It may work on WindowsXP, but I suspect that CScript may use the legacy API calls and would bypass the instrumentation.

Usage

The script supports a number of optional commandline arguments that allow you to control what APIs the scripting host can call.

usage: frida-wshook.py [-h] [--debug] [--disable_dns] [--disable_com_init]
                       [--enable_shell] [--disable_net]
                       script

frida-wshook.py your friendly WSH Hooker

positional arguments:
  script              Path to target .js/.vbs file

optional arguments:
  -h, --help          show this help message and exit
  --debug             Output debug info
  --disable_dns       Disable DNS Requests
  --disable_com_init  Disable COM Object Id Lookup
  --enable_shell      Enable Shell Commands
  --disable_net       Disable Network Requests

Analyze a script with the default parameters:

python wshook.py bad.js

Enable verbose debugging:

python wshook.py --debug bad.js

Enable shell (execute) commands:

python frida-wshook.py --enable_shell bad.vbs

Disable WSASend:

python frida-wshook.py --disable_net bad.vbs

Check what ProgIds the script uses:

python frida-wshook.py --disable_com_init bad.vbs

Hooked Functions

• ole32.dll
  • CLSIDFromProgIDEx
• Shell32.dll
  • ShellExecuteEx
• Ws2_32.dll
  • WSASocketW
  • GetAddrInfoExW
  • WSASend
  • WSAStartup

Known Issues

• Network responses are not captured
• Disabling Object Lookup can cause the script to only output the first ProgId...Malware QA can be lacking.
• WSF files with a specific job to target currently isn't supported

TODO

• Change GetAddrInfoExW to use .replace instead of .attach
• Add additional tracing and hooks to cover more APIs
• Look at bypassing common anti-analysis techniques found in scripts (sleeps etc)
• Update and improve network request hooking (ie: currently it captures requests, but not responses)

Feedback / Help

Any questions, comments or requests you can find us on twitter: @seanmw or @herrcore