Trojanized HWMonitor Installer Uses Obfuscated Scriptlets to Load Fileless .NET Payload
Summary
Analysis details a trojanized CPUID HWMonitor installer that uses PowerShell, MSBuild and regsvr32 to run scriptlets, reconstruct a .NET payload from fake IPv6 strings, and execute it in memory.
Key points
- A trojanized CPUID HWMonitor installer initiates a multi-stage fileless execution chain.
- The chain uses PowerShell, MSBuild and regsvr32 to run scriptlets including Clippy.sct and ActiveX.sct.
- Clippy.sct decodes embedded fake IPv6 strings into a byte stream and rebuilds a serialized .NET assembly in memory.
- The assembly is deserialized with BinaryFormatter and dynamically invokes a malicious ServiceClass.
- References to data.dat and VirtualAlloc/CreateThread suggest possible follow-on shellcode execution, according to the analysis.
- Recommended defenses include validating installer signatures and hashes, using EDR, and monitoring suspicious regsvr32 scriptlet and MSBuild activity.
Article Details
- Attack Vectors
- A trojanized CPUID HWMonitor installer delivers a multi-stage, fileless payload.
- The installer chain invokes PowerShell, MSBuild, and regsvr32 to execute scriptlets including Clippy.sct and ActiveX.sct.
- Clippy.sct decodes an embedded array of fake IPv6 strings into bytes, reconstructs a serialized .NET assembly in memory, and dynamically invokes it.
- The payload references reading data.dat and using VirtualAlloc and CreateThread for likely follow-on shellcode execution; this behavior is described as likely, not confirmed.
- Defensive Notes
- Validate installer signatures and hashes and scan downloads before execution; restrict execution of newly downloaded files until validated.
- Deploy and configure EDR, and monitor suspicious installer-to-PowerShell, MSBuild, or regsvr32 process chains and command-line activity.
- Monitor regsvr32 use with .sct files, MSBuild execution from user-writable directories, and script-based payload reconstruction involving large embedded arrays or encoded data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 02db6764d1f13b837b0a525e5931bdbc67e7a2a4d071e849c7e087255d4a2d5b | Hash identified for the trojanized HWMonitor installer. |
| SHA256 | 0ce8db66d881e98341a4f40754665059c028f27ba083b95e88cb7d1624390b5c | Hash identified for the ActiveX.sct scriptlet in the campaign. |
| SHA256 | 3d91f442ddc055e19e3710482e1605836c799249dacd43d99843257a3affd2d2 | Hash identified for the Portable HWMonitor Installer (1.63) used in the trojanized installer chain. |
| SHA256 | 788d3f14ff6a701b114e0b40990379c0302e26c1bbbce22a7ee5c872c7df1d1f | Hash identified for the 0uenkytg.cs artifact in the campaign. |
| SHA256 | a27df06c7167eced1ddaeb8adccaa5f60500f52bc7030389eed2a0903cdf8286 | Hash identified for the fake CRYPTBASE.dll artifact associated with the campaign. |
| SHA256 | b31a9d919750567167a07eb6d4d53f9dcd25e8343624d54d98f528832cb4cdc7 | Hash identified for the malicious Clippy.sct payload. |
| URL | hxxps[:]//welcome[.]supp0v3[.]com/d/callback | Referenced command-and-control callback URL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationClippy.sct encodes raw payload bytes as fake IPv6 strings, complicating static detection and analysis.T1059.001 · PowerShellPowerShell is part of the execution sequence initiated by the installer.T1059.007 · JavaScriptJScript in the scriptlet reconstructs and dynamically invokes the .NET payload.T1195 · Supply Chain CompromiseA trojanized CPUID HWMonitor installer was used as the initial delivery mechanism.T1218 · System Binary Proxy ExecutionThe chain abuses regsvr32 and MSBuild to execute scriptlet payloads without dropping traditional executables.
Vendors
Products
.NETMSBuild, regsvr32) to execute scriptlet payloads such as Clippy.sct which reconstructs and runs a .NET assembly entirely in memory.CPUID HWMonitorA trojanized CPUID HWMonitor installer was used to deliver a multi-stage, fileless malware chain that leverages trusted Windows binaries (PowerShell, MSBuild, regsvr32) to execute scriptlet payloads such as Clippy.sctMicrosoft WindowsHWMonitor installer was used to deliver a multi-stage, fileless malware chain that leverages trusted Windows binaries (PowerShell, MSBuild, regsvr32) to execute scriptlet payloads such as Clippy.sct which