When executed, “cscript.exe” runs a series of scripts carrying out basic system reconnaissance like collecting the machine GUID, hostname, and supported languages. It then replaces “runtimebroker.dll” in the user’s AppData directory with a reflexive loader and modifies Chrome’s Security Extension manifest.
This modification allows the attacker to inject two JavaScript files, “background.js” and “content.js,” that run as a malicious extension whenever Chrome starts. The resulting malware Malwarebytes tracks as GhostDesk.
While content.js was seen recording keystrokes and scanning submitted forms for credentials, authentication tokens, and financial information, background.js provided cookie theft, screenshot capture, and arbitrary JavaScript execution.
