New virus doesn't a file during infection
Anti-virus company Trend Micro detected new malware called JS_POWMNET that uses a fileless infection chain. A fileless infection chain never saves a file to the machine and makes it harder to analize via sandbox. It is unclear whether users unknowingly download it or other malware drops it onto the infected machine. Regardless of how it gets in, an autostart registry entry receives a url to fetch malicious JavaScript. This enables the regsrvr32 to execute arbitrary scripts without saving the xml file to the computer. The malicious script then downloads TROJ_PSINJECT which runs a Powershell script which downloads an encrypted file called "favicon." Then, finally, the favicon is decrypted so it can load up its payload. To protect against fileless malware, experts recommend segmenting their networks to limit access and to disable Powershell if they don't use it.