Huntress Analyzes Suspected Targeted PowerShell Attack Using AMSI Bypass
Summary
Huntress analyzed a suspected targeted attack using a scheduled task to launch staged PowerShell malware. The code bypassed AMSI, contacted a look-alike domain, and prepared an Empire beacon, but analysts could not retrieve the final payload.
Key points
- Huntress found a scheduled task named LTSvc launching hidden PowerShell code.
- The initial script repeatedly downloaded additional PowerShell snippets and executed them with Invoke-Expression.
- A staged .NET DLL used Win32 API calls to overwrite AmsiScanBuffer, disabling AMSI scanning in that PowerShell context.
- The malware used a look-alike domain and referenced legitimate software used by the target organization, leading Huntress to assess the activity as likely targeted.
- Later code prepared encrypted web communications, gathered the victim computer’s operating system, user account, and IP address, and included an Invoke-Empire command.
- Huntress could not retrieve the final payload because the listening beacon was no longer active.
Article Details
- Attack Vectors
- A scheduled task named LTSvc launched PowerShell with a hidden window, execution-policy bypass, and a lengthy command.
- PowerShell repeatedly downloaded remote code with DownloadString and executed it using Invoke-Expression.
- The malware used a typosquatted look-alike website that impersonated an organization and referenced software used by the target.
- The script decoded a Base64-encoded .NET DLL and reflectively loaded it into the PowerShell context.
- The script overwrote AmsiScanBuffer in memory to bypass AMSI scanning.
- A later stage decoded and decompressed a GZIP payload before executing it, then prepared encrypted web communications and invoked Invoke-Empire.
- Defensive Notes
- Huntress identifies the LTSvc scheduled task at C:\WINDOWS\system32\tasks\Microsoft\Windows\EnterpriseMgmt\LTSvc as a persistence artifact in this incident.
- The article highlights hidden PowerShell execution, execution-policy bypass, repeated DownloadString and Invoke-Expression calls, and in-memory modification of AmsiScanBuffer as suspicious behaviors.
- Huntress notes that bypassing AMSI can allow subsequent PowerShell code to run without inspection by antivirus or other preventive security solutions.
- The article describes tracking down persistent implants as a way for defenders to investigate malicious activity, remove persistence, and cut off access.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe final stage gathered the victim computer's IP address as part of its reconnaissance.T1033 · System Owner/User DiscoveryThe final stage gathered the victim computer's user account.T1036 · MasqueradingThe attackers used a typosquatted look-alike website and malware references to software used by the target to blend in with the organization's operations.T1053.005 · Scheduled TaskA scheduled task named LTSvc was used to maintain persistence.T1059.001 · PowerShellThe LTSvc task launched PowerShell, which executed downloaded and decoded script stages, including an Invoke-Empire command.T1071.001 · Web ProtocolsThe malware used web requests to communicate with its look-alike C2 website and retrieve further code.T1082 · System Information DiscoveryThe final stage gathered information about the victim computer's operating system.T1105 · Ingress Tool TransferPowerShell DownloadString requests retrieved successive remote script and payload stages.T1140 · Deobfuscate/Decode Files or InformationThe script decoded Base64 data and decompressed a GZIP payload before executing it.T1562.001 · Disable or Modify ToolsThe script changed memory protections and overwrote AmsiScanBuffer to disable AMSI scanning in the running PowerShell context.T1573.001 · Symmetric CryptographyThe final PowerShell stage prepared encrypted web communications and included RC4-related functions.T1620 · Reflective Code LoadingA Base64-encoded .NET DLL was reflectively loaded into the running PowerShell context.