cyber.hendryadrian.com
Threat Research · huntress.com

Huntress Analyzes a PowerShell Launcher That Executes Shellcode

· Original article ↗

Summary

Huntress dissects a hidden batch and PowerShell launcher that decodes a Base64-encoded, GZIP-compressed payload, allocates memory for shellcode, and runs it in a new thread. The shellcode itself was not analyzed.

Key points

  • A Windows batch script uses cmd.exe to start PowerShell with its window hidden, without a startup profile, and in non-interactive mode.
  • The launcher checks the system architecture to select a PowerShell path, then decodes and decompresses an embedded Base64 payload at runtime.
  • Obfuscated PowerShell uses reflection and delegates to locate and call Win32 API functions.
  • The script uses VirtualAlloc to create readable, writable, and executable memory, copies shellcode into it, and runs it with CreateThread.
  • The article does not analyze what the shellcode does; it recommends further behavioral monitoring or analysis in a contained sandbox.
  • AppLocker or PowerShell Constrained Language Mode may block execution of the initial launcher, according to the article.

Article Details

Attack Vectors
  • A Windows batch script launches PowerShell through cmd.exe, using arguments that suppress visible windows.
  • The launcher decodes a Base64-encoded, GZIP-compressed PowerShell payload and executes it.
  • The PowerShell payload uses Win32 API calls to allocate executable memory, copy shellcode into it, and execute it in a new thread.
Defensive Notes
  • The article recommends enabling AppLocker or PowerShell Constrained Language Mode to block execution of the initial launcher.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe launcher conceals its PowerShell payload in Base64-encoded, GZIP-compressed data and uses obfuscated variable and function names.T1059.001 · PowerShellThe launcher and its nested process execute PowerShell commands and payload code.T1059.003 · Windows Command ShellThe batch script uses cmd.exe to run a command that launches PowerShell.T1106 · Native APIThe PowerShell payload reflectively locates and calls Win32 API functions including VirtualAlloc and CreateThread.T1140 · Deobfuscate/Decode Files or InformationThe launcher decodes the Base64 data and decompresses the GZIP payload before executing it.T1564.003 · Hidden WindowThe script uses cmd.exe and PowerShell arguments such as /b and -w hidden to suppress visible windows.

Products

Microsoft WindowsThe first thing to note is that this took the form of a Windows “batch” script, or a file with a .bat extension. Batch scripts are interpreted and executed by the Windows command prompt, or the “cmd.exe” program.PowerShellHomeBlogFrom PowerShell to Payload: An Analysis of Weaponized Malware

Related Articles