PowerShell Malware Uses Encoded Payloads to Launch a WinInet Downloader

Summary

Huntress traces a PowerShell payload launched from a registry Run key through base64 and gzip layers to shellcode that uses VirtualAlloc and CreateThread and loads WinInet, indicating downloader behavior.

Key points

The payload was found on a partner’s host and launched from an HKLM Run key.
PowerShell read a base64-encoded value from the registry; the decoded content was UTF-16 text containing another base64-encoded, gzip-compressed script.
The decoded script called VirtualAlloc and CreateThread, functions the article associates with allocating memory for and executing shellcode.
A decoded string contained a User-Agent, and the shellcode instructions loaded WinInet, leading Huntress to identify it as a downloader.

Article Details

Attack Vectors: A PowerShell command launched from an HKLM Run key reads a Base64-encoded payload from another registry value.
The payload is Base64-decoded and Gzip-decompressed before being executed through PowerShell.
The decoded script uses VirtualAlloc and CreateThread to execute shellcode; the shellcode contains a User-Agent string and was assessed as likely to make an HTTP connection.
The shellcode loads WinInet, which the article identifies as the mechanism for accessing internet resources and evidence that the payload functions as a downloader.
Defensive Notes: Investigate unusual or obfuscated values under HKLM Run keys, including values whose names appear anomalous.
Review PowerShell commands that read registry values and decode Base64 or decompress Gzip data.
Inspect suspicious shellcode for memory allocation, thread creation, and WinInet-loading behavior.

MITRE ATT&CK

T1059.001 · PowerShellPowerShell reads and decodes the registry-stored payload, decompresses the next stage, and executes it.T1105 · Ingress Tool TransferThe article identifies the shellcode as a downloader and says it likely makes an HTTP connection; it also notes that the shellcode loads WinInet.T1140 · Deobfuscate/Decode Files or InformationThe script Base64-decodes and Gzip-decompresses encoded payload data before execution.T1547.001 · Registry Run Keys / Startup FolderThe payload was launched from a value under HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run.

Products

Microsoft Windowsitself. In other words, it uses the features and tools that are built into the operating system, such as Windows PowerShell, to perform a malicious activity and avoid detection.PowerShellHomeBlogMalware Deep Dive: Examining A PowerShell Payload

Tools

Metasploit FrameworkThe last five instructions load WinInet, the Windows Internet API for accessing internet resources. Metasploit nicely documented shellcode that uses the same instructions to load WinInet.shellenWe can use shellen to disassemble the shellcode, but first we need to turn the base64 decoded bytes into a hex string.