cyber.hendryadrian.com
Threat Research · huntress.com

Malware Hides PowerShell and mshta Behind Legitimate-Looking Windows Files

· Original article ↗

Summary

Huntress analyzed a malware foothold that mimicked a legitimate Windows task, used renamed mshta and PowerShell executables, and concealed commands in a fake log file. The payload could bypass AMSI and collect host information.

Key points

  • A malicious scheduled task closely imitated a legitimate Base Filtering Engine task, including its name and description.
  • The task used renamed copies of mshta.exe and powershell.exe, making the processes less likely to be noticed by name.
  • A file made to resemble an application log stored numeric values that the command converted into an executable PowerShell command.
  • The payload patched AMSI in memory when it detected CLR version 3 or later, then ran a downloader chain.
  • The final payload collected host details, including installed applications, IP addresses, and administrative privileges.

Article Details

Attack Vectors
  • A scheduled task named BfeOnServiceStartTypenChange launches renamed copies of mshta.exe and powershell.exe to execute an obfuscated PowerShell payload stored in C:\Windows\a.chk.
  • The payload checks for CLR version 3 or greater and patches AMSI in memory to bypass scanning.
  • Encoded commands and a secondary downloader retrieve further PowerShell commands and payloads.
  • The final payload collects information about installed applications, IP addresses, and administrative privileges on the compromised host.
Defensive Notes
  • Compare scheduled tasks with legitimate tasks on the host; the malicious task copied the name and description of BfeOnServiceStartTypeChange but used a different command.
  • Inspect task commands and executable paths for renamed copies of legitimate binaries, including mshta.exe and powershell.exe.
  • Review suspicious files presented as logs for encoded content and monitor for PowerShell decoding and execution.
  • Monitor for in-memory AMSI patching and unexpected PowerShell downloader activity.

MITRE ATT&CK

T1016 · System Network Configuration DiscoveryThe final payload collects IP addresses from the compromised host.T1027 · Obfuscated Files or InformationThe payload is stored as hexadecimal-like numeric values in a file made to resemble an error log and converted to ASCII before execution.T1053.005 · Scheduled TaskThe foothold is launched through a scheduled task named BfeOnServiceStartTypenChange.T1059.001 · PowerShellA renamed copy of powershell.exe, engine.exe, decodes and executes PowerShell commands, including downloader commands.T1059.003 · Windows Command ShellThe VBScript-launched command invokes cmd.exe to run engine.exe.T1069 · Permission Groups DiscoveryThe final payload collects information about administrative privileges on the compromised host.T1105 · Ingress Tool TransferThe downloader retrieves an intermediary PowerShell command and a subsequent payload.T1218.005 · MshtaA renamed copy of mshta.exe, BfeOnService.exe, runs a VBScript command that launches a shell.T1518 · Software DiscoveryThe final payload collects installed-application information, including whether browsers, financial applications, and security products are present.T1562.001 · Disable or Modify ToolsThe payload patches AMSI in memory to bypass scanning when CLR version 3 or greater is present.