Malware Uses a LNK File to Launch a Multi-Stage PowerShell Chain
Summary
Huntress analyzes malware launched by a LNK file that uses mshta.exe and obfuscated PowerShell to retrieve and execute staged payloads, collect system and security-software details, and communicate with remote servers.
Key points
- The LNK file launches mshta.exe, which starts VBScript and PowerShell; the PowerShell reads and decodes payload data embedded in the LNK.
- The first stage sends a POST request and executes the response, which retrieves an XML document and decodes another PowerShell payload.
- The later-stage code enumerates installed applications and antivirus software, checks administrator privileges and virtualization indicators, and obtains the host's external IP address.
- The malware uses RC4 to encrypt or decrypt data, then sends collected information to a remote server and executes its response.
- Huntress notes that PowerShell 5 enhanced logging can record complete PowerShell commands and scripts, making logging relevant to detecting these techniques.
Article Details
- Attack Vectors
- A LNK file named remote desktop connection.lnk launches mshta.exe, which runs VBScript that invokes PowerShell.
- PowerShell reads and decodes obfuscated data embedded in the LNK file, then makes HTTP POST and GET requests and executes the returned commands.
- The later PowerShell stage collects installed-application, antivirus, external IP, privilege, BIOS, and system information, and posts collected data.
- Defensive Notes
- The article recommends PowerShell logging as a detection aid and notes that Microsoft added enhanced logging in PowerShell version 5.
- Treat a LNK file that launches mshta.exe rather than the expected remote desktop application as a red flag.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryA PowerShell stage obtains the host's external IP address.T1027 · Obfuscated Files or InformationThe LNK-embedded PowerShell and subsequent commands are encoded and obfuscated before execution.T1041 · Exfiltration Over C2 ChannelThe article says collected host data is posted in a request before the response is executed.T1059.001 · PowerShellPowerShell decodes and executes commands embedded in the LNK file and commands returned by HTTP requests.T1071.001 · Web ProtocolsThe PowerShell stages communicate using HTTP POST and GET requests.T1082 · System Information DiscoveryThe malware checks BIOS and system details.T1204.002 · Malicious FileThe attack chain begins with a LNK file that launches mshta.exe.T1218.005 · MshtaThe LNK file uses mshta.exe to start a shell from VBScript.T1497.001 · System ChecksThe malware checks BIOS and system details to determine whether the host is a virtual machine, described as an anti-sandboxing technique.T1518.001 · Security Software DiscoveryA PowerShell stage enumerates antivirus software and checks installed applications against security-related terms.