Full Report
There’s no end to the stealthy ways in which attackers develop and execute their tradecraft. In this case, it's as simple as hiding in plain sight.
Analysis Summary
# Tool/Technique: Masquerading & Obfuscated PowerShell Downloader
## Overview
This technique involves "hiding in plain sight" by using renamed legitimate Windows binaries and masquerading as valid system services. The primary purpose is to establish a persistent foothold (via scheduled tasks) and execute a multi-stage PowerShell downloader while evading detection from EDR/AV that monitors for common process names like `powershell.exe` or `mshta.exe`.
## Technical Details
- **Type:** Technique (Masquerading) / Malware (Downloader)
- **Platform:** Windows (specifically observed on versions mirroring Windows 8/Server 2012)
- **Capabilities:** Persistence, AMSI bypass, Host reconnaissance, Credential/Application harvesting.
- **First Seen:** Reported June 18, 2020.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- T1036.003 - Masquerading: Rename System Utilities
- T1027 - Obfuscated Files or Information
- T1562.001 - Impair Defenses: Disable or Modify Tools (AMSI Patching)
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- T1518.001 - Software Discovery: Security Software
## Functionality
### Core Capabilities
- **Binary Renaming:** Legitimate binaries are renamed to appear as system drivers or engine files (`mshta.exe` renamed to `BfeOnService.exe`; `powershell.exe` renamed to `engine.exe`).
- **Persistence via Masquerading:** Creates a scheduled task named `BfeOnServiceStartTypenChange`, which mimics the name and description of the legitimate Windows "Base Filtering Engine" task.
- **File Masquerading:** Uses a file named `a.chk` that appears to be a standard application error log but actually contains the decimal-encoded ASCII payload.
### Advanced Features
- **AMSI Bypass:** The PowerShell payload checks for Common Language Runtime (CLR) version 3 or greater and patches the Anti-Malware Scan Interface (AMSI) in memory to prevent the scanning of subsequent malicious scripts.
- **Multi-stage Execution:** The initial stager decodes the "log" file, which triggers a secondary downloader that utilizes DNS-based techniques for further stage retrieval.
## Indicators of Compromise
- **File Names:**
- `C:\Windows\system32\BfeOnService.exe` (Renamed `mshta.exe`)
- `C:\Windows\system32\engine.exe` (Renamed `powershell.exe`)
- `C:\Windows\a.chk` (Encoded payload disguised as a log)
- **Scheduled Task Name:** `BfeOnServiceStartTypenChange`
- **Behavioral Indicators:**
- `mshta.exe` (or renamed equivalent) calling `powershell.exe` (or renamed equivalent).
- PowerShell execution involving `Get-Content` (gc) on `.chk` files followed by `-split` and `[char]` conversions.
- Unexpected modifications to memory (AMSI patching).
## Associated Threat Actors
- **Unknown:** The article does not name a specific group, though it notes the reconnaissance payload is identical to ones used in previous campaigns involving malicious `.LNK` files.
## Detection Methods
- **Behavioral Detection:** Monitor for instances where `mshta.exe` or `powershell.exe` are renamed but retain their original metadata (Original Filename in Version Info).
- **Command Line Monitoring:** Flag PowerShell commands containing suspicious string manipulation like `$_.split('x')[-1]` combined with `[char][int]`.
- **Task Analysis:** Audit scheduled tasks for typosquatting (e.g., `StartTypenChange` vs `StartTypeChange`).
## Mitigation Strategies
- **Endpoint Detection & Response (EDR):** Deploy tools that track process lineage and original file metadata rather than just process names.
- **Principle of Least Privilege:** Restrict the ability of standard users to create scheduled tasks or write to `C:\Windows\`.
- **Script Block Logging:** Enable PowerShell Script Block Logging (Event ID 4104) to capture the de-obfuscated code after it is decoded from the `.chk` file.
## Related Tools/Techniques
- **Living off the Land Binaries (LoLBins):** Use of `mshta` and `powershell`.
- **Deceptive File Extensions:** Using `.chk` for script payloads.
- **DNS TXT Record Downloader:** Used by the secondary stage for command retrieval.