Full Report
To avoid detection, hackers often turn a system’s own tools against itself. Here, we examine a malicious payload that was executed using PowerShell.
Analysis Summary
# Tool/Technique: PowerShell-based Registry Resident Payload
## Overview
This technique involves "Living off the Land" (LotL) by utilizing Windows PowerShell to execute malicious code stored directly within the Windows Registry. The primary purpose is to establish persistence while maintaining a fileless footprint, thereby avoiding traditional file-based antivirus detection.
## Technical Details
- **Type**: Technique (Living off the Land / Fileless Malware)
- **Platform**: Windows
- **Capabilities**: Persistence, Base64 decoding, Gzip decompression, Dynamic API resolution, Memory allocation, and Shellcode execution.
- **First Seen**: Article published February 9, 2021.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- **TA0005 - Defense Evasion**
- T1112 - Modify Registry
- T1027 - Obfuscated Files or Information
- T1620 - Reflective Code Loading
## Functionality
### Core Capabilities
- **Registry Resident Execution**: The malware uses a "Run Key" (HKLM) to launch a PowerShell command that reads a secondary registry value containing the actual payload.
- **Multi-stage Obfuscation**: The payload uses nested layers of Base64 encoding and UTF-16 string formatting to hide its logic.
- **Decompression**: Utilizes `IO.Compression.GzipStream` to unpack compressed malicious scripts directly into memory.
### Advanced Features
- **Reflective Injection**: The script uses a custom function (`func_get_proc_address`) to dynamically locate Windows API functions.
- **Memory Management**: Calls `VirtualAlloc()` to carve out executable memory space and `CreateThread()` to execute injected shellcode without writing a PE file to disk.
- **Environment Mimicry**: The shellcode includes a hardcoded User-Agent string (e.g., `Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; ASU2JS)`) to disguise C2 traffic as legitimate web browsing.
## Indicators of Compromise
- **File Names**: N/A (Fileless; utilizes `powershell.exe`).
- **Registry Keys**:
- `HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run` (Specifically values with non-standard/hidden characters like ``).
- `HKLM\Software\` (Or other non-standard keys used to store large Base64 blobs).
- **Network Indicators**:
- User-Agent: `Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; ASU2JS)`
- **Behavioral Indicators**:
- PowerShell processes spawned with `FromBase64String` and `IEX` (Invoke-Expression) arguments.
- PowerShell loading `System.IO.Compression` or calling `VirtualAlloc`.
## Associated Threat Actors
- While this specific instance was identified via Huntress ThreatOps, these LotL techniques are heavily utilized by:
- **Cobalt Strike** users (the shellcode structure is consistent with Cobalt Strike beacons).
- **APT groups** and sophisticated ransomware affiliates seeking to bypass EDR.
## Detection Methods
- **Behavioral Detection**: Monitor for PowerShell execution originating from Registry Run keys, especially those containing `DownloadString`, `IEX`, or `FromBase64String`.
- **Registry Monitoring**: Audit the creation of unusually large registry values (data blobs) in HKLM/HKCU software hives.
- **Memory Scanning**: Use EDR tools to scan for unbacked executable memory regions (Result of `VirtualAlloc`).
## Mitigation Strategies
- **Hardening**: Implement PowerShell Constrained Language Mode (CLM) via AppLocker or Windows Defender Application Control (WDAC).
- **Prevention**: Restrict administrative privileges to prevent modification of HKLM Run keys.
- **Visibility**: Enable Enhanced PowerShell Logging (Script Block Logging - Event ID 4104) to capture de-obfuscated code at execution time.
## Related Tools/Techniques
- **PowerSploit / Reflection**: For dynamic API calling.
- **Cobalt Strike Beacon**: Likely source of the final shellcode payload.
- **Gzip/Base64 Wrappers**: Common delivery methods for fileless delivery.