Fileless Malware Analysis & PowerShell Deobfuscation
Source: YouTube · John Hammond · published Jun 5, 2024 · 26:44
This video details the reverse engineering of a malware persistence mechanism that utilizes environment variables and the Windows Registry to hide and execute a PowerShell downloader 0:00-0:20 5:10-5:58.
Key Takeaways:
• The malware employs obfuscated autorun commands that use environment variables and the -w 1 flag to minimize PowerShell windows during execution 0:20-0:35 3:00-3:19.
• Payloads are stored fileless in the HKEY_CURRENT_USER registry hive and retrieved using Get-ItemProperty to evade file system detection 4:47-5:11.
• A custom PowerShell function within the script extracts every sixth character from obfuscated strings to reveal the actual commands, such as Start-BitsTransfer 10:00-10:45.
• The final payload attempts to download a malicious .cur file from an external domain, though the server was no longer active during the investigation 18:58-19:32 22:07-22:25.
The investigator demonstrates how static analysis and sandboxing can uncover malware logic even when command-and-control servers are offline 21:00-21:30.
Sources:
- 0:00-0:20 Introduction to malware autoruns and persistence
- 5:10-5:58 Explanation of fileless malware in the registry
- 10:00-10:45 Deobfuscation via string extraction
- 18:58-19:32 Discovery of the BITS transfer downloader
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I have a handful of Auto runs that have been set up and installed by malware and I mean auto run in that it will automatically run and execute an invoke code just as the user logs in or the computer starts up and it's set up as a persistence mechanism for thread actors adversaries hackers and malware now this is the syntax in fact I have each of these on different lines these are all different Auto runs that have been set up and staged on different compromised windows hosts each individual endpoint had their own unique little Stager here set up as a scheduled task or service however they might set up this hook and Claw for an auto run and persistence let me grab one of these just as an example something for us to look at explore and understand and you might already know all the things that…