Analyzing PowerShell Scripts

1. Understanding PowerShell Scripts:

• Threat Actor Use:

  • PowerShell scripts are popular among threat actors for post-exploitation activities.

• Identifying PowerShell Scripts:

  • Familiarity with PowerShell syntax is crucial. Common keywords include:

    • function: Defines a function.

    • Set-Alias: Creates an alias for a cmdlet or function.

    • IEX (Invoke-Expression): Executes a string or script passed to it.

2. Tools for Analysis:

• Text Editor for Static Analysis:

  • View the script in a text editor for basic, static analysis.

• PowerShell ISE (Integrated Scripting Environment):

  • An IDE tool by Microsoft for developing and debugging PowerShell scripts.

  • Pre-installed on Windows, useful for dynamic analysis.

3. Practical Analysis:

• Sample File Analysis: (say)

  • Analyze re_test_dlx.ps1 using PowerShell ISE.

  • Initial Check:

    • Use tools like Detect It Easy to verify the script is in plain text format.

• Loading the Script:

  • Open the script in PowerShell ISE.

  • Long lines in the script may require horizontal scrolling as PowerShell ISE lacks word wrapping.

• Beautifying the Script:

  • Break down complex, long lines to improve readability.

  • Use code formatting techniques like:

    • Curly Braces ({}): Expand functions based on these brackets.

    • Semi-Colons (;): Break down lines at each semi-colon.

  • Alternatively, use external code beautification tools for better results.

• Identifying Functions:

  • Look for functions like encode and analyze their content.

  • Example: A function that decodes a Base64 string can be manually decoded using tools like CyberChef.

4. Debugging the Script:

• Setting Breakpoints:

  • Use F9 to set breakpoints.

  • Example: Set a breakpoint at the Set-Alias command to intercept script execution.

• Debugging Process:

  • Set-Alias Command:

    • Associates XXX as an alias for the IEX function, enabling XXX to execute scripts.

  • Execution Interception:

    • Replace IEX with Write-Host to output the script to the console instead of executing it.

• Handling Pipes (|):

  • Pipes are used to pass the output from one command to another.

  • Alternative Debugging:

    • Break the script at pipes and introduce variables to capture intermediate outputs.

    • Example: Capture and inspect the content of the variable temp before execution.

5. Final Analysis:

• Decrypted Data:

  • The decrypted data reveals another PowerShell script designed to download and execute an executable from www.evil.com.

• Resources:

  • For further analysis, refer to:

    • PowerShell ISE for debugging.

    • Microsoft's Website for PowerShell syntax and standard functions.

Key Takeaways:

• PowerShell ISE:

  • A powerful tool for dynamically analyzing and debugging PowerShell scripts.

• Debugging Techniques:

  • Intercepting script execution and replacing key functions can reveal hidden behaviors.

• Use of External Tools:

  • Tools like CyberChef are essential for decoding and analyzing encoded data within scripts.

• Understanding Syntax:

  • Familiarity with PowerShell syntax is critical for effective script analysis and detection of malicious activities.