Part 2 of the HTA file analysis explains how the embedded payload is decrypted: base64 decoding, AES decryption in ECB mode, and gzip decompression to reveal the final payload. It also outlines the tooling workflow (base64dump.py, myjson-transform.py, numbers-to-string.py) used to extract and process the payload. hashtags: #HTA #AES #PowerShell #DidierStevens #MalwareBazaar
Keypoints
- Identifies a variable containing the BASE64 encoded ciphertext embedded in the PowerShell script.
- Identifies a second variable containing the BASE64 encoded encryption key.
- Notes that the encryption uses AES with ECB mode (IV is present in the data but not used).
- States that the payload is base64-decoded, decrypted, and then gzip-decompressed to obtain the decoded payload.
- Describes a tooling workflow: base64dump.py to extract strings, and myjson-transform.py to process JSON data.
- Reveals that the decrypted payload is another PowerShell script which contains an encoded payload leading to a URL and a .bat file.
MITRE Techniques
- [T1059.001] PowerShell – The payload cycle uses PowerShell to handle decryption and context; ‘The decrypted payload is another PowerShell script …’
- [T1140] Deobfuscate/Decode Files or Information – The flow explicitly decodes, decrypts, and decompresses data to obtain the payload; ‘Thus, to obtain the decoded payload, we need to BASE64-decode it, decrypt it and decompress it.’
- [T1027] Obfuscated/Compressed Files and Information – The process relies on BASE64 encoded ciphertext and gzip decompression steps; ‘BASE64 encoded ciphertext’ and ‘GZip decompression classes & methods.’
- [T1105] Ingress Tool Transfer – The workflow downloads a payload from a URL and retrieves a .bat file from MalwareBazaar; ‘The file obtained from this URL, is a .bat file and can be found on MalwareBazaar too.’
- [T1218.005] Mshta – Signed Binary Proxy Execution (HTA delivery) – The analysis centers on an HTA file used to deliver and execute the payload; ‘The complete command to extract the URL from the HTA file:’
Indicators of Compromise
- [File name] context – 2023-03-24-21-40-33.hta.Loader.6781a85bf0dd90e3ba1390143b17c08244f410dc165fa61bf7d6dacb4a4c8656.hta.zip
- [URL] context – https://isc.sans.edu/diary/Another+Malicious+HTA+File+Analysis+Part+2/29676/
Read more: https://isc.sans.edu/diary/Another+Malicious+HTA+File+Analysis+Part+2/29676/