Dropper

3048.ps1

Author: Moise Medici
Updated: 13 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Languages: PowerShell x64 Assembly (shellcode)
MITRE: T1059.001 (Command and Scripting Interpreter: PowerShell) T1106 (Native API) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1027.015 (Obfuscated Files or Information: Compression) T1140 (Deobfuscate/Decode Files or Information) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer)

stage2.ps1 Dynamic Analysis

To confirm the understanding above, we can run the PowerShell script with TCPView open, expecting to see the network connection from powershell.exe to the IP address found.

Before running stage2.ps1, one small fix is needed. The iI helper function must be renamed to anything else (I used helperType), since otherwise it collides with the alias of Invoke-Item 6, which makes the script crash. This was probably not an issue at the time the script was created, as the Invoke-Item alias may not have been present.

powershell_connection — Fig. : Network connection coming from powershell.exe.

The connection is seen as expected, though it fails after a while, since the host is no longer responding.