Dropper

3048.ps1

Author: Moise Medici
Updated: 13 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Command Execution via Powershell Cmd Bash In-Process Shellcode Execution Command and Control C2 Communication Dropping Secondary Payloads
Tags: ps1 shellcode

stage2.ps1 Dynamic Analysis

To confirm the understanding above, we can run the PowerShell script with TCPView open, expecting to see the network connection from powershell.exe to the IP address found.

Before running stage2.ps1, one small fix is needed. The iI helper function must be renamed to anything else (I used helperType), since otherwise it collides with the alias of Invoke-Item 6, which makes the script crash. This was probably not an issue at the time the script was created, as the Invoke-Item alias may not have been present.

powershell_connection — Fig. : Network connection coming from powershell.exe.

The connection is seen as expected, though it fails after a while, since the host is no longer responding.