← Reports

Dropper

3048.ps1

Author
Moise Medici
Updated
13 Sept 2026 · Completed
Difficulty
Easy
Platform
Windows
Languages
PowerShellx64 Assembly (shellcode)
MITRE
T1059.001 (Command and Scripting Interpreter: PowerShell) T1106 (Native API) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1027.015 (Obfuscated Files or Information: Compression) T1140 (Deobfuscate/Decode Files or Information) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer)

Appendix

  • 1 Microsoft: VirtualAlloc function
  • 2 Microsoft: CreateThread function
  • 3 Microsoft: WaitForSingleObject function
  • 4 Microsoft: delegates
  • 5 Microsoft: Memory Protection Constants
  • 6 Microsoft: InvokeItem function