Deobfuscate PowerShell using PowerShell Logging

Why do we need to do this?

• Easy technique to deobfuscate PowerShell without using any external tool
• Extract CC from PowerShell

Sample

• Qakbot: Download hta file (Md5: 9ce2f8566be903e4bd9159b1b06900f4) used by Qakbot from ANY.RUN.
• Emotet: Download Emotet downloader sample from zip archive 2018-05-04-Emotet-malware.zip  / Virustotal

Enable PowerShell Logging

Windows 10 VM doesn’t require any software updates to support enhanced PowerShell logging. But if you still want to configure Windows 7 VM, please check the FireEye article Greater Visibility Through PowerShell Logging.

1. Open Local Group Policy editor and navigate to
Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell

Initial PowerShell Logging Setting

PowerShell Group Policy Setting

Steps

1. Open Event Viewer and navigate to Windows Logs -> Application and Service Logs -> Windows PowerShell, right click and clear the existing logs
2. Execute the malware and wait for some time 30-60 sec.
3. Open ProcessHacker and check for termination of PowerShell process.
4. Open EventViewer and navigate to Windows PowerShell log and check the entries, you will see some deobfuscated PowerShell
5. Analyze PowerShell if needed to extract CC info

Example of Emotet & Qakbot

Qakbot

1. hta file contain Obfuscated VBScript code
   

   Initial Obfuscated hta

   Initial Obfuscated hta file which contain VBScript
2. Deobfuscate VBScript by replacing ]+($)#!%/=[?-_&*<> with ” and you can see obfuscated PowerShell.
   

   Initial Obfuscate PowerShell

   Initial Obfuscate PowerShell
3. But we don’t need to do above step, we can just run the hta file and see more clearer PowerShell code shown below.
   

   Qakbot PowerShell Deobfuscation

   2nd level deobfuscated code is much better as you can see the CC
4. Extract CC by executing below PowerShell code
   

   Qakbot CC

   Execute PowerShell Code to extract CC

Emotet