Unit 42 Inception November 2018

PowerShower is a backdoor written in PowerShell.

Inception has used PowerShell to execute malicious commands and payloads.

Inception has used VBScript to execute malicious commands and payloads.

PowerShower has the ability to save and execute VBScript.

PowerShower has the ability to remove all files created during the dropper process.

PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.

Inception has used HTTP, HTTPS, and WebDav in network communications.

PowerShower has collected system information on the infected host.

PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.

PowerShower has the ability to encode C2 communications with base64 encoding.

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

Inception has used decoy documents to load malicious remote payloads via HTTP.

PowerShower sets up persistence with a Registry run key.

PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.