Nullify AMSI Scanner with PowerShell

 AMSI as per Microsoft is: "The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product that's present on a machine. AMSI provides enhanced malware protection for your end-users and their data, applications, and workloads."

AMSI is being used by multiple antimalware products and is known to cause headache to the malicious actors. Hence malicious actors and red teamers started finding ways around disabling AMSI.

Below is one such PowerShell snippet that's making rounds in the wild made use by the actors to nullify AMSI scanner.

The PowerShell code initially gets hold of the "AmsiScannerBuffer" API and changes the memory protection. Post that it replaces the initial '7' bytes of the function with these bytes - "66B80100C21800". When checking the function now the prologue looks much different.

The overwritten bytes made changes in AmsiScanBuffer so that it always returns '1' (AMSI_RESULT_NOT_DETECTED) denoting that the script that is being scanned is not detected, thus nullifying the effect of AMSI.

References

• https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
• https://docs.microsoft.com/en-us/windows/win32/api/amsi/nf-amsi-amsiscanbuffer
  

Frida DBI - DeObfuscate PowerShell Script

Frida is a Dynamic Binary Instrumentation (DBI) toolkit that can be used to hook into live processes, analyze various parts of the program and print out debug information including but not limited to getting loaded modules, executed functions, arguments passed to the function etc.

In this blog we'll use "frida-trace", part of Frida toolset to de-obfuscate obfuscated powershell script. When PowerShell loads it get injected with a dll "amsi.dll" that is the core of the "Anti Malware Scan Interface".

"amsi.dll" includes a function called "AmsiScanBuffer" that's called to analyze the powershell scripts executed. Every powershell script that gets executed is initially run through the "AmsiScanBuffer" function that determines whether the script that's to be executed is benign or malicious. If it is malicious the script is terminated and an error is raised. The arguments passed to the "AmsiScanBuffer" from MSDN,



As you can see the 2nd argument that's passed to the function "buffer" contains the buffer that is passed for scanning. "frida-trace"can be used to hook into this function and print out the contents of the "buffer" argument.

"frida-trace" can be run with minimal arguments initially to create a skeleton handler file.

Once you execute the above command you should have a ".js" file created automatically in your python path - "C:\Python36\Scripts\__handlers__\amsi.dll\AmsiScanBuffer.js". You can edit this file to print the necessary argument, in our case argument 1. Argument 1 is a wide string that can be printed on to the console using "log(Memory.readUtf16String(args[1]));"

 

Saving the file will automatically load the script into memory.

Now lets runs an obfuscated powershell script and see if we get de-obfuscated version of it. I took a malicious script from cylance's blog. Running the malicious powershell script in powershell window prints out the de-obfuscated version (which is essentially the 2nd stage of the script) that downloads and runs the final payload. The obfuscated version and de-obfuscated version of the script side by side in the below snapshot.

The complete de-obfuscated script below,