How to Analyze a PowerShell Dropper

How to Analyze a PowerShell Dropper

Step 1: Safely Obtain the Script

• Copy script text (do NOT execute)
• Save to analysis VM as .ps1 file

Step 2: Decode Obfuscation Layers

Common obfuscation patterns:

# Base64 encoded command
powershell -enc [Base64String]
# Decode: [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("..."))

# String concatenation
$a="Inv"; $b="oke-"; $c="Web"; iex ($a+$b+$c+"Request")

# Character code arrays
[char[]]@(73,69,88) -join ''  # = "IEX"

Step 3: Identify the Download Cradle

Look for patterns:

• Invoke-WebRequest / iwr
• Net.WebClient.DownloadString
• Net.WebClient.DownloadFile
• Start-BitsTransfer

Step 4: Extract IOCs

• Download URL(s)
• File paths where payloads are saved
• Registry keys for persistence
• Scheduled task names

Step 5: Map to ATT&CK

• T1059.001 – PowerShell execution
• T1140 – Deobfuscation
• T1105 – Ingress tool transfer
• T1547.001 – Registry Run key persistence

Common Mistakes

• Accidentally executing the script on your host
• Not decoding all obfuscation layers
• Missing secondary payloads referenced in the script