
Installer turns an obscure resource file into PowerShell input
The executable dropped `Amnesias.Und`, then launched PowerShell to read its contents and derive a command name from them. A separate test of the same script content produced a desktop PE, but the records do not show that output as a completed stage of the installer run.
The executable’s PowerShell child did not launch a conventional .ps1 file. Its command read Amnesias.Und from a directory under the user’s roaming profile, extracted three characters from the file’s contents and used the resulting string as a command name. That raises a more useful question than whether the installer used PowerShell: was this obscurely named file a passive resource, or part of the execution mechanism? The records establish the latter.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read