Listen to this Post
Introduction
Attackers are weaponizing seemingly innocent JPEG files to deliver trojanized versions of legitimate remote access tools like ConnectWise ScreenConnect. This multi-stage PowerShell intrusion chain bypasses traditional email filters by hiding obfuscated scripts inside image file structures, enabling complete system takeover, credential harvesting, and persistent network access without raising immediate suspicion.
Learning Objectives
- Identify and analyze malicious JPEG files containing embedded PowerShell payloads using file header inspection and entropy analysis
- Detect trojanized ScreenConnect installations through registry, process, and network artifact examination on Windows systems
- Implement defensive hardening measures including PowerShell logging, AMSI bypass detection, and application whitelisting
You Should Know
- Anatomy of the Weaponized JPEG Attack – Hidden PowerShell Execution Chain
The attack begins with a file named `sysupdate.jpeg` that lacks valid JPEG byte markers. Instead, the file contains an obfuscated PowerShell script hidden within the file structure. When opened (often via double-click or automated script execution), the system invokes PowerShell to decode and run the payload.
Step‑by‑step breakdown:
- The file masquerades as a JPEG using a `.jpeg` extension and a plausible icon.
- Upon execution (e.g., via a malicious shortcut or script), PowerShell reads the file’s raw bytes.
- An embedded regex or string extraction routine pulls out a Base64-encoded script block.
- Decoded script downloads a trojanized ScreenConnect client (e.g.,
ScreenConnect.Client.exe) from a remote C2 server. - The trojanized client installs itself with legitimate-looking service names to evade detection.
Sample PowerShell extraction code (for analysis in isolated sandbox):
Extract hidden script from suspicious JPEG
$file = "sysupdate.jpeg"
$content = Get-Content -Path $file -Raw -Encoding Byte
$b64pattern = '([A-Za-z0-9+/]{4,})' crude regex for base64
$matches = [bash]::Matches([System.Text.Encoding]::ASCII.GetString($content), $b64pattern)
foreach ($match in $matches) {
try {
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($match.Value))
Write-Host "Decoded block: $decoded"
} catch {}
}
- Detecting Malicious JPEG Files Using Linux and Windows Commands
Legitimate JPEG files begin with `FF D8` (SOI marker) and end with FF D9. Weaponized copies often lack these markers or contain excessive ASCII text. Use the following commands to triage suspicious images.
Linux commands:
Check file header and magic bytes file sysupdate.jpeg hexdump -C sysupdate.jpeg | head -n 5 Extract all strings and look for PowerShell keywords strings sysupdate.jpeg | grep -iE 'powershell|iex|invoke-expression|base64|downloadstring' Use binwalk to detect embedded payloads binwalk -e sysupdate.jpeg Calculate entropy (high entropy may indicate obfuscated/compressed payload) ent sysupdate.jpeg
Windows commands (PowerShell):
Read first 8 bytes as hex Extract all readable strings and filter for suspicious patterns [System.Text.Encoding]::ASCII.GetString((Get-Content "sysupdate.jpeg" -Encoding Byte)) -match 'powershell|iex|frombase64string' Compute file hash for threat intelligence lookup Get-FileHash sysupdate.jpeg -Algorithm SHA256
- Analyzing Obfuscated PowerShell Scripts – Deobfuscation and Sandbox Execution
The malicious JPEG embeds PowerShell code that often uses layer upon layer of obfuscation: Base64, XOR, Gzip compression, and string splitting. Use these techniques to extract the final malicious script.
Step‑by‑step deobfuscation guide:
- Extract the encoded payload from the JPEG using the `strings` or `Get-Content` method above.
- Remove common wrappers like `IEX` (Invoke-Expression) and replace with `Write-Host` or output to file.
- Decode Base64 recursively – many scripts encode multiple times.
4. Expand compressed data using `[System.IO.Compression.GzipStream]`.
Example deobfuscation script:
$encoded = "H4sIAAAAAAAAA... (base64 from JPEG)"
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded))
If still obfuscated, look for further decoding:
if ($decoded -match 'FromBase64String') {
$inner = ($decoded -split '"')[bash]
$final = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($inner))
Write-Host $final
}
Safe execution (sandbox only – do not run on production):
Log every PowerShell command to Event Log Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 Execute in Constrained Language Mode $ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage" Or use a sandbox like Windows Sandbox or FlareVM
- Identifying Trojanized ScreenConnect – Forensics and Persistence Artifacts
The trojanized ScreenConnect client installs itself with subtle modifications. Compare against legitimate ScreenConnect installations and hunt for indicators.
Persistence locations to inspect:
- Services: `sc query | findstr “ScreenConnect”` (Look for misspelled or unusual service names)
- Startup folders: `Get-ChildItem “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp”`
– Run registry keys: `reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
– Scheduled tasks: `schtasks /query /fo LIST /v | findstr “ScreenConnect”`
Network indicators:
Check for established ScreenConnect outbound connections
netstat -ano | findstr "ESTABLISHED" | findstr ":443"
Look for ScreenConnect process ID
Get-Process | Where-Object {$<em>.ProcessName -like "ScreenConnect"}
Examine DNS queries (extract from Windows Event Log 22)
Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" | Where-Object {$</em>.Message -like "screenconnect"}
File indicators:
- Compare file hash with legitimate versions: legitimate ScreenConnect client SHA256 is published by ConnectWise.
- Check digital signature: `Get-AuthenticodeSignature “C:\Program Files\ScreenConnect\\ScreenConnect.Client.exe”`
– Look for unsigned or invalid signatures.
5. Mitigation and Hardening Against PowerShell-Based Image Malware
Prevent these attacks through a combination of email filtering, PowerShell restrictions, and endpoint detection.
Email gateway rules:
- Block or sandbox all image attachments with double extensions (e.g.,
.jpeg.exe,.jpeg.ps1) - Strip executable content from JPEGs – only allow valid image MIME types.
Windows PowerShell hardening (group policy):
Enable PowerShell ScriptBlock Logging (Event ID 4104)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
Constrain PowerShell to execution policy AllSigned or RemoteSigned
Set-ExecutionPolicy AllSigned -Scope LocalMachine
Enable AMSI (Antimalware Scan Interface) – enabled by default but ensure not disabled
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Name "Enabled" -Value 1
Application control (AppLocker):
- Create rule to block execution of scripts from `%USERPROFILE%\Downloads` and temporary folders.
- Allow only signed ScreenConnect binaries via publisher rule.
Network detection (Suricata/Snort rule example):
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Trojanized ScreenConnect Beacon"; flow:to_server,established; content:"ScreenConnect"; http_uri; content:"ClientAccess"; http_client_body; sid:1000001;)
- Incident Response – Removing the Infection and Recovering
If a system is compromised, follow this IR checklist.
Containment (immediate):
- Isolate the host from network (disable NIC or block via firewall).
- Revoke any session tokens and reset credentials for affected users.
Eradication steps:
Kill malicious ScreenConnect process Stop-Process -Name "ScreenConnect.Client" -Force -ErrorAction SilentlyContinue Remove service sc delete "ScreenConnect_legit_name" Adjust name from investigation Delete persistent run keys Remove-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "ScreenConnectUpdate" -ErrorAction SilentlyContinue Delete scheduled tasks Unregister-ScheduledTask -TaskName "ScreenConnectMaintenance" -Confirm:$false Remove the JPEG and any dropped payloads Remove-Item "sysupdate.jpeg" -Force Remove-Item "$env:TEMP.exe" -Filter "ScreenConnect" -Force
Forensic collection:
- Capture memory dump using `DumpIt` or
WinPmem. - Collect PowerShell Event Logs: `Get-WinEvent -LogName “Microsoft-Windows-PowerShell/Operational” | Export-Clixml pslogs.xml`
– Extract prefetch files for executed binaries.
What Undercode Say
- Defense in depth is non‑negotiable – Relying solely on extension blocking fails when users double‑click any file. Combine email filtering with PowerShell logging and AMSI.
- Legitimate remote tools are the new C2 – ScreenConnect, TeamViewer, AnyDesk are now top vectors. Enforce signed binaries and restrict outbound RMM traffic to approved IPs.
- User training must pivot to “behavior over extension” – Teach users that a JPEG asking to run scripts or showing a Command Prompt window is malicious regardless of icon.
- Base64‑heavy detection rules – Monitoring for Base64 strings inside image files via YARA or EDR can pre‑block these attacks before script execution.
- Least privilege for PowerShell – ConstrainedLanguage mode and execution policy prevented many infections; attack succeeds where bypasses exist (e.g.,
-ExecutionPolicy Bypass). Remove admin rights.
Prediction
This weaponized JPEG technique will rapidly evolve into polymorphic variants that use steganography within legitimate JPEG chroma channels, not just appended payloads. We will see cross‑platform versions targeting Linux desktops using ImageMagick vulnerabilities to trigger Python or Bash implants. Organizations will need to adopt Content Disarm and Reconstruction (CDR) for all image attachments by late 2026, and EDR vendors will add dedicated “image script injection” heuristics. The use of trojanized remote tools will shift toward signed but vulnerable versions of AnyDesk and RustDesk, forcing a zero‑trust model for all remote access software regardless of digital signature status.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cybersecuritynews Gbhackers – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
