Fake Windows Support Site Delivers Password-Stealing Malware

Summary

A typosquatted website impersonating Microsoft Support is pushing a fake Windows Update MSI. Once installed, the MSI deploys an Electron-based app that triggers a VBS starter, launches a renamed Python interpreter, and loads credential-theft modules. Stolen data is routed through Render, Cloudflare Workers, and GoFile, while persistence is set via a Run registry value and a Startup shortcut. The activity is tailored to French-speaking users.

Investigation

Researchers obtained WindowsUpdate 1.0.0.msi and confirmed it drops an Electron wrapper (WindowsUpdate.exe) plus a VBS launcher (AppLauncher.vbs). The Electron process then spawns a hidden Python runtime (_winhost.exe), which imports common information-stealing libraries to collect browser credentials, Discord tokens, and payment data. Network telemetry shows initial host profiling to www.myexternalip.com and ip-api.com, followed by C2 traffic to datawebsync-lvmv.onrender.com and sync-service.system-telemetry.workers.dev, with exfiltration observed to store8.gofile.io. Persistence is established by creating a SecurityHealth value under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and placing Spotify.lnk in the user Startup folder.

Mitigation

Remove the SecurityHealth Run value and delete Spotify.lnk from the user’s Startup folder. Delete the WindowsUpdate directory under AppData\Local\Programs and remove the temporary WinGettools folder. Reset stored passwords, enable MFA/2FA, and run a full scan using updated anti-malware protections.

Response

If alerts trigger on the suspicious MSI, VBS execution, or creation of the Run key, isolate the host, capture volatile data, and perform forensic triage of relevant AppData paths. Block the identified C2 domains and track traffic to the listed recon services. Remove persistence artifacts and reinforce safe update workflows to prevent repeat execution.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has obtained a foothold on the user’s workstation and wishes to maintain persistence across reboots while evading casual inspection. They drop a malicious payload named WindowsUpdate.exe into the user’s AppData folder, then create a Run‑key named SecurityHealth that points to this payload, deliberately mimicking the legitimate “Windows Security Health” service. Because the rule watches for exactly this key path, the activity should be flagged.

  ```powershell
  # 1. Drop the malicious payload (simulated with a harmless text file for testing)
  $payloadPath = "$env:APPDATAMicrosoftWindowsUpdateWindowsUpdate.exe"
  New-Item -ItemType Directory -Path (Split-Path $payloadPath) -Force | Out-Null
  Set-Content -Path $payloadPath -Value "This is a dummy malicious executable for testing." -Encoding ASCII
  
  # 2. Create the malicious Run key that masquerades as SecurityHealth
  $runKey = 'HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun'
  New-ItemProperty -Path $runKey -Name 'SecurityHealth' -Value $payloadPath -PropertyType String -Force
  ```

• Regression Test Script:

  ```powershell
  # -------------------------------------------------
  # Regression Test – Registry Persistence Masquerade
  # -------------------------------------------------
  # Purpose: Reproduce the exact telemetry that the Sigma rule expects.
  # Works on Windows 10/11 with admin privileges.
  
  # Define payload location
  $payload = "$env:APPDATAMicrosoftWindowsUpdateWindowsUpdate.exe"
  
  # Ensure the directory exists
  if (-not (Test-Path (Split-Path $payload))) {
      New-Item -ItemType Directory -Path (Split-Path $payload) -Force | Out-Null
  }
  
  # Create a dummy executable (in a real test this would be the malicious binary)
  Set-Content -Path $payload -Value "MALICIOUS_BINARY_PLACEHOLDER" -Encoding ASCII
  
  # Register the Run key with a masqueraded name
  $runKeyPath = 'HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun'
  New-ItemProperty -Path $runKeyPath -Name 'SecurityHealth' -Value $payload -PropertyType String -Force
  
  Write-Host "Malicious Run key created. Expect detection alert shortly."
  # -------------------------------------------------
  ```

• Cleanup Commands:

  ```powershell
  # Remove the malicious Run key
  Remove-ItemProperty -Path 'HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun' -Name 'SecurityHealth' -ErrorAction SilentlyContinue
  
  # Delete the dummy payload file and its folder
  $payloadDir = Split-Path "$env:APPDATAMicrosoftWindowsUpdateWindowsUpdate.exe"
  Remove-Item -Path $payloadDir -Recurse -Force -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup completed."
  ```