Dragon Boss Leaves 25,000+ Endpoints Exposed

Summary

A potentially unwanted application signed by Dragon Boss Solutions abused a legitimate update workflow to quietly download and run MSI and PowerShell payloads that disabled antivirus protections and established persistence through WMI event subscriptions and scheduled tasks. Because the updater communicated with unregistered domains that could be claimed by anyone, the software effectively created a supply-chain opportunity for arbitrary code delivery. Researchers observed more than 25,000 endpoints reaching out to this infrastructure, including systems in several high-value sectors.

Investigation

Huntress uncovered WMI-based persistence artifacts and a spike in scheduled task creation, then traced the activity back to a signed executable named RaceCarTwo.exe that launched an MSI installer. The installer extracted a PowerShell script called ClockRemoval.ps1, which terminated antivirus processes, blocked access to AV update domains, added Microsoft Defender exclusions, and repeatedly reinstalled itself to maintain foothold. Investigators also found that unregistered domains, including chromsterabrowser.com, were being used as the primary update source, meaning any outside party could register those domains and deliver their own payloads.

Mitigation

To stop further abuse, the research team registered the exposed domains and sinkholed them, effectively cutting off the malicious update path. They also documented the related WMI event subscriptions, scheduled tasks, and registry changes so defenders could identify and remove affected components. Organizations should block the known domains and monitor for the specific task names and WMI consumer activity associated with this campaign to reduce the risk of continued compromise.

Response

Security teams should detect the creation of scheduled tasks such as ClockSetupWmiAtBoot, DisableClockServicesFirst, DisableClockAtStartup, RemoveClockAtLogon, and RemoveClockPeriodic. Alerts should also trigger on WMI event subscriptions containing MbRemoval or MbSetup. Defenders should monitor executables signed by Dragon Boss Solutions, look for the presence of ClockRemoval.ps1 in WMILoad directories, review hosts files for entries that block antivirus vendor domains, and investigate unexpected Windows Defender exclusions across impacted systems.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has obtained the legitimate RaceCarTwo.exe signed by Dragon Boss Solutions LLC. They leverage the binary’s trusted status to bypass application whitelisting. First, they deploy a malicious MSI (Setup.msi) that drops a privileged service and installs a scheduled task to achieve T1546.016. Next, they execute a PowerShell script (ClockRemoval.ps1) that disables or uninstalls the endpoint AV product, reflecting T1059.001. Both actions are performed from the same process, ensuring the detection rule sees the exact command‑line patterns.

  1. Deploy malicious MSI:

     Start-Process -FilePath "C:Program FilesDragonBossRaceCarTwo.exe" `
                   -ArgumentList "Setup.msi" `
                   -Wait

  2. Execute AV‑disable PowerShell script:

     Start-Process -FilePath "C:Program FilesDragonBossRaceCarTwo.exe" `
                   -ArgumentList "ClockRemoval.ps1" `
                   -Wait

• Regression Test Script:
  The script below automates the two steps in a single run, reproducing the exact telemetry the Sigma rule expects.

  # -------------------------------------------------
  # Simulation of DragonBoss malicious execution chain
  # -------------------------------------------------
  $binaryPath = "C:Program FilesDragonBossRaceCarTwo.exe"
  
  # 1. Install malicious MSI
  Write-Host "[*] Deploying malicious MSI (Setup.msi)…"
  Start-Process -FilePath $binaryPath -ArgumentList "Setup.msi" -Wait
  
  # 2. Run AV‑disable PowerShell script
  Write-Host "[*] Executing ClockRemoval.ps1 via the same binary…"
  Start-Process -FilePath $binaryPath -ArgumentList "ClockRemoval.ps1" -Wait
  
  Write-Host "[+] Simulation complete. Verify alerts in the SIEM."

• Cleanup Commands:
  Remove any artifacts created during the simulation to restore the host to its pre‑test state.

  # -------------------------------------------------
  # Cleanup for DragonBoss simulation
  # -------------------------------------------------
  # Remove the installed MSI product (replace ProductCode with actual GUID)
  $productCode = "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}"
  try {
      Write-Host "[*] Uninstalling malicious MSI..."
      msiexec /x $productCode /quiet /norestart
  } catch { Write-Warning "MSI uninstall failed or product not present." }
  
  # Delete the PowerShell script if it was written to disk by the MSI
  $scriptPath = "$env:ProgramDataClockRemoval.ps1"
  if (Test-Path $scriptPath) {
      Write-Host "[*] Removing ClockRemoval.ps1..."
      Remove-Item $scriptPath -Force
  }
  
  Write-Host "[+] Cleanup complete."