Counterfeit Installers Drive a Multi-Stage System Compromise

Summary

An active malware campaign is using counterfeit software download websites to impersonate trusted vendors and distribute malicious installers. Once executed, the installers deploy malware that establishes persistence, weakens security controls, and communicates with attacker-controlled infrastructure. The campaign primarily targets Chinese-speaking users and China-based organizations across multiple industries.

Investigation

Microsoft Defender detected and disrupted several stages of the attack chain, including through automated containment. Investigators identified server-side payload regeneration that causes archive hashes to change with every download. Telemetry also linked the malicious archives to specific spoofed domains and a rotating set of payload delivery hosts.

Mitigation

Organizations should prioritize blocking downloads from untrusted sources and ensure Tamper Protection is enabled to prevent unauthorized security configuration changes. SmartScreen, network protection, and Microsoft Defender XDR should also be enabled where available. Users should be trained to recognize and avoid look-alike domains impersonating legitimate software vendors.

Response

If malicious activity is detected, responders should focus on fully removing persistence mechanisms, since automated disruption may not eliminate all scheduled tasks. Reviewing FileOriginReferrerUrl can help identify the original download source. Analysts should also hunt for randomized file-drop patterns in world-writable directories and investigate related persistence artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary targets a user via a spoofed website. The user downloads a file named app_setup.6653004.zip via Microsoft Edge. The attacker then executes a malicious MSI installer that uses the -Embedding flag to masquerade its activity. Finally, the installer invokes cmd.exe to run vssadmin delete shadows /all /quiet to ensure the victim cannot recover files after a subsequent ransomware deployment. Separately, the attacker attempts to bypass Windows Defender by using PowerShell to add an exclusion path.

• Regression Test Script:

  # Simulation of Counterfeit Software Campaign
  
  Write-Host "[+] Starting Simulation: Counterfeit Software Campaign" -ForegroundColor Cyan
  
  # 1. Simulate Edge downloading the specific filename (Note: We simulate the process event)
  # Since we can't easily force Edge to download a specific name via script without a web server,
  # we simulate the process creation event that the rule expects.
  Write-Host "[+] Step 1: Simulating Edge process with specific download command line..."
  Start-Process "msedge.exe" -ArgumentList "--downloads app_setup.6653004.zip" -WindowStyle Hidden
  
  # 2. Simulate the MSIExec exploitation/embedding pattern
  Write-Host "[+] Step 2: Simulating malicious MSIExec embedding..."
  Start-Process "msiexec.exe" -ArgumentList "-Embedding E GlobalMSI0000" -WindowStyle Hidden
  
  # 3. Simulate the VSSAdmin Shadow Copy Deletion (The 'Chain' completion)
  Write-Host "[+] Step 3: Simulating VSSAdmin shadow copy deletion via CMD..."
  Start-Process "cmd.exe" -ArgumentList "/c vssadmin delete shadows /all /quiet" -WindowStyle Hidden
  
  # 4. Simulate PowerShell Exclusion (The standalone detection)
  Write-Host "[+] Step 4: Simulating PowerShell Defender Exclusion..."
  Start-Process "powershell.exe" -ArgumentList "Add-MpPreference -ExclusionPath 'C:TempMalware'" -WindowStyle Hidden
  
  Write-Host "[+] Simulation commands sent. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: Remove the exclusion path added during simulation
  Write-Host "[+] Cleaning up: Removing PowerShell Defender Exclusion..." -ForegroundColor Yellow
  powershell.exe -Command "Remove-MpPreference -ExclusionPath 'C:TempMalware'"
  
  # Note: VSSAdmin deletion is difficult to "undo" via script; this is a destructive action 
  # intended for testing in a lab environment only.