Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
An active malware campaign is using counterfeit software download websites to impersonate trusted vendors and distribute malicious installers. Once executed, the installers deploy malware that establishes persistence, weakens security controls, and communicates with attacker-controlled infrastructure. The campaign primarily targets Chinese-speaking users and China-based organizations across multiple industries.
Investigation
Microsoft Defender detected and disrupted several stages of the attack chain, including through automated containment. Investigators identified server-side payload regeneration that causes archive hashes to change with every download. Telemetry also linked the malicious archives to specific spoofed domains and a rotating set of payload delivery hosts.
Mitigation
Organizations should prioritize blocking downloads from untrusted sources and ensure Tamper Protection is enabled to prevent unauthorized security configuration changes. SmartScreen, network protection, and Microsoft Defender XDR should also be enabled where available. Users should be trained to recognize and avoid look-alike domains impersonating legitimate software vendors.
Response
If malicious activity is detected, responders should focus on fully removing persistence mechanisms, since automated disruption may not eliminate all scheduled tasks. Reviewing FileOriginReferrerUrl can help identify the original download source. Analysts should also hunt for randomized file-drop patterns in world-writable directories and investigate related persistence artifacts.
Attack Flow
We are still updating this part.
Detections
LOLBAS Schtasks (via cmdline)
Suspicious Execution from Public User Profile (via process_creation)
Suspicious VSSADMIN Activity (via cmdline)
Windows Defender Preferences Suspicious Changes (via powershell)
Suspicious Files in Public User Profile (via file_event)
IOCs (HashSha256) to detect: Counterfeit installers to system compromise: Tracking a deceptive software download campaign
IOCs (SourceIP) to detect: Counterfeit installers to system compromise: Tracking a deceptive software download campaign
IOCs (DestinationIP) to detect: Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Detection of Command-and-Control Communication via Non-Standard Ports [Windows Network Connection]
Detection of Counterfeit Software Download Campaign Activities [Windows Process Creation]
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands: The adversary targets a user via a spoofed website. The user downloads a file named
app_setup.6653004.zipvia Microsoft Edge. The attacker then executes a malicious MSI installer that uses the-Embeddingflag to masquerade its activity. Finally, the installer invokescmd.exeto runvssadmin delete shadows /all /quietto ensure the victim cannot recover files after a subsequent ransomware deployment. Separately, the attacker attempts to bypass Windows Defender by using PowerShell to add an exclusion path. -
Regression Test Script:
# Simulation of Counterfeit Software Campaign Write-Host "[+] Starting Simulation: Counterfeit Software Campaign" -ForegroundColor Cyan # 1. Simulate Edge downloading the specific filename (Note: We simulate the process event) # Since we can't easily force Edge to download a specific name via script without a web server, # we simulate the process creation event that the rule expects. Write-Host "[+] Step 1: Simulating Edge process with specific download command line..." Start-Process "msedge.exe" -ArgumentList "--downloads app_setup.6653004.zip" -WindowStyle Hidden # 2. Simulate the MSIExec exploitation/embedding pattern Write-Host "[+] Step 2: Simulating malicious MSIExec embedding..." Start-Process "msiexec.exe" -ArgumentList "-Embedding E GlobalMSI0000" -WindowStyle Hidden # 3. Simulate the VSSAdmin Shadow Copy Deletion (The 'Chain' completion) Write-Host "[+] Step 3: Simulating VSSAdmin shadow copy deletion via CMD..." Start-Process "cmd.exe" -ArgumentList "/c vssadmin delete shadows /all /quiet" -WindowStyle Hidden # 4. Simulate PowerShell Exclusion (The standalone detection) Write-Host "[+] Step 4: Simulating PowerShell Defender Exclusion..." Start-Process "powershell.exe" -ArgumentList "Add-MpPreference -ExclusionPath 'C:TempMalware'" -WindowStyle Hidden Write-Host "[+] Simulation commands sent. Check SIEM for alerts." -ForegroundColor Green -
Cleanup Commands:
# Cleanup: Remove the exclusion path added during simulation Write-Host "[+] Cleaning up: Removing PowerShell Defender Exclusion..." -ForegroundColor Yellow powershell.exe -Command "Remove-MpPreference -ExclusionPath 'C:TempMalware'" # Note: VSSAdmin deletion is difficult to "undo" via script; this is a destructive action # intended for testing in a lab environment only.
