{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Active malware campaign using server-side payload regeneration makes hash-based detection alone ineffective. This hunt provides confidence by correlating infrastructure leads with behavioral indicators." }, "name": "Counterfeit software delivery and randomized execution", "type": "investigation", "labels": [ "hunt", "attack.t1566.002", "attack.t1204.002", "attack.t1036.005" ], "series": { "slug": "counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign", "index": 1, "title": "Counterfeit installers to system compromise: Tracking a deceptive software download campaign", "total": 2 }, "related": [ { "hunt": "silver-fox-task-persistence", "reason": "Persistence through scheduled tasks is a downstream stage that requires baselining of the Schedule service.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A detection rule fires on a single domain. This hunt pivots from a network lead into a behavioral audit: looking for rare processes extracted by archivers into public paths and verifying them against fabricated metadata used by the actor.", "coverage": [ { "stage": "initial-access-spoofed-sites", "steps": [ "dns-campaign-lead" ], "status": "covered" }, { "stage": "delivery-dynamic-archive", "steps": [ "rare-archiver-execution" ], "status": "covered" }, { "stage": "execution-randomized-payloads", "steps": [ "metadata-masquerade-audit" ], "status": "covered" }, { "stage": "persistence-scheduled-task", "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.", "status": "out_of_scope" }, { "stage": "c2-alibaba-oss-update", "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Spoofed software-download sites", "slug": "initial-access-spoofed-sites", "tactic": "initial-access", "techniques": [ "T1566.002" ], "observables": [ "pc-razerzone.com.cn", "app-microsoft-edge.com.cn", "kaspersky-lab.hl.cn", "calibre-ebook.com.cn", "gehie246.com", "yimxg25tiy.com", "cc8ttkv35b.com" ] }, { "name": "Dynamically generated installer archive", "slug": "delivery-dynamic-archive", "tactic": "execution", "techniques": [ "T1204.002" ], "observables": [ "app_setup.6653004.zip", "zinst.zip", "zintall.zip", "intsoft.zip", "innstll.zip", "/712down", "/73inst" ] }, { "name": "Randomized stage-one payload execution", "slug": "execution-randomized-payloads", "tactic": "execution", "techniques": [ "T1204.002", "T1036.005" ], "observables": [ "a_instapp83353001.exe", "C:\\Users\\Public\\", "C:\\ProgramData\\", "Speech Processing Solutions GmbH", "Philips Speech Driver Client Configuration", "PhilipsSpeechDriverConfiguration.exe", "TODO: ", "6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8" ] }, { "name": "Implant persistence via Scheduled Task", "slug": "persistence-scheduled-task", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "svchost.exe -k netsvcs -p -s Schedule", "C:\\ProgramData\\" ] }, { "name": "Repurposed update client C2", "slug": "c2-alibaba-oss-update", "tactic": "command-and-control", "techniques": [ "T1071", "T1105" ], "observables": [ "upitem.oss-cn-hangzhou.aliyuncs.com", "tu_rt.exe", "_ir_tu2_temp_", "Indigo Rose TrueUpdate Client" ] } ], "summary": "This campaign uses high-fidelity vendor look-alike domains to distribute dynamically generated installer archives to Chinese-speaking users. Once executed, the malicious installers drop randomized payloads that establish persistence via Scheduled Tasks and repurpose legitimate update utilities to retrieve further stages from Alibaba Cloud infrastructure." }, "severity": "high", "rationale": "Start with hosts running software the campaign is known to impersonate (e.g., Razer, Kaspersky, Microsoft Edge) as identified in the scoping step, then use the DNS lead to broaden the search.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has established initial access by tricking a user into downloading a polymorphic installer from a spoofed vendor site, which then launches a masqueraded payload from a randomized directory.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Focus the hunt on specific hosts; leave empty to scan the estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "archiver_names": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[string]", "default": [ "7zfm.exe", "360zip.exe", "winrar.exe" ], "description": "Common archiver binaries used to extract malicious installers." }, "campaign_hashes": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[hash]", "default": [ "6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8" ], "description": "Confirmed SHA256 hashes of late-stage payloads." }, "spoofed_domains": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[domain]", "default": [ "pc-razerzone.com.cn", "kaspersky-lab.hl.cn", "app-microsoft-edge.com.cn", "calibre-ebook.com.cn", "gehie246.com", "yimxg25tiy.com", "cc8ttkv35b.com", "n7b8t85zsg.com" ], "description": "Spoofed vendor and delivery domains from the research." }, "masquerade_companies": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[string]", "default": [ "Speech Processing Solutions GmbH" ], "description": "Fabricated company names observed in malicious payload metadata." }, "masquerade_filenames": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[string]", "default": [ "PhilipsSpeechDriverConfiguration.exe", "tu_rt.exe" ], "description": "Original file names from genuine products being masqueraded." }, "impersonated_packages": { "from": { "ref": "msrc-blog-2026-09-01", "kind": "article", "observed": "2026-09-01" }, "type": "list[string]", "default": [ "razer", "edge", "kaspersky", "sejda", "youdao", "diskgenius", "baidu", "ocam", "draw.io", "steelseries", "sogou", "calibre", "mindmaster" ], "description": "Software names known to be impersonated by the campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/", "name": "MSRC \u2014 Counterfeit installers to system compromise: Tracking a deceptive software download campaign" } ], "blind_spots": [ { "id": "no-dns-visibility", "risk": "If the browser uses DoH, the lead query will return zero results, gating the hunt even if an infection occurred.", "stage": "initial-access-spoofed-sites", "question": "Did the host resolve the domains via DNS-over-HTTPS (DoH)?", "requires": "Endpoint DNS monitoring or proxy decryption" }, { "id": "metadata-rotation", "risk": "The metadata audit is high-fidelity for current samples but will miss payloads using different fabricated resource strings.", "stage": "execution-randomized-payloads", "question": "What if the actor rotates the 'Philips' masquerade brand?", "requires": "hb_process_activity metadata" } ] }, "name": "Counterfeit software delivery and randomized execution", "description": "This hunt identifies the early stages of the Silver Fox (Yinhu) campaign by gating expensive behavioral queries behind a cheap DNS lead. It first identifies hosts running software the campaign frequently impersonates (Kaspersky, Razer, Microsoft Edge) to provide context. The hunt then scans for resolutions of known look-alike domains. If confirmed, it fans out to detect the execution of rare binaries spawned from archiver tools and audits for fabricated file metadata used to masquerade malicious payloads. An agent correlates the delivery traffic with randomized execution patterns to route high-confidence findings to containment." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign", "index": 1, "title": "Counterfeit installers to system compromise: Tracking a deceptive software download campaign", "total": 2 }, "coverage": [ { "stage": "initial-access-spoofed-sites", "steps": [ "dns-campaign-lead" ], "status": "covered" }, { "stage": "delivery-dynamic-archive", "steps": [ "rare-archiver-execution" ], "status": "covered" }, { "stage": "execution-randomized-payloads", "steps": [ "metadata-masquerade-audit" ], "status": "covered" }, { "stage": "persistence-scheduled-task", "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.", "status": "out_of_scope" }, { "stage": "c2-alibaba-oss-update", "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.", "status": "out_of_scope" } ], "rationale": "An intruder has established initial access by tricking a user into downloading a polymorphic installer from a spoofed vendor site, which then launches a masqueraded payload from a randomized directory.", "blind_spots": [ { "id": "no-dns-visibility", "risk": "If the browser uses DoH, the lead query will return zero results, gating the hunt even if an infection occurred.", "stage": "initial-access-spoofed-sites", "question": "Did the host resolve the domains via DNS-over-HTTPS (DoH)?", "requires": "Endpoint DNS monitoring or proxy decryption" }, { "id": "metadata-rotation", "risk": "The metadata audit is high-fidelity for current samples but will miss payloads using different fabricated resource strings.", "stage": "execution-randomized-payloads", "question": "What if the actor rotates the 'Philips' masquerade brand?", "requires": "hb_process_activity metadata" } ], "scoping_notes": "Start with hosts running software the campaign is known to impersonate (e.g., Razer, Kaspersky, Microsoft Edge) as identified in the scoping step, then use the DNS lead to broaden the search.", "beyond_detection": "A detection rule fires on a single domain. This hunt pivots from a network lead into a behavioral audit: looking for rare processes extracted by archivers into public paths and verifying them against fabricated metadata used by the actor." } }, { "id": "identify-impersonated-software", "type": "query", "label": "Scope: Identify potential targets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{impersonated_packages}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{impersonated_packages}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "surface": "hb_software_inventory", "description": "Find hosts with software matching the campaign's lure list to provide asset context.", "expected_signal": "A list of hosts running software titles like Razer or Kaspersky. Silence means the specific software is not installed, but does not preclude infection via other lures." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope: Identify potential targets", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{impersonated_packages}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{impersonated_packages}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hosts running software titles like Razer or Kaspersky. Silence means the specific software is not installed, but does not preclude infection via other lures.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "dns-campaign-lead", "type": "query", "label": "Lead: Look-alike domain resolutions", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{spoofed_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify hosts that successfully resolved domains known to host spoofed download pages or deliver payloads.", "expected_signal": "Hosts resolving campaign domains. Silence proves the domains listed are not currently active in the estate." }, "parents": [ { "id": "identify-impersonated-software" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Lead: Look-alike domain resolutions", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{spoofed_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "Hosts resolving campaign domains. Silence proves the domains listed are not currently active in the estate.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "gate-agent", "type": "analytic", "label": "Gate: Evaluate the lead", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "dns-campaign-lead" ], "objective": "Confirm if any host successfully resolved the suspicious look-alike domains within the lookback window.", "description": "Decide if the behavioral audit is warranted based on the DNS lead.", "max_iterations": 3, "expected_signal": "A verdict confirming resolutions of spoofed domains.", "success_criteria": "A verdict per host citing the specific domain resolution." }, "parents": [ { "id": "dns-campaign-lead" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate: Open fan-out", "config": { "fuzzy": true, "judge": "hunter", "question": "the gate-agent verdict confirms at least one host resolved a campaign domain", "condition": "the gate-agent verdict confirms at least one host resolved a campaign domain", "blind_spot": "no-dns-visibility", "confidence": "high", "description": "Route to the behavioral queries only when the lead is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gate-agent" } ] }, { "id": "rare-archiver-execution", "type": "query", "label": "Behavior: Rare processes from archivers", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, process_name, LOWER(process_path) AS path, parent_process_name, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{archiver_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\programdata\\\\%') AND time >= datetime('now', '-{{lookback_days}} days')) GROUP BY device_hostname, process_name, path, parent_process_name HAVING COUNT(DISTINCT device_hostname) <= 3", "surface": "hb_process_activity", "description": "Detect binaries launched by archiver tools from randomized folders in Public or ProgramData, then stack-count to find anomalies.", "expected_signal": "A list of rare binaries spawned from archivers into world-writable paths. Fleet-wide software will exceed the host threshold and be filtered." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Behavior: Rare processes from archivers", "reads": [ "device_hostname", "process_name", "process_path", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, LOWER(process_path) AS path, parent_process_name, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{archiver_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\programdata\\\\%') AND time >= datetime('now', '-{{lookback_days}} days')) GROUP BY device_hostname, process_name, path, parent_process_name HAVING COUNT(DISTINCT device_hostname) <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of rare binaries spawned from archivers into world-writable paths. Fleet-wide software will exceed the host threshold and be filtered.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "metadata-masquerade-audit", "type": "query", "label": "Behavior: Metadata masquerade audit", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_file_company, process_original_file_name, process_hash_sha256, time FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{masquerade_companies}}' || ',', ',' || process_file_company || ',') > 0 OR instr(',' || '{{masquerade_filenames}}' || ',', ',' || process_original_file_name || ',') > 0 OR instr(',' || '{{campaign_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days'))", "surface": "hb_process_activity", "description": "Audit process events for metadata fabricated by the attacker to bypass verification, including 'Philips' or 'Speech Processing' resources.", "expected_signal": "Process events with campaign-consistent masquerade attributes. This confirms the presence of payloads even if filenames are randomized." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Behavior: Metadata masquerade audit", "reads": [ "device_hostname", "process_name", "process_path", "process_file_company", "process_original_file_name", "process_hash_sha256", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_file_company, process_original_file_name, process_hash_sha256, time FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{masquerade_companies}}' || ',', ',' || process_file_company || ',') > 0 OR instr(',' || '{{masquerade_filenames}}' || ',', ',' || process_original_file_name || ',') > 0 OR instr(',' || '{{campaign_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days'))", "silence": "not_evidence_of_absence", "expected": "Process events with campaign-consistent masquerade attributes. This confirms the presence of payloads even if filenames are randomized.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Triage: Weigh the evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "identify-impersonated-software", "gate-agent", "rare-archiver-execution", "metadata-masquerade-audit" ], "objective": "Determine if any host showing look-alike domain traffic also executed a rare binary extracted from an archiver or carrying fabricated metadata.", "description": "Correlate software presence, DNS leads, and behavioral findings to identify system compromise.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious | suspicious | benign.", "success_criteria": "A per-host verdict citing rows for every claim." }, "parents": [ { "id": "rare-archiver-execution", "kind": "merge" }, { "id": "metadata-masquerade-audit", "kind": "merge" } ] }, { "id": "route-decision", "type": "checkpoint", "label": "Route findings", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one host", "condition": "the triage-agent verdict is malicious for at least one host", "confidence": "high", "description": "Route confirmed malicious activity to containment.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Isolate the host to prevent command-and-control communication.", "instructions": "Isolate the host immediately. Collect the binary identified in the randomized path for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review findings and confirm the scope of the compromise.", "instructions": "Review the DNS resolutions and archiver lineage. Verify if any software identified in the scoping step was the intended lure." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-decision", "branch": "default" }, { "id": "route-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document the negative result.", "instructions": "Record that no campaign-consistent DNS resolutions or archiver-spawned processes were observed." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-decision", "branch": "on_refutes" } ] } ] }