Maranhao Lab

Scenario

A gaming enthusiast at GOAT Company downloaded what appeared to be a free mod launcher for a popular survival game. The archive contained a trojanized installer that silently dropped hidden files, established registry persistence, and began communicating with malicious infrastructure. The machine was isolated and a full disk image was provided for forensic analysis.

Tooling

• FTK Imager
• VirusTotal

Investigation

Delivery — Trojanized Game Launcher

Browser history analysis revealed the download URL and timestamp of the initial compromise vector:

• URL: hxxps[://]drive[.]google[.]com/file/d/1mIxhfZXmcUT2mbKNuahsRI4S_rzVUFKW/view
• Timestamp: 2025-09-17 10:10
• Filename: Fnafdoomlauncher.exe (delivered as fnafdoomlauncher.d7z)

The archive was disguised as a legitimate FNAF Doom game launcher to trick the victim into executing it willingly.

VirusTotal confirmed the dropper binary as malicious:

• SHA1: FCB94C06FA80CE277B47E545B3805AB38BB6ACF4 ![[maranhao_virus_total.png]]

Execution — Silent Installation

The installer was executed with the /VERYSILENT flag to suppress all user-facing prompts during deployment, preventing the victim from observing any installation activity. This is a common abuse of legitimate NSIS/Inno Setup installer flags.

Persistence — Registry Autorun

Event log analysis revealed the secondary payload was staged in a user-space directory masquerading as a legitimate Microsoft component:

C:\Users\Levi\AppData\Local\Programs\Microsoft Updater\Updater.exe

The payload was invoked with a victim-tagging UUID for C2 identification:

C:\Users\Levi\AppData\Local\Programs\Microsoft Updater\updater.exe e90de8b2-eb79-4614-94f8-308f0f81573b

A registry autorun key was created to ensure re-execution on every reboot, with the persistence entry timestamped at 2025-09-17 10:13 — just three minutes after initial delivery.

![[maranhao_eventlog.png]]

Defense Evasion — File Hiding

Following payload deployment, the malware used a native Windows utility to conceal its artifacts at the filesystem level:

attrib +h +s

The +h flag marks files as hidden and +s marks them as system-protected, rendering them invisible to standard directory listings and basic user inspection. This maps to MITRE T1564.001 — Hidden Files and Directories.

Discovery — WMI Reconnaissance & Sandbox Evasion

The malware performed extensive WMI-based host fingerprinting to profile the victim environment and determine whether it was running in a sandbox or analyst VM:

The malware also retrieved a static Windows activation backup key from the registry:

HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\BackupProductKeyDefault

Credential Access — Browser Data Theft

To harvest browser credentials and session cookies, the malware forcibly terminated Microsoft Edge before injecting into the browser process:

taskkill /F /IM msedge.exe

A named pipe was then created to ferry stolen browser data between processes:

ChromeDecryptIPC_e7e223c5-50d5-40ae-8513-64c9962789c2

This maps to MITRE T1539 — Steal Web Session Cookie and MITRE T1056 — Input Capture.

Command and Control

The malware beaconed to two C2 endpoints:

• Geolocation enrichment: ip-api[.]com (resolved to 208[.]95[.]112[.]1)
• Primary C2: api[.]maranhaogang[.]fun (resolved via Cloudflare edge to 172[.]67[.]144[.]96 and 104[.]21[.]71[.]100)

Using Cloudflare as a front for C2 infrastructure is a common technique to obscure the true origin of attacker-controlled servers and complicate blocking by IP.

![[maranhao_virustotal_ip.png]] malicious ip 208.95.112.1

IOCs

Conclusion

A trojanized game mod launcher delivered via Google Drive silently installed a secondary payload disguised as a Microsoft Updater component, establishing registry persistence within three minutes of delivery. The malware performed extensive WMI-based sandbox evasion before terminating browser processes to steal credentials via a named pipe. C2 communications were routed through Cloudflare’s edge network to obscure attacker infrastructure, with geolocation enrichment via ip-api.com used to profile the victim’s location.

References

• MITRE T1566 — Phishing
• MITRE T1547 — Boot or Logon Autostart Execution
• MITRE T1564.001 — Hidden Files and Directories
• MITRE T1082 — System Information Discovery
• MITRE T1539 — Steal Web Session Cookie
• MITRE T1071 — Application Layer Protocol
• CyberDefenders — Maranhao Lab