Active Malware Compromise on Workstation: Ransomware Activity, DLL Side-Loading, and Security Tool Evasion

Initial Signal

On March 13, 2026, CrowdStrike Falcon raised a SuspiciousFileWritten alert on ws-001 (10.1.1.1), a Windows 7 workstation in the [SITE_1] Manufacturing facility. The alert mapped to T1036 Masquerading and T1486 Data Encrypted for Impact, indicating file write activity consistent with ransomware. The specific artifact that triggered investigation was `SogouExe.exe` writing `temp.dll` into the `[CUSTOM_DIR_1]` directory—a classic DLL side-loading technique targeting Chinese input method software. What made this signal noteworthy was the presence of a second masqueraded binary: a file named `精美日历.exe` (Beautiful Calendar) executed from the user desktop, but with an embedded PE header name of `SAFlashPlayer.exe`. This filename-to-original-name mismatch is a hallmark of trojanized software. The investigation correlated CrowdStrike alerts, Next-Gen SIEM process and logon events, and registry changes across 28 data queries spanning 11 minutes 37 seconds of autonomous analysis, revealing a multi-stage compromise with unblocked malicious activity.

The Questions We Asked

What follows is the path the agent walked to reach its verdict. Pivots and dead ends both made the cut. Routine steps that just ruled out the obvious are grouped together so you can skim past them.

Key Pivots

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Compromised at high confidence rests on the following mutually corroborating signals:

1. Multiple independent CrowdStrike behavioral detections across distinct MITRE ATT&CK techniques—T1036 Masquerading (filename/PE header mismatch), T1486 Data Encrypted for Impact (ransomware file modification), T1562.001 Disable or Modify Tools (CrowdStrike protected folder tampering), and T1110.001 Brute Force (495 failed Guest logon attempts)—all on the same device within a 3-day window

2. Process telemetry showing SogouExe.exe executed 4 times across March 11–13, each time writing temp.dll to the IME directory, confirming persistent DLL side-loading behavior

3. A trojanized executable (Beautiful Calendar / SAFlashPlayer.exe) launched from the user desktop, a non-standard execution path for system binaries

4. All malicious activities completed successfully under detect-only disposition (pattern_disposition=0), meaning CrowdStrike detected but did not block the threat

5. Confidence is High rather than Confirmed because we lack hash-based malware family confirmation or sandbox detonation results; however, the behavioral evidence across five distinct attack techniques is sufficient to confirm active malware presence without requiring signature-based identification

Lessons

1. 01
   Detect-only mode leaves the door open. In this investigation, CrowdStrike Falcon detected all five malicious behaviors (masquerading, DLL side-loading, ransomware file modification, security tool tampering, and brute force) but operated in detect-only mode. The malware ran unimpeded for three days, executing SogouExe.exe four times and completing 495 brute force attempts. The lesson: detection without prevention is a distraction. Audit your CrowdStrike Falcon policies to ensure critical threats—particularly ransomware, security tool tampering, and persistence mechanisms—are set to block or kill, not detect-only. A high detection count is not a win if the malware achieves its objectives.
2. 02
   Filename-to-PE-header mismatch is a red flag you can act on immediately. The trojanized executable '精美日历.exe' (Beautiful Calendar) with internal name 'SAFlashPlayer.exe' was the first signal of compromise. This mismatch is trivial to detect in process telemetry and is almost never legitimate. Create a detection rule that flags any process where the on-disk filename differs from the OriginalFilename field in the PE header, especially when executed from user-writable paths like Desktop or Downloads. This single rule would have caught the initial compromise before DLL side-loading and ransomware activity began.
3. 03
   DLL side-loading into IME directories is a known persistence vector. SogouExe.exe repeatedly wrote temp.dll to the [CUSTOM_DIR_1] input method directory—a technique documented in Chinese-targeted malware campaigns. If your organization uses Chinese input methods or has users in regions where they're common, monitor for DLL writes to IME directories (typically `C:\Windows\IME\*` or equivalent). Alert on any process writing DLLs to these paths, especially with generic names like temp.dll. Pair this with file integrity monitoring to catch DLL side-loading before the trusted IME application loads the malicious DLL.
4. 04
   Brute force from the local machine means malware is running. The 495 failed Guest logon attempts all originated from 10.1.1.1 (the device itself). This is not a remote attacker; it's malware running on the compromised host attempting lateral movement or privilege escalation. When you see high-volume brute force from a device's own IP, immediately investigate what process is generating the logon attempts. In this case, it would have revealed the malware's credential attack behavior and confirmed active compromise before ransomware encryption began.
5. 05
   Correlate across MITRE techniques to confirm compromise. No single alert in this investigation was definitive in isolation. But the combination of T1036 (masquerading), T1486 (ransomware file modification), T1562.001 (security tool tampering), and T1110.001 (brute force) across the same device in a 72-hour window is a clear compromise signal. Build correlation rules that trigger on multiple distinct MITRE techniques from the same device within a short timeframe. This investigation required 28 data queries to confirm what a well-tuned correlation rule could have flagged in minutes.