- malware
- social-engineering
- double-extension
- command-and-control
- network-share
- thailand
Malicious Double-Extension Executable Executed from Network Share with External Command and Control Communication
A malicious executable with a deceptive double extension (.TXT.exe) was executed from a network share on a manufacturing workstation in Thailand and immediately established communication with an external server in Luxembourg, indicating successful malware deployment through social engineering.
Time and cost estimates are based on a Tier-2 SOC analyst model and actual investigation telemetry. Individual results vary by analyst experience, tooling, and environment.
Initial Signal
CrowdStrike Falcon detected a suspicious executable on workstation ws-001 (10.1.1.1) in Thailand. The file, named `คิดแบบใหม่.TXT.exe` (Thai for "Think New.TXT.exe"), uses a classic deceptive double extension (.TXT.exe) designed to trick users into thinking it's a harmless text file. The executable was launched from a network share path `\10.1.1.2\[SHARE_1]\TOO\` and immediately established an outbound TCP connection to `[EXTERNAL_IP_1]:80` at 2026-03-17T07:31:00Z—approximately 1 second after execution. This maps to MITRE technique T1566.002 (Phishing: Spearphishing Link) combined with T1204.002 (User Execution: Malicious File). The timing and destination are the red flags here: the file didn't pause or perform legitimate work; it went straight to an external hosting provider in Luxembourg with no business context. The same IP was contacted by explorer.exe on 2026-03-16 and 2026-03-17, suggesting the compromise predates this alert. Investigation across CrowdStrike Falcon and Microsoft Defender XDR took 26 minutes and correlated 16,042 records across two data sources.
How We Reached the Verdict
The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.
Could this be normal activity?
Ruled out[EXTERNAL_IP_1] on port 80 after executionCould this be a true positive that was blocked?
Ruled out[EXTERNAL_IP_1] on port 80 after executionCould this be a policy violation?
Ruled outCould this be a false positive?
Ruled outExplorer.exe process flagged with FileNamePathKnownMalware alertexplorer.exeexplorer.exe processFileNamePathKnownMalware alert on explorer.exe appears to be a false positive. The process follows the standard Windows logon sequence, operates from the expected system directory, and performs normal Windows Explorer functions like creating shortcut files in the Recent folder. The common global and local prevalence is consistent with legitimate Windows system files. However, this single potential false positive does not negate the clear evidence of malicious activity from the double-extension executable, which represents a separate and confirmed threat.·Medium confidenceCould this be an account compromise?
Ruled out[EXTERNAL_IP_1] on port 80 after executionDisconfirming Evidence
Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.
Evidence Gathered
The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.
TXT.exe' (Thai for 'Think New.TXT.exe') with deceptive double extension designed to hide executable natureDoubleExtensionProcess and DoubleExtensionExecuted alerts are triggered when a binary with a double extension pattern (e.g., .TXT.exe) is executed. This detection is based on filename analysis and process creation events captured by the Falcon sensor.DoubleExtensionProcess, DoubleExtensionExecuted)10.1.1.2\[SHARE_1]\TOO\' mapped as Z: driveImageFileName or CommandLine field in process events, revealing the source location of the executed binary.[EXTERNAL_IP_1]:80 established at 2026-03-17T07:31:00Z, approximately 1 second after execution[EXTERNAL_IP_1] belongs to G-Core Labs S.A. hosting provider in Luxembourg with no VPN/proxy indicators3a554c3a4ec13257a7acfa046c447ba09efd607dc84f1f5908d690c23f8e0472 with 'low' global prevalence but 'common' local prevalence[EXTERNAL_IP_1]) contacted by explorer.exe process on 2026-03-16T10:47:05Z and 2026-03-17T05:13:27ZFalse Positive Analysis
The agent ran these validation checks to confirm the verdict isn't a false positive.
- fp1Verified the file uses a deceptive double extension (.Pass
TXT.exe) designed to trick users - fp2Analyzed network communication pattern immediately following executionPass
- fp3Evaluated file prevalence and distribution patternPass
- fp4Assessed potential legitimate business purposesPass
Detection Opportunities
The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.
DoubleExtensionProcessFileNamePathKnownMalwareNetworkConnectIP4| Technique | Tactic | Context |
|---|---|---|
T1036.007Masquerading: Double File Extension | Defense Evasion | Flag any process execution where the filename contains a double extension pattern (e.g., .TXT.exe, .PDF.exe, .DOC.exe). Alert on executables with non-executable extensions followed by .exe, especially when executed from user-writable or network-accessible paths. Monitor for files with Thai, Chinese, or other non-Latin script characters combined with double extensions, as this pattern targets users unfamiliar with the language. Threshold: any single execution of a double-extension binary should trigger investigation. |
T1204.002User Execution: Malicious File | Execution | Monitor for execution of files from network shares (UNC paths or mapped drives) that match known malware signatures or exhibit suspicious characteristics. Flag files with low global prevalence but common local prevalence, as this pattern indicates targeted distribution within a specific organization. Alert on any executable launched from shares named with generic or obfuscated folder names (e.g., 'TOO', 'SHARE_1'). Correlate file execution with immediate outbound network connections to external IPs. |
T1071.001Application Layer Protocol: Web Protocols | Command and Control | Alert on unencrypted HTTP (port 80) connections to external IPs immediately following process execution, especially from newly-launched executables. Flag connections to hosting providers (G-Core Labs, Linode, DigitalOcean, etc.) that lack business context. Monitor for repeated connections to the same external IP from different processes (e.g., explorer.exe and a suspicious executable) on the same device, as this indicates persistent C2 communication. Threshold: any outbound HTTP connection within 1 second of a suspicious process launch warrants escalation. |
Verdict Reasoning
The verdict of Malicious at high confidence rests on the following mutually corroborating signals:
1. The file uses a deceptive double extension (.TXT.exe), a textbook social engineering technique with no legitimate business purpose. Windows hides known extensions by default, making this appear as a text file to the user
2. Execution occurred from a network share (`\10.1.1.2\[SHARE_1]\TOO\`), suggesting either a compromised share or targeted distribution within the organization
3. Immediate outbound connection to `[EXTERNAL_IP_1]:80` within 1 second of execution is consistent with command-and-control behavior; legitimate applications do not establish external connections this quickly
4. The external IP belongs to G-Core Labs S.A., a hosting provider in Luxembourg, with no documented business relationship to the organization
5. The same IP was contacted by explorer.exe on 2026-03-16 and 2026-03-17, indicating persistent presence and prior compromise
6. Multiple high-severity CrowdStrike alerts (DoubleExtensionProcess, DoubleExtensionExecuted) were triggered simultaneously, confirming detection across independent engines. Confidence is High rather than Confirmed because the investigation did not recover the full command-and-control payload or establish the initial infection vector (how the file reached the network share)
Lessons
- 01Double extensions are not benign—they are deliberate deception. In this investigation, the .
TXT.exepattern was the first signal that execution was malicious. Windows hides known file extensions by default, so users see only 'Think New.TXT' and assume it's a document. This is not a coincidence or a quirk of the filesystem; it is a deliberate attacker choice. Any alert flagging a double extension should be treated as high-confidence malware until proven otherwise. Do not dismiss it as a false positive based on the presence of a 'legitimate' extension in the name. - 02Network share execution is a distribution vector, not a safety feature. The file was executed from a network share accessible to multiple users. This is not a sign of legitimacy; it is a sign of targeted distribution. Attackers place malware on shared drives to maximize exposure within an organization. The common local prevalence combined with low global prevalence is a strong indicator of targeted malware. Investigate the source of the share and audit who has write access.
- 03Immediate external connections after execution are command-and-control. The malicious executable connected to
[EXTERNAL_IP_1]:80 within 1 second of execution. Legitimate applications do not establish external connections this quickly. They perform initialization, load configuration, and then communicate. This timing pattern is consistent with command-and-control behavior. The use of unencrypted HTTP (port 80) rather than HTTPS (port 443) further suggests an attacker-controlled server. - 04Persistent C2 communication across processes indicates active compromise. The same external IP was contacted by
explorer.exeon 2026-03-16 and 2026-03-17, before and after the malicious executable was executed. This is not coincidence; it indicates the device was already compromised and the malicious executable was a secondary payload or lateral movement tool. Do not assume the device is clean after isolating the malicious file. Investigate all network connections to the external IP and audit for additional persistence mechanisms. - 05Low global prevalence + common local prevalence = targeted attack. The suspicious file had low global prevalence (rare worldwide) but common local prevalence (multiple executions within the organization). This distribution pattern is a hallmark of targeted malware campaigns. Attackers customize malware for specific organizations or industries to evade generic detection. The Thai language filename further suggests targeting of the Thailand manufacturing facility. Investigate whether other devices in the facility have similar files or connections to the same external IP.