Manufacturing Workstation Compromised: Multi-Stage Malware with Persistence and C2 Communication

Initial Signal

On 2026-04-26 at 10:05:53 UTC, CrowdStrike Falcon detected a multi-stage attack chain on ws-001, a Windows 7 manufacturing workstation at a Philippines facility. The process [CUSTOM_APP_1].exe spawned iexplore.exe instances that wrote a malicious executable (`kxnbrjvz.exe`, SHA256: [MALWARE_HASH_2]) to the user Startup folder—a known persistence mechanism—and attempted process injection into `iexplore.exe` and `dwm.exe`. The malware then queried DGA-characteristic domains (`xkrqnvbplt.com`, `wfsrtmnxqzpb.com`, `qhvnplxmrtw.com`, `bzrkvfmnxqplts.com`) and established an outbound connection to `[EXTERNAL_IP_2]:447` on a non-standard port, consistent with C2 communication. What made this signal critical was not just the initial execution, but the persistence: the same malicious binary re-executed 66 hours later on 2026-04-29 from a different parent process (`explorer.exe`), indicating the attacker maintained control despite CrowdStrike's quarantine actions. The investigation correlated 14 CrowdStrike alerts across multiple MITRE ATT&CK tactics (Execution, Persistence, Defense Evasion, Command and Control) and 2,245 telemetry records over 3 days, revealing a persistent foothold and broader campaign activity on sibling hosts.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. FP-01
   Evaluate whether the malicious file write (kxnbrjvz.exe to Startup folder) could be a legitimate software installation or update.
   Fail
2. FP-02
   Evaluate whether the DGA-characteristic DNS queries could be legitimate application traffic.
   Fail
3. FP-03
   Evaluate whether the 2026-04-29 MaliciousModule alert could be a false positive detection of a legitimate module.
   Fail
4. FP-05
   Evaluate whether the broader campaign indicators (sibling host alerts, PsExec detections) corroborate or are independent of the ws-001 compromise.
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Compromised at high confidence rests on the following mutually corroborating signals:

1. A pre-registered IOC hash match on the dropped file (kxnbrjvz.exe) written to a known persistence location (Startup folder), classified by CrowdStrike as known_malware

2. Multiple independent detection mechanisms firing in sequence: process injection into system processes (dwm.exe, iexplore.exe), DGA-characteristic DNS queries to four algorithmically generated domains, and outbound C2 connection to a non-standard port

3. Confirmed persistence: the same malicious binary (SHA256: [MALWARE_HASH_1]) re-executed 66 hours later from a different parent process, demonstrating the attacker maintained a foothold

4. Behavioral corroboration: eight Early Exploit Pivot Detect alerts clustered at the initial compromise time, plus one additional alert 32 hours later, confirming continued unusual execution behavior

5. Campaign-level evidence: sibling hosts (ws-002, ws-003) have analyst-confirmed true-positive alerts involving the same process names and IOC hashes, and PsExec activity across multiple hosts indicates lateral movement. Confidence is High rather than Confirmed because the process attribution for the persistent TCP 7777 listener remains unknown, and the TightVNC installation origin (attacker-deployed vs. pre-existing) cannot be definitively determined from available telemetry

Lessons

1. 01
   Quarantine is not containment—verify persistence mechanisms. In this investigation, CrowdStrike quarantined the malicious executable on 2026-04-26, but the attacker had already installed persistence via the Startup folder before the quarantine action. The same malicious binary re-executed 66 hours later from a different parent process. Always audit what persistence mechanisms were installed before quarantine, not just what was blocked. Check Startup folders, Run keys, scheduled tasks, and services immediately after detecting malware execution. The blocked count is the distractor; the unblocked persistence is the real threat.
2. 02
   Process parent-child anomalies warrant immediate escalation. A manufacturing application ([CUSTOM_APP_1].exe) spawning multiple iexplore.exe instances is anomalous and should trigger immediate investigation. In this case, the unusual parent-child relationship was the first signal of compromise. Establish baseline process execution patterns for critical applications in your environment. When a process spawns children that are inconsistent with its documented function, escalate immediately rather than waiting for additional alerts. This investigation took 8 minutes to complete; early escalation on parent-child anomalies can prevent persistence installation.
3. 03
   DGA queries + non-standard port connections = confirmed C2. This investigation detected four DGA-characteristic domains queried within minutes of an outbound connection to port 447. The combination of algorithmically generated domain names and non-standard port usage is a high-confidence C2 indicator. Do not wait for additional confirmation; treat DGA + non-standard port as confirmed command and control. Implement network-level detection for DGA patterns and non-standard port connections. The attacker in this case was attempting to establish C2 communication; early detection of this pattern could have prevented the 66-hour persistence window.
4. 04
   Campaign-level corroboration reduces false positive risk. Sibling hosts (ws-002, ws-003) had analyst-confirmed true-positive alerts with the same process names and IOC hashes. This corroboration across multiple independently monitored hosts significantly reduced the probability that ws-001 detections were false positives. When investigating a single host, always check for related alerts on peer systems in the same environment. Shared IOC hashes, process names, or attack patterns across multiple hosts indicate a coordinated campaign rather than isolated incidents. This context strengthens confidence in the verdict and justifies immediate containment actions.
5. 05
   Windows 7 end-of-life systems are high-risk targets. This manufacturing workstation ran Windows 7 Professional (end-of-life January 2020), which no longer receives security patches. The attacker exploited this vulnerability gap to achieve persistence and C2 communication. Prioritize upgrading or isolating end-of-life systems, especially those in critical environments like manufacturing. If upgrade is not feasible, implement compensating controls: network segmentation, application whitelisting, and enhanced monitoring. The 66-hour persistence window in this investigation would have been much shorter on a patched, modern operating system.