A multi-stage malware campaign uses a weaponized ZIP archive containing a VHDX disk image to evade common security controls. After the VHDX is mounted, an obfuscated JavaScript file runs and launches a series of PowerShell stages through WMI. The final payload is Remcos RAT, which is injected into a legitimate Windows process to conceal its execution.
The researcher examined a malicious ZIP archive and the embedded VHDX container to reconstruct the full attack flow. The analysis exposed a complex execution chain that used WMI-based process creation to disguise parent-child relationships, along with XOR and Base64 string obfuscation and a reflective .NET loader. The infection path was successfully traced from the initial JavaScript execution through to deployment of the final Remcos payload.
Organizations should apply strict controls to prevent mounting of VHDX disk images from untrusted sources. Security tooling should also monitor suspicious Win32_Process.Create activity triggered by scripting engines such as JavaScript or PowerShell. Blocking known malicious domains and watching for unusual Run key persistence in the registry can further reduce risk.
If this activity is detected, isolate the affected endpoint immediately to stop command-and-control communication. Acquire a memory dump to capture the injected Remcos payload and the reflective .NET loader. A full forensic review should then for malicious Run key entries, additional VHDX files, and suspicious PowerShell activity elsewhere in the environment.
## Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary aims to execute a malicious payload in memory to avoid detection by traditional AV. They utilize a PowerShell script that leverages [System.Reflection.Assembly]::Load() to pull a compiled .NET DLL directly from a byte array into the current process. To maintain persistence and evade scrutiny, they attempt to spawn or interact with backgroundTaskHost.exe , a legitimate Windows process, to hide their execution thread within a standard system background task.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
