full_name: cipher

type: .none

description: Early cascade using IRvana

owner: securitySolution

title: Early cascade with IRvana

type: cases


description: PE File executed without IRvana, Early cascade injection to execute Adaptix beacon

title: Direct PE Execute without IRvana


action: create

description: Early cascade using IRvana

severity: critical

status: open

title: Early cascade with IRvana

type: cases-user-actions


comment:
## Process Injection Attack via Cascade Malware

Process injection attack on `e609dff2-08cf-4f98-8b65-6e35639b7034` targeting `a94f800d-6222-4620-9d10-44795cae49b9`

### Summary
Malicious executable `cascade.exe` launched via PowerShell performed sophisticated process injection attack, allocating memory and injecting shellcode into `Notepad.exe` to evade detection on `e609dff2-08cf-4f98-8b65-6e35639b7034`.

### Details
## Process Injection Attack Chain

* At 22:12:10, a malware file `cascade.exe` was detected on `e609dff2-08cf-4f98-8b65-6e35639b7034`. This unsigned executable was launched from `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` with `a94f800d-6222-4620-9d10-44795cae49b9` credentials.

* The malware `cascade.exe` (SHA256: `349698dcdae58d2b623cbee93aa8a9f01f34bb3e394d458b3a4e91393c883bd7`) began its attack by performing suspicious memory operations at 22:12:19, specifically remote memory allocation, a common technique for process injection.

* Between 22:12:20 and 22:12:24, `cascade.exe` performed multiple instances of remote memory writes to trusted target processes, showing clear evidence of the process injection attack technique. This included writing to memory from an unsigned (low reputation) module and attempting to inject code into suspended processes.

* The culmination of this attack occurred at 22:12:27 when the malware successfully injected shellcode into `Notepad.exe`. This legitimate Windows process (`C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2507.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe`) was exploited to execute malicious code while appearing as a trusted application.

* The alerts confirm both "Unbacked Shellcode from Unsigned Module" and "Shellcode Injection with Parent as Provenance" occurring in `Notepad.exe`, with `C:\Users\cipher\Downloads\cascade.exe` identified as the parent process responsible for the injection.

### Attack Chain
- Execution
- Defense Evasion

type: user

type: cases-comments


title: Direct PE Execute without IRvana


name: Malicious Behavior Detection Alert: Shellcode Injection with Parent as Provenance

type: alert


type: comment

version: WzExNDQxLDFd


action: update

status: closed

type: status


comment:
## Process Injection via Unsigned Executable

Process injection attack from malicious lli.exe on `1b2af71b-0afe-4e45-b34b-184896c2c8bc` by `6d42276a-9d26-4d0c-bb1b-7c50101c56eb`

### Summary
A sophisticated process injection attack was detected on `1b2af71b-0afe-4e45-b34b-184896c2c8bc`. An unsigned executable `C:\Users\cipher\Downloads\lli.exe` created a suspended `Notepad.exe` process and injected malicious shellcode into it, using multiple memory manipulation techniques to evade defenses.

### Details
## Process Injection Attack Chain

* At 22:34:26 UTC on October 29, 2025, a suspicious process creation was detected on host `1b2af71b-0afe-4e45-b34b-184896c2c8bc` when an unsigned executable `C:\Users\cipher\Downloads\lli.exe` launched `Notepad.exe` in a suspended state. This is a common technique used by attackers to prepare for code injection.

* The parent process `lli.exe` was executed with the command line `"C:\Users\cipher\Downloads\lli.exe" .\final-obf.ll`. The presence of an obfuscated file (final-obf.ll) as an argument is suspicious and indicates potential malicious intent.

* Following the suspended process creation, at 22:34:27 UTC, multiple alerts for suspicious memory operations were triggered as `lli.exe` performed memory manipulations:
  - Suspicious remote memory allocation
  - Remote process memory writes by low reputation module
  - Remote memory writes to trusted target process

* At 22:34:28 UTC, additional defense evasion techniques were detected as `lli.exe` performed:
  - Potential suspended process code injection
  - Windows system module remote hooking
  - Suspicious NTDLL memory writes

* The attack culminated at 22:34:32 UTC with shellcode injection alerts as the injected code began execution in `Notepad.exe` with PID `6700`.

* This attack chain shows a clear progression from process creation to code injection, demonstrating how the attacker used `6d42276a-9d26-4d0c-bb1b-7c50101c56eb`'s credentials to execute an unsigned binary that injected malicious code into a legitimate Windows application.

### Attack Chain
- Execution
- Defense Evasion

version: WzExNDkxLDFd


version: WzExNDkzLDFd