Operation GriefLure & TroyDen Factory: APT & Infostealer Swarm Analysis

---
title: Potential Argamal COM Hijacking via Windows Color System
description: Detects registry modification associated with Argamal malware persistence via MSCMS DLL hijacking.
id: 4e1b2c3d-5f6a-4b7c-8d9e-1a2b3c4d5e6f
status: experimental
date: 2026/06/08
author: Security Arsenal
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: 'Classes\CLSID'
    TargetObject|contains: 'InprocServer32'
    Details|contains: 'mscms.dll'
  filter_generic:
    Details|contains: 'C:\\Windows\\System32\\'
  condition: selection and not filter_generic
falsepositives:
  - Legitimate software installation (rare)
level: high
tags:
  - attack.persistence
  - attack.t1546.015
---
title: Suspicious GitHub Download and Execution (TroyDen)
description: Detects potential execution of binaries downloaded from GitHub, a vector used by TroyDen lure factory.
id: 5f2c3d4e-607b-5c8d-9e0f-2b3c4d5e6f70
status: experimental
date: 2026/06/08
author: Security Arsenal
logsource:
  product: windows
  category: process_creation
detection:
  selection_download:
    ParentImage|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\bash.exe'
    CommandLine|contains:
      - 'github.com'
      - 'githubusercontent.com'
  selection_exec:
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - '-enc' # Base64 encoded commands often used in these campaigns
      - 'iex'
  condition: selection_download and selection_exec
falsepositives:
  - Legitimate developer tools
level: medium
tags:
  - attack.initial_access
  - attack.t1102
---
title: TDS Traffic Connection to Malicious Infrastructure
description: Detects network connections to known Traffic Distribution System (TDS) IPs and domains identified in the Impersonation campaign.
id: 6g3d4e5f-718c-6d9e-0f1g-3c4d5e6f7081
status: experimental
date: 2026/06/08
author: Security Arsenal
logsource:
  product: windows
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - '194.150.220.218'
      - '217.156.122.75'
  selection_domain:
    DestinationHostname|endswith:
      - '.cyou'
      - 'guiformat.com'
      - 'forestoaker.com'
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.command_and_control
  - attack.c2

// Hunt for Argamal Persistence Registry Events
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "CLSID" and RegistryKey contains "InprocServer32"
| where RegistryValueData contains "mscms.dll" and RegistryValueData !contains @"C:\Windows\System32"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessAccountName

// Hunt for TDS/Malware Domain Connections
DeviceNetworkEvents
| where RemoteUrl has_any ("guiformat.com", "forestoaker.com", "cyou") 
   or RemoteIP in ("194.150.220.218", "217.156.122.75")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, LocalPort, InitiatingProcessFileName

// Hunt for GitHub Suspicious Execution (TroyDen)
DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("github.com", "githubusercontent.com")
| where FileName in~ ("powershell.exe", "cmd.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

<#
.SYNOPSIS
    IOC Hunter for Argamal Persistence and GriefLure Artifacts.
.DESCRIPTION
    Checks for Windows Color System COM Hijacking and presence of specific file hashes.
#>

Write-Host "[+] Starting Threat Hunt for Argamal and GriefLure..." -ForegroundColor Cyan

# 1. Check for MSCMS.dll (Windows Color System) Hijacking
# Argamal targets the CLSID associated with the Windows Color System
$clsidPath = "Registry::HKCU\Software\Classes\CLSID"
$knownCLSID = "{d7db...}" # Truncated for brevity, real check would iterate or target specific known calibrator CLSID

# Generic check for InprocServer32 modifications under User CLSID
Write-Host "[*] Checking for COM Hijacking Persistence mechanism..."
$userClsids = Get-ChildItem -Path "Registry::HKCU\Software\Classes\CLSID" -ErrorAction SilentlyContinue

foreach ($clsid in $userClsids) {
    $inprocPath = "$($clsid.PSPath)\InprocServer32"
    if (Test-Path $inprocPath) {
        $defaultValue = Get-ItemProperty -Path $inprocPath -Name "(default)" -ErrorAction SilentlyContinue
        if ($defaultValue) {
            if ($defaultValue.'(default)' -like "*mscms.dll*" -and $defaultValue.'(default)' -notlike "*System32*") {
                Write-Host "[!] ALERT: Suspicious MSCMS.dll loading found in: $($clsid.Name)" -ForegroundColor Red
                Write-Host "    -> Value: $($defaultValue.'(default)')" -ForegroundColor Red
            }
        }
    }
}

# 2. Check for GriefLure / TDS related file hashes (Sample set)
$targetHashes = @(
    "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886",
    "197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6"
)

Write-Host "[*] Scanning fixed drives for known malicious hashes..."
$drives = Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Used -gt 0} 

foreach ($drive in $drives) {
    Get-ChildItem -Path $drive.Root -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($targetHashes -contains $hash) {
            Write-Host "[!] MALWARE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green