Malicious Double-Extension Executable Executed from Network Share with External Command and Control Communication

Initial Signal

CrowdStrike Falcon detected a suspicious executable on workstation ws-001 (10.1.1.1) in Thailand. The file, named `คิดแบบใหม่.TXT.exe` (Thai for "Think New.TXT.exe"), uses a classic deceptive double extension (.TXT.exe) designed to trick users into thinking it's a harmless text file. The executable was launched from a network share path `\10.1.1.2\[SHARE_1]\TOO\` and immediately established an outbound TCP connection to `[EXTERNAL_IP_1]:80` at 2026-03-17T07:31:00Z—approximately 1 second after execution. This maps to MITRE technique T1566.002 (Phishing: Spearphishing Link) combined with T1204.002 (User Execution: Malicious File). The timing and destination are the red flags here: the file didn't pause or perform legitimate work; it went straight to an external hosting provider in Luxembourg with no business context. The same IP was contacted by explorer.exe on 2026-03-16 and 2026-03-17, suggesting the compromise predates this alert. Investigation across CrowdStrike Falcon and Microsoft Defender XDR took 26 minutes and correlated 16,042 records across two data sources.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified the file uses a deceptive double extension (.TXT.exe) designed to trick users
   Pass
2. fp2
   Analyzed network communication pattern immediately following execution
   Pass
3. fp3
   Evaluated file prevalence and distribution pattern
   Pass
4. fp4
   Assessed potential legitimate business purposes
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. The file uses a deceptive double extension (.TXT.exe), a textbook social engineering technique with no legitimate business purpose. Windows hides known extensions by default, making this appear as a text file to the user

2. Execution occurred from a network share (`\10.1.1.2\[SHARE_1]\TOO\`), suggesting either a compromised share or targeted distribution within the organization

3. Immediate outbound connection to `[EXTERNAL_IP_1]:80` within 1 second of execution is consistent with command-and-control behavior; legitimate applications do not establish external connections this quickly

4. The external IP belongs to G-Core Labs S.A., a hosting provider in Luxembourg, with no documented business relationship to the organization

5. The same IP was contacted by explorer.exe on 2026-03-16 and 2026-03-17, indicating persistent presence and prior compromise

6. Multiple high-severity CrowdStrike alerts (DoubleExtensionProcess, DoubleExtensionExecuted) were triggered simultaneously, confirming detection across independent engines. Confidence is High rather than Confirmed because the investigation did not recover the full command-and-control payload or establish the initial infection vector (how the file reached the network share)

Lessons

1. 01
   Double extensions are not benign—they are deliberate deception. In this investigation, the .TXT.exe pattern was the first signal that execution was malicious. Windows hides known file extensions by default, so users see only 'Think New.TXT' and assume it's a document. This is not a coincidence or a quirk of the filesystem; it is a deliberate attacker choice. Any alert flagging a double extension should be treated as high-confidence malware until proven otherwise. Do not dismiss it as a false positive based on the presence of a 'legitimate' extension in the name.
2. 02
   Network share execution is a distribution vector, not a safety feature. The file was executed from a network share accessible to multiple users. This is not a sign of legitimacy; it is a sign of targeted distribution. Attackers place malware on shared drives to maximize exposure within an organization. The common local prevalence combined with low global prevalence is a strong indicator of targeted malware. Investigate the source of the share and audit who has write access.
3. 03
   Immediate external connections after execution are command-and-control. The malicious executable connected to [EXTERNAL_IP_1]:80 within 1 second of execution. Legitimate applications do not establish external connections this quickly. They perform initialization, load configuration, and then communicate. This timing pattern is consistent with command-and-control behavior. The use of unencrypted HTTP (port 80) rather than HTTPS (port 443) further suggests an attacker-controlled server.
4. 04
   Persistent C2 communication across processes indicates active compromise. The same external IP was contacted by explorer.exe on 2026-03-16 and 2026-03-17, before and after the malicious executable was executed. This is not coincidence; it indicates the device was already compromised and the malicious executable was a secondary payload or lateral movement tool. Do not assume the device is clean after isolating the malicious file. Investigate all network connections to the external IP and audit for additional persistence mechanisms.
5. 05
   Low global prevalence + common local prevalence = targeted attack. The suspicious file had low global prevalence (rare worldwide) but common local prevalence (multiple executions within the organization). This distribution pattern is a hallmark of targeted malware campaigns. Attackers customize malware for specific organizations or industries to evade generic detection. The Thai language filename further suggests targeting of the Thailand manufacturing facility. Investigate whether other devices in the facility have similar files or connections to the same external IP.