Fighting Ursa: Car-for-Sale Lure to HeadLace

A diplomatic workstation raised an endpoint alert this morning. Before pivoting through the data, understand what you are looking at.

The intrusion began in the mailbox. One inbound message used a sales pitch to get the attache to click. Recover where that click sent the browser.

The link did not drop malware directly. After showing a convincing decoy, it handed the browser a file. Identify the archive that landed on the workstation.

The archive did not contain obvious malware. It bundled a perfectly legitimate Windows program whose only job was to be run by the victim. Name the signed binary that was used as the launch vehicle.

Running the trusted program caused it to pull in attacker code from its own folder instead of the real Windows library. Recover the malicious module it loaded.

For the incident report, classify the core evasion technique: a trusted signed program was made to load an attacker library placed beside it. Map it to its MITRE ATT&CK technique.