From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

MITRE Techniques

• [T1059.001 ] PowerShell – Used to run multi-stage scripts and execute reconstructed payloads (‘PowerShell.exe -NoProfile -executionPolicy Bypass…’; ‘the payload extracted the PowerShell code and executed it asynchronously’).
• [T1112 ] Modify Registry – Used the Registry to store and retrieve encrypted payload stages and host identifiers (‘the Registry was being used to store the next stage of the payload’; ‘stored in the Registry’).
• [T1027 ] Obfuscated Files or Information – Heavily concealed payloads with encoded data, decimal-to-ASCII conversion, nibble reconstruction, and hidden content in images/audio (‘encoded PowerShell payload’; ‘reconstructed the embedded data by combining the lower four bits’).
• [T1071.004 ] DNS – Used DNS TXT queries to retrieve data and discover C2 information (‘queries DNS TXT records’; ‘Resolve-DnsName performs the TXT record query’).
• [T1105 ] Ingress Tool Transfer – Downloaded payload containers and configuration files from remote URLs (‘downloaded a PNG image’; ‘downloaded a copy from https[:]//publicwavlib[.]pages.dev/mav.wav’).
• [T1564.001 ] Hidden Files and Directories – Created hidden Scheduled Tasks to maintain persistence (‘Hidden Scheduled Tasks were created to execute the encrypted payload’).
• [T1546.003 ] Windows Management Instrumentation Event Subscription – Set up a WMI permanent event subscription for persistence (‘a WMI permanent event subscription was configured’).
• [T1562.001 ] Disable or Modify Tools – Tampered with security and telemetry settings, including Microsoft Defender exclusions and PowerShell history removal (‘disabled or weakened selected security-related features’; ‘add broad Microsoft Defender exclusions’).
• [T1053.005 ] Scheduled Task/Job – Used Scheduled Tasks to run the payload at logon and at regular intervals (‘Hidden Scheduled Tasks were created to execute the encrypted payload at logon and at regular intervals’).
• [T1106 ] Native API – Loaded .NET assemblies directly into memory with Assembly.Load rather than writing them to disk (‘[Reflection.Assembly]::Load()’; ‘loaded it directly into the PowerShell process’).
• [T1041 ] Exfiltration Over C2 Channel – Sent host information and command results over the established C2 channel (‘transmitted “Info” and “pingo” messages’; ‘reported to the C2 server using “OK” or “ERR” responses’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – Not mentioned.