A Windows machine kept tripping alerts every time PowerShell ran on it. When researchers at K7 Labs pulled the thread, they found the actual payload was never on disk: it had been parked inside the Windows Registry, then rebuilt out of a DNS record, the red pixels of a PNG image, and three files that looked like audio.
At the end of the chain sat a cryptocurrency miner. The part that should worry defenders more is what was left running next to it.
A payload parked in the Registry
The script that set off the alerts did almost nothing by itself. It read a value from a Registry key under HKLM, decoded it, and executed it in memory, which keeps the real code out of any .ps1 file an endpoint agent might scan. It also switched off PowerShell's command history first.
That second stage periodically looked up DNS TXT records for sslvalidcert[.]com, and later txtcdn[.]net, and converted the comma separated numbers it received into text. The text was a URL.
Pictures and audio that are neither
The URL led to frames.png, hosted on a Cloudflare Pages site. The image was a container rather than a picture: the script read the red channel of its pixels and reassembled a hidden script from them. Running it opened a command and control connection, and the server replied with more PowerShell.
The next instruction wiped the user's Public\Music folder and unpacked a ZIP archive there holding files named Atsg.wav and Tmav.wav. Neither was ever played. Each carried code buried in the audio data, which the script recovered by skipping the standard 44 byte WAV header and stitching together the lower half of every byte that followed. One reconstruction produced a .NET library, another a .NET executable, and both were handed straight to [Reflection.Assembly]::Load() so they ran inside the PowerShell process without being written to disk as programs.
It turns the lights off before it starts
Most of the effort went into staying unseen. K7 Labs observed the code setting the execution policy to Bypass, weakening PowerShell logging and telemetry, adding broad Microsoft Defender exclusions, disabling selected Defender services and scheduled tasks, and deleting PowerShell history. Persistence came from hidden Scheduled Tasks that fire at logon and on a timer, plus a WMI permanent event subscription tied to a Registry change.
The miner is not the worst of it
The final executable is a miner from the XMRig family, set to the RandomX algorithm, pointed at a remote pool over TLS, with a CPU thread hint of 40 and a second configuration pulled from a remote config.txt at run time. It also drops WinRing0.sys, a signed kernel driver XMRig uses on Windows to reach CPU model specific registers.
The detail worth carrying away is in the conclusion of the analysis: the command and control channel built in the earlier stages keeps working whether or not the miner does. Kill the mining and the operator may still hold a shell, ready to push a stealer or an encryptor down the same pipe. Mining crews have been hollowing out defences this way for a while, including a Linux campaign that deleted the logs that would have caught it.
Start hunting in the Registry and Public\Music
Look for PowerShell reading script blocks out of Registry values, for Resolve-DnsName queries returning long numeric TXT records, and for .wav files appearing in Public\Music on machines nobody uses for music. Microsoft Defender exclusions and disabled Defender scheduled tasks that nobody created are the other strong signal. The full technical walk through is in the original K7 Labs analysis by Ashwath Ram.
Indicators
- hxxps://frames-1zm[.]pages[.]dev/frames[.]png
- hxxps://publicwavlib[.]pages[.]dev/hdaudio[.]wav
- hxxps://publicwavlib[.]pages[.]dev/mav[.]wav
- hxxps://wavmain[.]pages[.]dev/main[.]wav
- hxxps://config-rg7[.]pages[.]dev/config[.]txt
- C2: 104[.]21[.]2[.]193:8443
- MD5: 94b50ace73cc03790678c73b867be129 (atsg.wav), c024189e1e7fa0ae6d24353367e8b98d (tmav.wav), ed276b2312f641b00f87fa18e85c48eb (Realtek HD Audio.wav)
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.