Huntress Details Kaseya VSA PowerShell Payload and Persistence Techniques

Jan 30, 2018 · Original article ↗

Summary

Huntress analyzed a PowerShell payload that used registry-stored scripts and disguised scheduled tasks to persist. Attackers later changed registry paths and task behavior to evade Kaseya’s removal procedure; Dropbox removed identified malicious files.

Key points

Huntress reported finding dozens of suspicious scheduled tasks that launched a persistent payload with Local System privileges.
The foothold used PowerShell to run Base64-encoded content stored in the Windows Registry and downloaded from Dropbox-hosted URLs.
The script checked whether another PowerShell process was running and selected 32-bit or 64-bit payloads based on the system architecture.
It created scheduled tasks from a downloaded XML template and combined legitimate task paths and names to make malicious tasks harder to spot.
On January 29, 2018, attackers changed registry locations and values and altered task behavior to evade Kaseya’s automated removal procedure.
The attackers also added a malicious action to the legitimate “sihboot” scheduled task.
Huntress said it coordinated with Dropbox to take down the identified malicious URLs on January 30; Kaseya had updated its automated and manual removal instructions.

Article Details

Attack Vectors: A PowerShell command downloaded and executed a script from a Dropbox-hosted URL, establishing a persistent foothold.
The script selected architecture-matched payloads, stored payload data and an obfuscated PowerShell script in Windows Registry values, and used Scheduled Tasks to run the payload with Local System privileges.
The infection script created Scheduled Tasks from a downloaded XML template and used task names assembled from legitimate task paths and names to blend in.
An updated script changed its Registry paths and value names to evade Kaseya's initial automated removal procedure and added a malicious Exec Action to the legitimate “sihboot” Scheduled Task.
Defensive Notes: Huntress reported that the identified malicious Dropbox URLs had been taken down by Dropbox on January 30, 2018.
Kaseya updated its automated and manual removal procedures after the attackers changed Registry locations and Scheduled Task arguments.
The article notes that having two or more long-running PowerShell processes could temporarily prevent this particular script from proceeding; it does not present this as permanent remediation.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//dl[.]dropboxusercontent[.]com/s/namkbc37wtx2mdq/reg_load_subsequent.ps1`	Malicious PowerShell script URL used to establish the persistent foothold; Huntress reported that Dropbox took down the malicious URLs.