PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2

Key facts for PowerShell Registry cryptominer

Detection coverage for PowerShell Registry cryptominer

As of 2026-09-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2593 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Registry-Resident PowerShell Loader Execution with Policy Bypass

Detects a PowerShell/pwsh process launched with -NoProfile and -ExecutionPolicy Bypass occurring alongside a Registry value-set/read under a short, randomly-named HKLM:\SOFTWARE subkey (e.g. HKLM:\Software\uf42a9660377\vstdfehzr) on the same host within a short window -- the fileless first-stage pattern used to store and decode an encoded loader script directly in the Registry instead of writing a .ps1 file to disk.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.001, T1112, T1027, T1140
• Data sources: sysmon, windows_security, powershell_operational
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=13)
| eval etype=if(EventCode=1,"process","registry")
| eval is_bypass_ps=if(etype="process" AND (like(Image,"%\\powershell.exe") OR like(Image,"%\\pwsh.exe")) AND like(CommandLine,"%-NoProfile%") AND like(CommandLine,"%-ExecutionPolicy%Bypass%"),1,0)
| eval is_susp_reg=if(etype="registry" AND match(TargetObject,"^HKLM\\\\SOFTWARE\\\\[A-Za-z0-9]{8,}\\\\[A-Za-z]{6,}$"),1,0)
| where is_bypass_ps=1 OR is_susp_reg=1
| stats count, min(_time) as first_seen, max(_time) as last_seen, values(Image) as image, values(CommandLine) as cmdline, values(TargetObject) as registry_path by host, user
| where count>=2
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "-NoProfile" and ProcessCommandLine has "-ExecutionPolicy" and ProcessCommandLine has "Bypass"
| project Timestamp, DeviceId, DeviceName, AccountName, ProcessCommandLine
| join kind=inner (
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey matches regex @"HKEY_LOCAL_MACHINE\\SOFTWARE\\[A-Za-z0-9]{8,}\\[A-Za-z]{6,}$"
    | project RegTimestamp = Timestamp, DeviceId, RegistryKey, RegistryValueName, ActionType
  ) on DeviceId
| where RegTimestamp between (Timestamp .. Timestamp + 5m)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RegistryKey, RegistryValueName, ActionType

Sigma

title: PowerShell Execution with Profile Bypass and Registry-Resident Script Indicators
id: 7a1e0c9e-2b3f-4c5d-8a6e-1f2b3c4d5e60
status: experimental
description: Detects a PowerShell/pwsh process launched with -NoProfile and -ExecutionPolicy Bypass, consistent with a fileless first-stage loader that reads and decodes an encoded script directly from the Windows Registry rather than a .ps1 file on disk.
references:
    - https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/
    - https://gbhackers.com/powershell-malware-abuses-registry-and-dns-txt-records/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-20
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1112
    - attack.t1027
    - attack.t1140
logsource:
    category: process_creation
    product: windows
detection:
    selection_proc:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - '-NoProfile'
            - '-ExecutionPolicy'
            - 'Bypass'
    filter_signed_deploy:
        ParentImage|endswith:
            - '\CcmExec.exe'
            - '\IntuneManagementExtension.exe'
    condition: selection_proc and not filter_signed_deploy
falsepositives:
    - Signed enterprise software-deployment tooling (SCCM/Intune) that intentionally launches PowerShell with -ExecutionPolicy Bypass for packaged scripts.
level: high

Known false positives:

• Signed IT-automation/deployment tooling (SCCM, Intune, third-party RMM) that launches PowerShell with -ExecutionPolicy Bypass for packaged scripts; correlate against the registry write to reduce noise.
• Developers or admins storing benign configuration blobs in HKLM:\Software subkeys with auto-generated names from legitimate installers.

Tuning notes: Tighten the registry-key regex to the observed naming convention (8-11 lowercase-alphanumeric parent key, 6-9 lowercase-alpha value name) once more samples are available, and add an allowlist for known SCCM/Intune parent process paths to suppress the primary false-positive source.

• 🔒 Registry-Resident PowerShell Loader Execution with Policy Bypass · unlock with TL Creds
• 🔒 Defender Exclusion Abuse, PowerShell History Clearing, and Hidden Scheduled Task/WMI Persistence Chain · unlock with TL Creds
• 🔒 DNS TXT-Record C2 Discovery, Steganographic Payload Retrieval, and XMRig C2 Beacon · unlock with TL Creds
• 🔒 Registry-Resident PowerShell Loader Execution with Policy Bypass · unlock with TL Creds
• 🔒 Defender Exclusion, PowerShell History Clearing, and Scheduled Task Persistence Chain · unlock with TL Creds
• 🔒 DNS TXT-Record C2 Discovery for Registry-Resident PowerShell Cryptominer · unlock with TL Creds
• 🔒 Defender Exclusion Abuse, PowerShell History Clearing, and Hidden Scheduled Task/WMI Persistence Chain · unlock with TL Creds
• 🔒 DNS TXT-Record C2 Discovery, Steganographic Payload Retrieval, and XMRig C2 Beacon · unlock with TL Creds

Indicators of compromise for PowerShell Registry cryptominer

As of 2026-09-20, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2593.

Sample indicators (3 of 19)

• IP address: 104.21.2[.]193
• Domain: sslvalidcert[.]com
• URL: hxxps://frames-1zm[.]pages[.]dev/frames.png

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How PowerShell Registry cryptominer works

K7 Security Labs identified the campaign after repeated PowerShell-activity alerts on a monitored Windows host. The infection begins with a PowerShell process launched using -NoProfile and an execution-policy bypass, which reads and decodes an encoded script stored directly in the Registry value HKLM:\Software\uf42a9660377\vstdfehzr rather than as a .ps1 file on disk, limiting the malware's forensic footprint from the outset.

The registry-resident script queries DNS TXT records for sslvalidcert.com (later rotated to txtcdn.net) using Resolve-DnsName; the TXT response carries comma-separated decimal values that are converted to ASCII to reconstruct a payload URL, frames-1zm.pages.dev/frames.png. The script then extracts data from the red colour channel of that PNG's pixels to reconstruct and execute a further stage, which opens a command channel to receive additional PowerShell instructions and downloads two WAV containers -- Atsg.wav and Tmav.wav -- from Cloudflare Pages-hosted domains. Both WAV files are decoded by skipping the standard 44-byte WAV header and recombining the lower nibbles of consecutive bytes to reconstruct embedded .NET assemblies, which are loaded directly into memory via [Reflection.Assembly]::Load() rather than written to disk.

The Atsg.wav stage performs defense evasion and persistence: it sets the PowerShell execution policy to Bypass, adds broad Microsoft Defender exclusions, disables/clears PowerShell command history, installs hidden Scheduled Tasks that fire at logon and on a recurring interval, and creates a WMI permanent event subscription that monitors Registry conditions to re-trigger the chain across reboots. It also generates a 20-character hardware identifier stored in the Registry and used as an X-HWID header on subsequent HTTP/HTTPS POST requests, and performs DNS-over-HTTPS lookups against Google's public resolver for TXT records at httptls.org to rediscover C2 endpoints if the primary channel is blocked.

The Tmav.wav stage reconstructs and in-memory-loads the XMRig miner, configured for the RandomX (rx/0) algorithm against a Monero mining pool over TLS with a keepalive channel and a CPU thread-count hint of up to 40, with live pool/wallet/threading parameters pulled from remote config resources (config-rg7.pages.dev/config.txt, softtestcopapool.pages.dev/rxconfig.txt). To optimize RandomX performance the malware also drops the signed kernel driver WinRing0.sys / WinRing0x64.sys, whose 1.2.0 build (as bundled in EVGA Precision X1 through 1.0.6) is tracked under CVE-2020-14979: the driver lets any local process, including low-integrity ones, read and write arbitrary physical memory by mapping \Device\PhysicalMemory, granting NT AUTHORITY\SYSTEM-equivalent MSR/memory access without a Windows kernel exploit. A separate defense-evasion DLL (fp.dll) further modifies PowerShell profiles and disables Defender services/scheduled tasks. All observed C2 traffic converges on 104.21.2.193:8443, an IP inside Cloudflare's shared anycast range. K7 Labs assesses that even after the miner is remediated, the underlying C2 channel could persist and deliver payloads beyond cryptomining. No CVE is required for initial execution, no actor attribution or campaign name is given in reporting, and the observed motivation is financial (Monero mining).

MITRE ATT&CK techniques by tactic:

Command and Control

T1001.002 Steganography; T1071.001 Web Protocols; T1071.004 DNS; T1132.002 Non-Standard Encoding

Stealth

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.003 Clear Command History; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Impact

T1496 Resource Hijacking

Remediation for PowerShell Registry cryptominer

Patches

• Remove or update software bundling WinRing0.sys/WinRing0x64iotoolkit build 1.2.0 (e.g., EVGA Precision X1 through 1.0.6) per CVE-2020-14979 to eliminate the underlying vulnerable driver.

Immediate actions

• Block DNS resolution to sslvalidcert.com, txtcdn.net, and httptls.org at the resolver/firewall.
• Block outbound HTTP/HTTPS to 104.21.2.193:8443 and alert on any outbound HTTP request carrying an X-HWID header.
• Hunt for and remove the registry value HKLM:\Software\uf42a9660377\vstdfehzr and any similarly-structured encoded PowerShell blobs under HKLM:\Software.
• Audit Microsoft Defender exclusion lists for entries added outside change-management and remove unauthorized exclusions.
• Enumerate hidden Scheduled Tasks and WMI permanent event subscriptions (__EventFilter/__EventConsumer/__FilterToConsumerBinding under root\subscription) for unrecognized entries tied to PowerShell execution.

Workarounds

• Where the WinRing0 driver cannot be removed outright, enforce HVCI/Windows Defender Application Control rules that block the driver by file hash or signing certificate.

Longer-term hardening

• Deploy Microsoft's vulnerable/blocklisted driver policy (WDAC or Attack Surface Reduction 'Block abuse of exploited vulnerable signed drivers') to prevent WinRing0.sys/WinRing0x64.sys from loading.
• Enable PowerShell Script Block Logging and Constrained Language Mode to reduce the blast radius of registry-resident, in-memory script execution.
• Monitor for anomalous DNS TXT record volume and DNS-over-HTTPS traffic to non-corporate resolvers as a potential C2-discovery channel.
• Baseline and alert on endpoint outbound requests to *.pages.dev and similar free static-hosting domains, which served as the steganographic payload CDN in this campaign.

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: all Windows versions capable of running PowerShell and loading the dropped WinRing0 kernel driver
• EVGA (WinRing0 redistribution) — WinRing0.sys / WinRing0x64.sys
  Vulnerable versions: 1.2.0, as bundled in EVGA Precision X1 through 1.0.6, and other software redistributing this build

Timeline of PowerShell Registry cryptominer

• 2026-09-18 The Tmav.wav stage reconstructs and loads locked-ioc-19 configured for RandomX (rx/0) with remote pool/wallet/thread settings, and drops WinRing0.sys for CPU MSR access, calling back to locked-ioc-16:8443.
• 2026-09-18 A 20-character hardware identifier is generated and stored in the Registry, subsequently sent as an X-HWID header on HTTP/HTTPS POST requests to the C2.
• 2026-09-18 Hidden Scheduled Tasks (logon and recurring triggers) and a WMI permanent event subscription monitoring Registry conditions are installed to survive reboots.
• 2026-09-18 The Atsg.wav stage sets PowerShell execution policy to Bypass, adds Microsoft Defender exclusions, and clears PowerShell command history.
• 2026-09-18 Reconstructed .NET assemblies are loaded directly into memory via [Reflection.Assembly]::Load(), avoiding disk writes.
• 2026-09-18 Atsg.wav and Tmav.wav are retrieved from Cloudflare Pages-hosted domains and decoded by skipping the 44-byte WAV header and recombining low nibbles of consecutive bytes to reconstruct .NET assemblies.
• 2026-09-18 The script downloads frames-1zm.pages.dev/frames.png and extracts hidden script content from the image's red pixel channel to reconstruct and execute a further stage.
• 2026-09-18 The loader queries DNS TXT records for locked-ioc-15 (later locked-ioc-18) for comma-separated decimal values decoded to ASCII, reconstructing a payload URL.
• 2026-09-18 Registry-resident PowerShell is launched with -NoProfile and an execution-policy bypass, reading and decoding the encoded stage stored at locked-ioc-6 in memory.
• 2026-09-18 K7 Security Labs identifies the campaign after repeated security alerts indicate suspicious PowerShell activity on a monitored host.
• 2026-09-19 GBHackers publishes coverage summarizing K7 Security Labs' technical findings and the full IOC set.

Sources cited for PowerShell Registry cryptominer

• NVD - CVE-2020-14979 NVD (NIST) · Advisory · 2020-08-27
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain labs.k7computing.com · Research · 2026-09-18
• VulnerableDriver:WinNT/Winring0.A threat description Microsoft · Vendor report · 2026-09-20
• Windows: Vulnerable WinRing0 Driver Load Fortinet · Vendor report · 2026-09-20
• PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner gbhackers.com · Blog · 2026-09-19
• Registry-Resident PowerShell Chain Deploys In-Memory XMRig Miner mallory.ai · Blog · 2026-09-19
• Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner cyberpress.org · News · 2026-09-19

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs, and MFA Codes Previous report
• Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors Next report