# Deep Dive: Kaseya VSA Mining Payload

Kaseya VSA hosts were infected with persistent scheduled-task PowerShell footholds storing Base64 payloads in registry keys and Dropbox, mining cryptocurrency as Local System.

- Payout: Real-world hack
- Program: Kaseya VSA
- Analysis by: Huntress
- Disclosed: 2018-01-30
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- Tags: area:os domain:desktop impact:integrity impact:internal-access kind:incident platform:threat-intel tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoints managed by Kaseya VSA (scheduled tasks, registry, PowerShell)
**Root cause:** Attackers abused Kaseya VSA to push a PowerShell infection script that creates scheduled tasks from a downloaded XML template, storing Base64 payloads in registry values and Dropbox-hosted scripts, running as Local System.
**Steps:**
1. Infection script runs a single PowerShell command that downloads and executes `hxxps://dl[.]dropboxusercontent[.]com/s/namkbc37wtx2mdq/reg_load_subsequent.ps1`
2. Script checks running processes and aborts if more than one PowerShell process is already running
3. Script measures integer pointer size: 4 bytes selects x86 payloads (URLs ending `_32.txt`), otherwise 64-bit payloads
4. Payloads and an obfuscated PowerShell script are stored in registry: `HKLM\SOFTWARE\Microsoft\Powershell\Scripts` values `a`,`b`,`c`,`d` and `HKLM\SOFTWARE\Microsoft\Powershell` value `ScriptInit`
5. Script downloads a scheduled task XML template from Dropbox and generates a random-looking task name by joining the path of one legitimate task with the name of another (e.g. `\Microsoft\Windows\SettingSync\UPnPHostConfig`)
6. Creates the task via `schtasks /CREATE /XML $file /TN "$fullTaskName" /F`
7. On Jan 29 2018 attackers moved registry values to `HKLM\SOFTWARE\Microsoft\Policies\System` value `*` and `HKLM\SOFTWARE\Microsoft\Policies` value `Start`, evading Kaseya's XMR.xml removal script that matched on `ScriptInit`
8. Attacker backdoored Microsoft's legitimate `sihboot` scheduled task by adding an extra Exec Action running the malicious PowerShell payload
**How found:** Huntress ThreatOps observed dozens of suspicious scheduled tasks executing a persistent payload with Local System privileges, then reverse-engineered the PowerShell infection chain, registry storage, and XML task template.
**Exploitation:** Kaseya VSA was used to push the infection script to managed endpoints; it established Local System scheduled-task footholds that re-launched Base64-encoded payloads from registry and Dropbox, mining cryptocurrency and persisting across reboots.
**Escalation:** Payloads ran as Local System via scheduled tasks; attacker renamed registry keys and backdoored a legitimate Microsoft task (sihboot) to survive Kaseya's automated removal.
**Insight:** Malware hiding in plain sight: generating task names by splicing the path of one legitimate scheduled task with the name of another defeats name-based hunting; also check for extra Exec Actions appended to legitimate Microsoft tasks like sihboot.

## Proof of concept (copied exactly from the original report)

**schtasks command creating malicious scheduled task**

```
schtasks /CREATE /XML $file /TN “$fullTaskName” /F
```

**PowerShell download-and-execute foothold URL**

```
hxxps://dl[.]dropboxusercontent[.]com/s/namkbc37wtx2mdq/reg_load_subsequent.ps1
```