![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18133024/sl-binary-coins-golden-scaled-1-990x400.jpg) In April of this year, the FBI published an [advisory]() on attacks targeting government, law enforcement, and non-profit organizations. Attackers download scripts onto victims' devices, delivering several types of malware all at once. The main aim is to utilize company resources for mining, steal data using keyloggers, and gain backdoor access to systems. According to our telemetry data, we have detected numerous scripts, executables, and associated links under this campaign since late 2022. We were still finding new versions at the time of writing, so the threat to B2B is still live. Enterprise resources and data remain at risk. Investigating the indicators of compromise identified in the April report, we discovered in our telemetry for August of this year some previously unpublished malicious scripts that attempt to manipulate Windows Defender ([0BEFB96279DA248F6D49169E047EE7AB]() — _runxm1.cmd_ and [769BC25454799805E83612F0F896E03F]() — _start.cmd_). Indirect evidence suggests that the scripts penetrate the target infrastructure mainly as a result of exploiting vulnerabilities on servers and workstations. First, the script _start.cmd_ attempts to disable protection through the registry: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131313/Money-making-scripts_01.png)]() _Disabling Windows Defender in start.cmd_ If this succeeds, the script _runxm1.cmd_ tries to add several files to exceptions. These files are used at different stages of the attack; more details about them below. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131323/Money-making-scripts_02.png)]() _Adding files to Windows Defender exceptions_ This script also obtains administrator rights and renames folders of known security solutions to prevent them from running on the infected device: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131333/Money-making-scripts_03.png)]() _Renaming security solutions_ Both scripts then access a domain hosting a platform that displays real-time cryptocurrency exchange rates (now offline): [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131345/Money-making-scripts_04.png)]() From this domain, the scripts attempt to download various executable and configuration files: * _intelsvc.exe_ ([A7CDE18F991E97037A7899B7669E2548]()), * _View.exe _ ([830debd1f6d39c726c2d3208e3314f44]()), * _rtkaudio.exe/rtkaudio.txt _([a6d4706baeb9ab97490d745f7a2bb11e]()) * _config.txt_ ([99634dcaca690066187e30c36182bf19]()). [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131358/Money-making-scripts_05.png)]() _Downloading files_ Next, _start.cmd_ tries to run _RtkAudio.exe_ using the contents of _config.txt_ for configuration: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131407/Money-making-scripts_06.png)]() _Running RtkAudio.exe with config.txt as an argument_ Peering inside the configuration file, we immediately see that it refers to a miner. In this case, the actors want to use the infected device to mine the Monero cryptocurrency (XMR): [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131415/Money-making-scripts_07.png)]() _Contents of config.txt_ A look at the strings in the file to which the configuration is passed convinces us that this is indeed a miner: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131426/Money-making-scripts_08.png)]() Let's see if other downloaded files appear in the _start.cmd_ code. We see that the path to _View.exe_ is assigned as a value to the variable _PlayMusic_: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131434/Money-making-scripts_09.png)]() _The PlayMusic variable_ Next, after verifying that _View.exe_ is present in the system and is an executable file, _start.cmd_ accesses this variable and covertly runs the file: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131439/Money-making-scripts_10.png)]() _Running View.exe_ Running _View.exe_ manually on a virtual machine, we saw that it saves several files to the path C:\Users\Public. Among them are copies of _IntelSvc_ and _RtkAudio_, plus some other executables: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131445/Money-making-scripts_11.png)]() _Files saved by View.exe_ Having opened one of them in IDA (_Systemfont.exe_), we established that it tracks keystrokes and has a typical keylogger structure: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131451/Money-making-scripts_12.png)]() | [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131459/Money-making-scripts_13.png)]() ---|--- _Code and structure of Systemfont.exe_ After running _Systemfont.exe_ on the virtual machine separately from the other files, we create a new text document and write something: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131505/Money-making-scripts_14.png)]() The archive _tempfont.rar_ immediately appears in the folder where the executable file is located: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131510/Money-making-scripts_15.png)]() Opening this archive in a HEX editor shows the entire sequence of keystrokes and mouse clicks: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131515/Money-making-scripts_16.png)]() Now let's take a closer look at _IntelSvc.exe_, which is also run using _start.cmd_. Once started, it sends a request to C2 approximately once a minute and overwrites the file _log.json_ while waiting for commands. Such behavior is typical of a backdoor. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131522/Money-making-scripts_17.png)]() _Activity of IntelSvc.exe_ _log.json_ contains arguments for configuring the backdoor's further operation: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131532/Money-making-scripts_18.png)]() | [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131540/Money-making-scripts_19.png)]() ---|--- _Contents of log.json_ Opening _IntelSvc.exe_ in IDA, we can see the commands it is capable of executing: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/17141323/Money-making-scripts_020.png)]() _Commands that IntelSvc.exe can execute_ This executable also creates a folder to store configuration files and logs: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131613/Money-making-scripts_24.png)]() Among the files of interest in this folder is _web.ttf_, which contains the IP address of the C2 server: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/16131620/Money-making-scripts_25.png)]() _Contents of web.ttf_ ## Attack statistics and geography Since May 2023, we have detected more than 10,000 attacks on over 200 users worldwide. The attacks target the B2B sector, including both large enterprises and SMBs in various sectors: government agencies, agricultural organizations, and wholesale and retail trade companies, among others. According to our statistics, the above threats were encountered most often in the following countries: * Russian Federation * Saudi Arabia * Vietnam * Brazil * Romania Our solutions also detected isolated attacks in the United States, India, Morocco, and Greece. ## Conclusion The B2B sector remains attractive to cybercriminals, who seek to exploit its resources for money-making purposes. Even if a cryptominer infection seems insignificant to you, bear in mind that if actors were able to inject a miner into your corporate infrastructure, they could do the same with more dangerous software. The campaign described in this post clearly illustrates this: besides a cryptominer, victims' devices are infected with a backdoor and a keylogger that captures passwords and other keyboard input. To protect against such threats, companies need to constantly improve and update their security systems, as attackers never cease to refine their tools, skills, and systems in a bid to breach corporate defenses. ## Indicators of compromise **MD5** [0BEFB96279DA248F6D49169E047EE7AB]() [769BC25454799805E83612F0F896E03F]() [B747AEDF0F3E4457C6D02BC5AF7C0980]() [0A50081A6CD37AEA0945C91DE91C5D97]() [1DA8E7C92C86FC8DBAB5287BDCA91CA1]() [3C47D45F09948B8E6FDB5F96523BC60B]() [5D3E2B2EE668B2BC071B8D4027C6B8F1]() [227FA5D690A943114FF3CCFE7977192A]() [A531FE822618B6A917D50BEE001C95A1]() [DDAB66730A84583B98D3415F9181D092]() [830debd1f6d39c726c2d3208e3314f44]() [3b2a270b90b3e24a25cc991df40da3ca]() [DDD12566B99343B96609AFA2524ECEC3]() [a6d4706baeb9ab97490d745f7a2bb11e]() [A7CDE18F991E97037A7899B7669E2548]() [AC27DE51896A5BA2FD0DDA9B7955A201]() [2ac1d8e16e47e97db3c60d728270ad5a]() [5919e4e3e06b617d967dc6e8fecb701b]() [8dcd1e4e37838b49214f10c50ef5a5f0]() [51ad216fcb4afe42b9ef01ab472a2914]() [df6f39d30dc5e9f4155514cdefb54620]() [b2e250b9e3b9d5e6b2080cb782f9698e]() [af9327d353b97fd50a777145bc0e8e1e]() [22f9682e543b94532d46541c63512f2d]() [1225f4f50154dd49d4853e4efc3ddf77]() [7d0f67343f128d29a50ccd3639b72884]() [752940da17469330c38ab98d04f3d6b8]() [11ca68ea3500cb03db1f4008d18cb6b2]() [b558fa064d0d3f94f5e4c975375cbad1]() [4cdbcfa0d6fd2e7de6ec0030cfb2322d]() [7e09279dcd3655ab1b2e2684746e4bc2]() [a38dece5bcb9f6d1c027d86e0318a60e]() [474f517eb23bdfa4c320c091c3eb2dba]() [f0881b3c3d1535685d6190df4083f515]() [61d5944634d735c3e6efc3b1349de740]() [99634dcaca690066187e30c36182bf19]()

Money-making scripts attack organizations