Windows 10: Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

EdTittel · Mar 8, 2018

At this week's MVP conference Microsoft presented many terrific use cases to justify or explain the value of telemetry data, particularly from a security standpoint. This news story captures one so immediate that our security presenter hadn't even heard it yet: Massive Coin-Mining Attempt Targets Nearly Half a Million PCs - Infosecurity Magazine

Massive Coin-Mining Attempt Targets Nearly Half a Million PCs

Tara Seals (US/North America News Reporter, Infosecurity Magazine)

Microsoft has averted a massive and widespread campaign that would have seen tens of thousands of machines impacted.

The software giant reported that on March 6, "Windows Defender AV blocked more than 80,000 instances of several sophisticated Trojans that exhibited advanced cross-process injection techniques, persistence mechanisms and evasion methods." The Trojans, which are new variants of Dofoil (also known as Smoke Loader), carry a coin-miner payload.

"Within the next 12 hours, more than 400,000 new instances were recorded, 73% of which were in Russia. Turkey accounted for 18% and Ukraine 4%," Microsoft stated.Dofoil uses a customized mining application that supports a function called NiceHash, which means it can mine different cryptocurrencies.

The samples Microsoft analyzed mined Electroneum coins. It burrowed into systems using a process called process hollowing.“Process hollowing is a code injection technique that involves spawning a new instance of legitimate process...and then replacing the legitimate code with malware,” explained Mark Simos, lead cybersecurity architect for Microsoft’s enterprise cybersecurity group in a blog. “The hollowed explorer.exe process then spins up a second malicious instance, which drops and runs a coin mining malware masquerading as a legitimate Windows binary.”

The attack was picked up on thanks to its use of an unusual persistence mechanism, which triggered behavior-based alerts. For coin-miner malware, it’s required to stay undetected for long periods in order to mine enough coins to make the attack worth its while.

In this case, Dofoil modifies the registry.“The hollowed explorer.exe process creates a copy of the original malware in the Roaming AppData folder and renames it to ditereah.exe,” Simos said. “It then creates a registry key or modifies an existing one to point to the newly created malware copy. In the sample we analyzed, the malware modified the OneDrive Run key.”

....
Click to expand...

:)

ŁukaszBiernot · Mar 8, 2018

How to stop the Windows Compatability Telemetry (CompatTelRunner.exe) from starting on Windows 10?

I have the same issue. No error message. Windows Task Manager shows massive disk usage by Microsoft Compatibility Telemetry. No scripted answers please.

ChristopherCobbs · Mar 8, 2018

svchost.exe in Windows/Temp is a massive Trojan and when I remove it the system crashes and puts it back. Why is a VIRUS a SYSTEM FILE?

I did a system scan recently and found a virus with maximum threat level so sought to clean it and the system crashed and restarted. I then used CCleaner to kill the file and the system crashed and restarted. Attempting to eliminate this massive Trojan virus
is clearly not what Microsoft wants, so I'm forced to assume that Microsoft is using a virus to data mine and provide invisible remote access to all Windows 10 users. I've known a few hackers that do this exact same thing and the purpose, intent and function
of a Trojan of this style is always malicious.

I want to know how to remove it without my system crashing so others can't exploit Microsoft's virus package to ruin my system or my life.

SystemDrive:\Windows\Temp\svchost.exe

lehnerus2000 · Mar 9, 2018

How does Telemetry fit into this?

The description says it was blocked by Defender ("triggered behavior-based alerts").
It doesn't say:

Telemetry reported unusual PC activity to MS

MS analysed the Telemetry

MS sent out a Defender update to stop the "coin miner"

That said, if Telemetry actually did something useful it deserves credit. *Smile

Telemetry certainly isn't fixing Windows Update issues though.

Bree · Mar 9, 2018

How does Telemetry fit into this?
Click to expand...

Like this...

Windows Defender AV initially flagged the attack’s unusual persistence mechanism through behavior monitoring, which immediately sent this behavior-based signal to our cloud protection service.

Within milliseconds, multiple metadata-based machine learning models in the cloud started blocking these threats at first sight...

Click to expand...

https://cloudblogs.microsoft.com/mic...ning-campaign/

Block at First Sight requires telemetry in Defender to be turned on.

The feature is automatically enabled, as long as Cloud-based protection and Automatic sample submission are both turned on.
Click to expand...

Enable Windows Defender Block at First Sight in Windows 10

EdTittel · Mar 9, 2018

Thanks, Bree: owing to the time difference, I was sleeping when Lehnerus's excellent query came through. I appreciate you stepping up to cover for me. And indeed Lehnerus, Bree was spot on in his citation to back up the information I presented. But thanks for asking anyway: one can never be too clear or explicit about such things.
Best wishes,
--Ed--

Bree · Mar 9, 2018

Thanks, : owing to the time difference, I was sleeping when Lehnerus's excellent query came through.
Click to expand...

TBH, it was past my bedtime too *Smile The article skipped over some details, but it did cite the blog I linked to which explained it in full.

lehnerus2000 · Mar 10, 2018

Windows Defender AV initially flagged the attack’s unusual persistence mechanism through behavior monitoring, which immediately sent this behavior-based signal to our cloud protection service.

Within milliseconds, multiple metadata-based machine learning models in the cloud started blocking these threats at first sight...

Click to expand...

Thanks Bree. *Smile

It's a pity the Tara Seals only included the bit , "triggered behavior-based alerts" and not the relevant bit that you posted.

I thought that "behavior-based alerts" sounded like heuristics, which most (if not all) AV programs claim to include.

It seems that Telemetry deserves kudos in this case. *Smile

Bree · Mar 10, 2018

Thanks . *Smile
It's a pity the Tara Seals only included the bit , "triggered behavior-based alerts" and not the relevant bit that you posted.
Click to expand...

She did at least include a link to the blog, which is where I got the details.

Golden · Apr 4, 2018

Great find - thanks Ed.

Windows 10: Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt

Microsoft (Telemetry) Foils Massive Coin-mining Exploit Attempt - Similar Threads - Microsoft Telemetry Foils

can i get a refund on mine coins

can i get a refund on mine coins

Mine craft coins not showing up

Mine craft coins not showing up

How i refund a world and get my mine coins back

How i refund a world and get my mine coins back

Minecraft mine coins

mine coins puchase

No Mine coins and Missing Skin & Texture Packs.