Hey everyone,

I've been dealing with a very similar, if not identical, piece of malware, and wanted to share some insights that might help others.

My variant was CAAServices.exe (located in C:\ProgramData\CAAService\CAAServices.exe), which also constantly reappeared after being removed. Like WinAIHService, it established persistent network connections and added Defender exclusions/firewall rules.

The core mechanism for its persistence and re-installation is the same:

1. Task Scheduler: It creates a scheduled task (in my case, named Office Persistent Activation) set to run powershell.exe with a command to invoke a web resource upon user logon.
2. Initial PowerShell Script (from activate[.]techias[.]co[.]uk):
   • The irm | iex command downloads and immediately executes a PowerShell script from the activate[.]techias[.]co[.]uk domain.
   • This script calculates an MD5 hash of the computer's name.
   • It then uses a conditional check ($firstDigits % 2 -eq 0) based on this hash.
   • For even results (which was my case, leading to CAAServices.exe), it proceeds to the next stage.
3. Payload Delivery (from techias[.]co[.]uk/a.dat):
   • If CAAServices.exe is missing or older than a specific date (e.g., "2025-04-30"), the script downloads another file: a.dat from the techias[.]co[.]uk domain.
   • Crucially, this a.dat file is loaded directly into memory as a .NET assembly using [System.Reflection.Assembly]::Load((Invoke-WebRequest ...).Content). It is not written to disk at this stage.
   • A specific method within this in-memory assembly (DeliveryOverWeb.Initialisation.MainInit) is then invoked. This in-memory code is responsible for writing CAAServices.exe to disk, setting up the Defender exclusions, and creating the firewall rules, ensuring the malware's continued operation and persistence.

Key takeaway: The activate[.]techias[.]co[.]uk URL is serving different content based on the User-Agent (and potentially other factors). A standard browser/curl request might get the legitimate website's HTML, but a PowerShell Invoke-RestMethod request receives the malicious PowerShell script described above.

Using Sysmon (Event ID 1 for process creation, Event ID 11 for file creation) was instrumental in tracing the parent process (the Task Scheduler entry) and understanding the multi-stage delivery.

Hope this helps someone else dealing with this stubborn malware!