Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The attack utilized exploit kits targeting RDP vulnerabilities for initial access.
- Persistence mechanisms included scheduled tasks and registry modifications.
- Beaconing behavior was established through customized domains ensuring robust C2 communications.
Executive Summary
In our analysis of a recent ransomware attack, we observed the threat actor’s innovative use of Remote Desktop Protocol (RDP) vulnerabilities to gain initial access to targeted environments. The attack followed a well-documented pattern, leveraging increasingly sophisticated delivery mechanisms, persistence strategies, and command and control infrastructure. This report delves into the intricacies of the observed ransomware behavior, providing an in-depth investigation from initial access to impact, while mapping TTPs to the MITRE ATT&CK framework.
Initial Access
The initial access vector identified was a compromise through exposed RDP services. Our analysis revealed attempts to brute-force credentials, employing a range of common usernames and passwords. The sampled logs indicated repeated authentication failures followed by instances of successful logins originating from unfamiliar IP addresses, specifically in the range of 192.168.1.0/24. Once access was gained, the actor immediately deployed a lightweight dropper, which we tracked as RansomX, housed under C:\Windows\Temp\RansomX.exe. This executable was designed to establish a foothold within the compromised environment.
Execution & Persistence
During the investigation, we noted that the payload not only executed on a successful drop but also established persistence through both scheduled tasks and Windows Registry modifications. The actor configured a task named “RansomX_Startup” to execute the payload every time the workstation was booted. This can be observed under C:\Windows\System32\Tasks\. Additionally, we identified changes made to the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, where an entry for “RansomX” was created, ensuring that the malware would reinitialize without user intervention.
Command and Control
Our analysis revealed a sophisticated command and control (C2) mechanism that made use of dynamically generated domains, obfuscating actual server locations. The malware frequently contacted the domain example-c2.com through HTTPS, leveraging port 443. The communication pattern displayed typical characteristics of a beacon, wherein the actor would initiate requests at regular intervals. We also noted that the environment had outbound firewall rules that allowed this traffic, effectively bypassing usual detection measures.
Lateral Movement & Discovery
Once the actor had surfaced within the network, they initiated lateral movement via Windows Management Instrumentation (WMI) and PsExec. Instances of wmi <= Get-WmiObject -ComputerName commands confirming access to remote machines were observed in the logs, thus hinting at the actor's strategic reconnaissance phase. The investigation noted multiple executed commands targeting administrative shares, indicating they were gathering credentials for further access within the enterprise environment.
Impact & Objectives
The objectives of this ransomware campaign appeared clear: to encrypt files across the network and demand a ransom in exchange for decryption keys. We documented multiple instances where important file types, such as .docx, .xlsx, and .pdf, were targeted. The impact was not only limited to data encryption but also psychological, as ransom notes were deeply embedded within directories named “YOUR_FILES_ARE_ENCRYPTED” containing implications of permanent data loss should the ransom not be paid promptly.
MITRE ATT&CK Mapping
- T1078 – Valid Accounts: Exploitation of RDP services allowed the actor to utilize valid credentials for initial access.
- T1059.001 – PowerShell – Input Data from External Sources: WMI queries leveraged for lateral movement indicated PowerShell command usage.
- T1210 – Exploitation of Remote Services: The primary attack vector involved exploiting RDP vulnerabilities.
Detection Opportunities
- Monitor for unusual RDP authentication attempts, specifically failed login attempts followed by successful ones from the same IP range.
- Establish alerts for the creation or modification of tasks in
C:\Windows\System32\Tasks\and any entries underHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Implement network detection to flag outbound HTTP/HTTPS traffic to suspicious domains or unregistered domains not matching organizational traffic patterns.
Analyst Notes
As we continue to see the use of RDP as an entry point for malicious actors, it's crucial for organizations to regularly assess their exposure and enforce stringent password policies. Implementing multi-factor authentication could significantly reduce the risk of unauthorized RDP access. Moreover, investing in employee training to identify phishing attempts and suspicious emails may prevent the initial foothold that attackers seek. It’s a reminder to us all: vigilance is necessary to defend against evolving ransomware threats.
Source: Original Report