Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Detailed examination of the ransomware’s initial access vector and propagation techniques.
- Identification of C2 communication patterns and network behaviors indicative of compromise.
- Insights into the persistence mechanisms employed by the actor for evading detection.
Executive Summary
During our investigation of a recent ransomware incident, we observed a malicious actor exploiting a variety of tactics to gain initial access and deploy their payload. The attack unfolded over several stages, revealing sophisticated methodologies typical of organized cybercriminal groups. Our analysis focused on dissecting the entire kill chain, from initial access to the final compromise.
Initial Access
The attack began with a phishing email that contained a malicious attachment masquerading as a legitimate document. The sample we examined utilized a macro-based technique to execute a PowerShell script upon enabling macros in Microsoft Word, leading to the download of the ransomware binary from a remote server controlled by the actor. This aligns with the MITRE ATT&CK technique T1203 – Exploit Public-Facing Application, as the initial exploit relied on user interaction to execute the malware.
Execution & Persistence
Once executed, the ransomware encrypted files on the infected system, generating a distinctive extension for encrypted files which made identification straightforward. Furthermore, our analysis revealed that the malware created scheduled tasks in the Windows Task Scheduler to ensure persistence across reboots. Specifically, the following command was observed: schtasks /create /tn
Source: Original Report