Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The threat actor employed a sophisticated multi-stage attack strategy to gain initial access.
- Malicious PowerShell scripts were a key component of the execution and persistence phases.
- Beaconing with C2 servers was observed, indicating a solid strategy for stolen data exfiltration.
Executive Summary
During our investigation into the recent spike in ransomware attacks targeting financial institutions, we observed a complex and systematic approach employed by the threat actor. The sample we examined reveals a clear attack chain, leveraging multiple techniques throughout the kill chain. This post will break down the initial access methods, persistence mechanisms, command and control (C2) strategies, and the eventual impact on the victim’s network.
Initial Access
The initial access appeared to be facilitated by phishing emails containing malicious attachments disguised as legitimate invoices. Our analysis revealed that the email headers were spoofed to look like they came from trusted clients, enhancing the likelihood of successful delivery. Upon opening the attachments, which were crafted as Microsoft Word documents, macros were enabled to exploit vulnerabilities such as CVE-2017-11882. This particular exploit allowed remote code execution, providing the actor with foothold capabilities without raising significant alarms.
Execution & Persistence
Once the macro was executed, it deployed a dropper, which is primarily a PowerShell script designed to download additional payloads from the C2 server. The sample exhibited features of PowerShell-based malicious activity, utilizing the Invoke-WebRequest command to retrieve further components hidden within compromised domains. Post-infection, we noted that the dropper also implemented persistence by modifying the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run, ensuring reinfection upon system reboot.
Command and Control
As part of our ongoing analysis, we captured C2 communications which employed domain generation algorithms (DGA) to establish a resilient communication channel with the threat actor’s infrastructure. This C2 traffic often utilized non-standard ports, making detection more challenging. The actor’s choice of encrypted protocols contributed to the obfuscation of their actions, as we observed TLS-encrypted requests to various dummy domains. The payloads sent during these sessions disclosed details about the internal environment, including hostname, user accounts, and active directory structure.
Lateral Movement & Discovery
Upon further exploitation, the actor leveraged several lateral movement techniques. We observed a usage pattern consistent with T1075 – Pass the Hash during our network traffic analysis, where stolen credentials from the first compromised system were used to access other critical infrastructure within the organization. Furthermore, tools like Mimikatz were employed, allowing the actor to extract plaintext passwords and Kerberos tickets, facilitating deeper network infiltration. Additionally, reconnaissance activities revealed usage of WMIC commands to identify active sessions and networked devices, thus broadening their attack surface.
Impact & Objectives
The primary goal of the threat actor appeared to be data exfiltration and subsequent ransom demands, typically targeting sensitive financial data. During the incident, we noted that the malicious payload included mechanisms to identify and encrypt critical data files across the network shares. The impact of the ransomware deployment was significant, resulting in substantial operational downtime and financial losses for the organization. The recovery from the incident necessitated extensive forensic analysis and cleanup, emphasizing the operational challenges posed by such sophisticated attacks.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: The attacker gained access through a malicious email containing a payload.
- T1059.001 – PowerShell: Utilized for executing malicious scripts post-compromise.
- T1075 – Pass the Hash: Facilitation of lateral movement within the network.
Detection Opportunities
- Monitor for unusual outbound connections to non-standard ports, which may indicate C2 traffic.
- Implement alerts for changes to critical registry keys typically associated with persistence mechanisms.
- Analyze PowerShell logs to identify irregular command executions, especially those involving
Invoke-WebRequest.
Analyst Notes
In reviewing the tactics employed by the threat actor, it is evident that constant vigilant monitoring is essential for early detection of these advanced persistent threats. Enhancing employee training on phishing avoidance, coupled with robust endpoint protections and active network monitoring, can significantly improve an organization’s resilience against such multifaceted attacks.
Source: Original Report