Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- A sophisticated ransomware strain used living-off-the-land techniques to evade detection.
- The attacker leveraged scheduled tasks for persistence, complicating remediation efforts.
- Initial access was achieved via phishing, demonstrating the risk associated with user awareness levels in organizations.
Executive Summary
During our investigation of a recent ransomware incident affecting multiple enterprises, we observed a well-orchestrated attack chain that showcased the actor’s proficient use of established tactics and techniques. The threat actor executed this operation with a focus on stealth and persistence, employing tools and methods that blended into the legitimate operations of the affected environments. This analysis outlines the attack lifecycle, detailing the techniques involved from initial access to lateral movement and impact assessment, ultimately providing insight into detection and mitigation strategies.
Initial Access
The initial compromise stemmed from a targeted phishing campaign, where the attacker disseminated unsolicited emails containing malicious attachments. We identified that these attachments were crafted to take advantage of Microsoft Office vulnerabilities, specifically utilizing macros to deliver the payload. Upon enabling macros, the user inadvertently launched a dropper executable that utilized the file path %APPDATA%\Roaming\update.exe for its installation. This executable was responsible for decrypting the main payload and executing it in memory without writing it to disk, thereby avoiding traditional signature-based detection methodologies.
Execution & Persistence
Once executed, the ransomware employed several persistence mechanisms. Our analysis revealed that the actor configured a scheduled task under the name MicrosoftUpdateTask using the following command: schtasks /create /tn
Source: Original Report