Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The attack highlights the effectiveness of using social engineering for initial access via phishing emails that deliver malicious documents.
- The malware employed utilizes multiple persistence mechanisms, including directory hijacking and scheduled tasks.
- C2 communications are established over HTTPS, using a blend of legitimate servers and compromised domains to evade detection.
Executive Summary
This analysis details a recent sophisticated phishing campaign that ultimately led to the deployment of ransomware on victim networks. Our investigation revealed a multifaceted approach utilized by the threat actor to establish a strong foothold within the targeted environments. The thorough use of social engineering, along with robust malware techniques, allowed the actor to execute their operation stealthily and effectively, causing significant disruption for the affected organizations.
Initial Access
During our investigation, we observed that the initial access was achieved through well-crafted phishing emails targeting employees within the victim organizations. These emails included a malicious attachment disguised as a PDF document related to finance, a tactic consistent with the actor’s attempts to leverage urgency and fear. Upon opening the attachment, users were prompted to enable macros, activating the embedded macro which ultimately downloaded the primary malware payload from a remote server. The actor’s use of Initial Access Technique – Phishing (T1566.001) was significant in gaining foothold quickly.
Execution & Persistence
The sample we examined executed various techniques to ensure persistence within the compromised systems. Our analysis revealed that the malware added itself to the startup programs located in the directory C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup. It also created a scheduled task with the following parameters: schtasks /create /tn
Source: Original Report