Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The attack utilized a sophisticated multi-stage intrusion technique leveraging phishing emails as the initial access vector.
- We identified the use of the PowerShell script for execution and persistence, coupled with a unique method of establishing command and control.
- Lateral movement was orchestrated through Windows Management Instrumentation (WMI), allowing the threat actor to traverse the network undetected.
Executive Summary
During our investigation into a recent ransomware attack, we uncovered a well-coordinated operation that exemplifies the evolving tactics of threat actors. The malware in question, identified as LockBit, leveraged a multi-faceted attack chain beginning with a phishing campaign targeting the employees of a large organization. Our analysis revealed several key techniques employed throughout the attack, showcasing both the sophistication of the malware and the methodologies that facilitated its successful deployment. This report chronicles the various stages of the attack, from initial access to execution, command and control, and lateral movement, ultimately leading to a significant impact on the organization.
Initial Access
Initial access was achieved through a targeted phishing campaign employing socially engineered emails containing malicious attachments. These attachments, identified as a PDF masquerading as an invoice, contained embedded macro scripts. Upon enabling macros, a PowerShell downloader was executed, retrieving the LockBit payload from a remote server. The downloaded executable was observed to be obfuscated, making detection efforts challenging at this phase of the attack.
Execution & Persistence
Once the LockBit payload was executed, it initiated a series of commands leveraging PowerShell for execution and persistence. Our analysis revealed that the malware created a scheduled task located at C:\Windows\Tasks\LockBitTask to ensure its persistence across reboots. The task was configured to run a randomly named script located in the C:\Users\Public\Documents\ directory every hour, maintaining a foothold within the system.
Command and Control
The command and control (C2) infrastructure leveraged domain generation algorithms (DGA) to evade detection and maintain communication with the compromised hosts. The C2 communications were established over HTTPS, with our logs indicating a series of requests directed toward a dynamic domain associated with the actor. Notably, the traffic was designed to blend with legitimate web traffic, thus minimizing the risk of detection from perimeter defenses. We observed frequent beaconing, with intervals of approximately 30 minutes.
Lateral Movement & Discovery
Subsequent to establishing persistence, we noted the use of Windows Management Instrumentation (WMI) for lateral movement within the environment. The actor employed WMI queries to enumerate systems on the network, targeting specifically high-value assets. Additionally, the use of PsExec was identified as a means to deploy the malware across other machines using stolen credentials gathered previously via keylogging techniques. This allowed the threat actor to propagate the infection rapidly.
Impact & Objectives
The ultimate objective of the attack appeared to be both data exfiltration and encryption of critical files, consistent with the operational goals of ransomware groups. During our forensic analysis, we detected several files being encrypted with the .lockbit extension, rendering critical business documents inaccessible. Furthermore, ransom notes were deployed across numerous directories, indicating the extent of the attack and demanding payment in cryptocurrency for the decryption keys. The operational downtime incurred by the organization due to this incident extended to several days, with significant implications for ongoing business activities.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: Malicious communications were established using HTTPS to blend with legitimate traffic.
- T1059.001 – Command and Scripting Interpreter: PowerShell: The actor used PowerShell for both executing the payload and maintaining persistence.
- T1086 – PowerShell: PowerShell was integral to various activities including downloading additional payloads.
- T1021.001 – Remote Services: Remote Desktop Protocol: Used to access additional systems via stolen credentials.
- T1077 – Windows Admin Shares: WMI and Admin shares were used for lateral movement.
Detection Opportunities
- Implement monitoring for unusual outbound traffic patterns, especially HTTPS connections to newly observed domains.
- Establish alerts on the creation and execution of scheduled tasks resembling patterns seen in the attack.
- Utilize EDR solutions to detect PowerShell command executions and scripting misuse.
Analyst Notes
This incident serves as a stark reminder of the effective strategies employed by modern threat actors. Emphasis should be placed on user education concerning phishing tactics, coupled with the implementation of robust endpoint protection and network monitoring solutions. Continuous threat intelligence updates and incorporating AI-driven anomaly detection can significantly bolster defensive measures against such sophisticated attacks in the future.
Source: Original Report