Sarah Chen — Malware Reverse Engineer
Key Takeaways
- REvil employs advanced evasion techniques to establish persistence.
- The operator utilizes a robust Command and Control (C2) infrastructure to exfiltrate data and facilitate encrypted communication.
- Investment in network segmentation and alerting mechanisms can mitigate the risk of lateral movement.
Executive Summary
During our analysis of a recent REvil ransomware incident, we observed the attack chain begin with email phishing targeting employees, deploying a malicious Microsoft Office document that executed PowerShell commands leading to the initial infection. The payload, once executed, established footholds via persistence mechanisms and callback functions to a well-established C2 infrastructure. As the actor sought to exfiltrate sensitive data, ransomware was deployed, encrypting files across multiple endpoints.
Initial Access
The attack vector began with a sophisticated phishing campaign, where phishers crafted an email containing a malicious link disguised as an important business document. Upon clicking the link, users were redirected to a rogue website that prompted the download of an infected DOCX file. The file contained embedded macros, which upon enabling, executed various PowerShell commands designed to download and run the actual REvil malware from the actor’s server.
Execution & Persistence
Our investigation revealed that the sample we examined took advantage of the Windows Management Instrumentation (WMI) for executing malicious scripts. We noted that once the malware was executed, it altered the registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure persistence. The entries we found indicated an auto-start mechanism that initiated the malware with every user login, in line with T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder.
Command and Control
The REvil malware established a C2 connection using HTTPS, employing domain generation algorithms (DGAs) to periodically change the domain for communication. The malware communicated via POST requests to a known set of IP addresses which had been previously identified in other cases. Our network analysis revealed that data was exfiltrated as encrypted formats to obscure activities. The payloads communicated frequently following the T1071.001 – Application Layer Protocol: Web Protocols pattern, establishing a persistent communication channel with the C2.
Lateral Movement & Discovery
Following the encryption of files on the initial host, the malware attempted lateral movement. We observed that the REvil variant exploited Windows Admin Shares and employed T1021.002 – Remote Services: SMB/Windows Admin Shares to propagate throughout the network. The malware scanned for other accessible systems, leveraging embedded credentials hardcoded within the malware to authenticate to remote systems. The spread exhibited behavior typical for advanced persistent threats aiming for maximum data acquisition.
Impact & Objectives
The primary objective of this REvil operation was twofold: encrypt data for ransom and exfiltrate sensitive data for potential leakage threats. Our analysis elucidated that the actor encrypted critical business files, making downtime significantly disruptive. Additionally, as part of the ransom note, victims were threatened with the exposure of stolen data if the demands were not met, highlighting the dual-strike nature of contemporary ransomware operations. The visible impact was severe, leading to halted operations for the targeted entities, costing them not only financially but also damaging reputational risks.
MITRE ATT&CK Mapping
- T1566 – Phishing: The delivery method utilized phishing emails to gain initial access.
- T1059.001 – Command and Scripting Interpreter: PowerShell: The malware executed commands via PowerShell as part of its initial execution.
- T1071.001 – Application Layer Protocol: Web Protocols: Utilized HTTPS to communicate with the C2 server.
- T1021.002 – Remote Services: SMB/Windows Admin Shares: Employed for lateral movement within the network.
- T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: Ensured persistence by modifying registry keys.
Detection Opportunities
- Monitor for unusual PowerShell execution particularly involving script downloads from untrusted sources.
- Implement file integrity monitoring on critical registry paths to detect changes linked to persistence mechanisms.
- Utilize EDR solutions to identify lateral movement through SMB requests, focusing on anomalous access patterns to Windows Admin Shares.
Analyst Notes
This investigation underscores the critical need for robust security awareness training coupled with technical defenses. Active monitoring of network behaviors and endpoint activities would have considerably mitigated this incident. Organizations must invest continuously in threat intelligence to adapt to the evolving landscape of ransomware threats and enhance their incident response policies accordingly.
Source: Original Report