Deep Dives

Deep Dive into the Recent Ransomware Attack: Analyzing the Tactics, Techniques, and Procedures

by n8n admin

Sarah Chen — Malware Reverse Engineer

Key Takeaways

  • The attack used a phishing email as the initial vector for ransomware deployment.
  • Persistence mechanisms included scheduled tasks and modifications to the registry.
  • Command and Control communications were primarily over HTTPS, hiding in plain sight.

Executive Summary

During a recent malware investigation, we analyzed a sophisticated ransomware strain that affected multiple organizations across various sectors. The initial access was accomplished through a well-crafted phishing campaign that targeted employees, enticing them to download a malicious attachment. The payload exhibited a series of complex behaviors aimed at establishing persistence, exfiltration of data, and ultimately, encryption of critical files. Our analysis revealed not only the inherent capabilities of the malware but also the underlying TTPs used by the threat actor throughout the attack lifecycle.

Initial Access

The breach initiated when an employee received a phishing email containing a malicious Word document. Upon opening the document, the user was prompted to enable macros. This action triggered the download of a malicious executable from a remote server, which we identified as a variant of the Emotet dropper. The sample we examined connected to the URL http://malicious-server.com/dropper.exe, showcasing the initial infection stage. The actor leveraged Phishing tactics under MITRE ATT&CK technique T1566.

Execution & Persistence

Once executed, the dropper installed the main ransomware payload and established several persistence mechanisms to ensure longevity on the infected system. Our investigation showed that it created scheduled tasks under C: asks
ansomware-task and modified the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run\MalwareName. These changes provided the malware with the ability to persist even after a system reboot. Furthermore, the ransomware employed Process Injection techniques (T1055) to avoid detection by security tools during execution.

Command and Control

The sample exhibited robust command and control capabilities, utilizing encrypted communications over HTTPS. Upon execution, it beaconed to a C2 server at https://malicious-server.com/c2 to receive further instructions. The use of HTTPS effectively masked the malicious traffic, complicating detection efforts. Through reverse engineering, we discovered that the malware could accept commands for file encryption, data exfiltration, and lateral movement commands, illustrating a comprehensive C2 framework.

Lateral Movement & Discovery

After establishing control on the initial host, the ransomware began lateral movement within the compromised network. It used legitimate tools like WMIC and PSEXEC to proliferate to other machines. We observed the malware executing commands such as wmic /node:

Source: Original Report

Related Posts