Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The observed ransomware leveraged email phishing as an initial access vector.
- Persistence was achieved through the use of a scheduled task that executed a malicious binary.
- Command and control communication showed indicators of compromise with C2 servers demonstrating a mix of HTTP and DNS tunneling.
Executive Summary
In our recent investigation into a targeted ransomware attack, we uncovered a sophisticated threat actor employing a multi-stage attack chain. The sample we examined highlighted several tactics, techniques, and procedures (TTPs) that allowed the actor to gain access, maintain persistence, and ultimately execute their malicious payload while evading detection mechanisms. The threat was characterized by its use of phishing emails, advanced lateral movement, and a robust command and control (C2) infrastructure.
Initial Access
During the investigation, we identified that the initial access vector was an email phishing campaign, where the actor utilized a meticulously crafted email containing a malicious attachment. This attachment was a Microsoft Word document that, upon opening, prompted the user to enable macros. By employing the T1203 – Exploitation for Client Execution technique, the document executed a PowerShell command designed to download additional malicious payloads. The downloaded files were encoders that disguised the ransomware as benign updates.
Execution & Persistence
Our analysis revealed that the ransomware utilized a multi-stage dropper mechanism. Once the payload was executed, it wrote itself to the filesystem in the path C:\Users\Public\Documents\svchost.exe and also established persistence. The actor created a scheduled task using the command schtasks /create /tn
Source: Original Report