Priya Nair — Digital Forensics Analyst
Key Takeaways
- The ransomware employs sophisticated encryption techniques targeting specific file types.
- Initial access achieved through phishing emails with malicious attachments.
- Utilizes multiple layers of command and control, incorporating both HTTP and DNS tunneling.
Executive Summary
During our recent investigation into a newly identified ransomware variant, we observed a systematic approach utilized by the threat actor to infiltrate networks and exfiltrate sensitive data. The attack vector was primarily initiated via phishing emails designed to deceive users into executing a malicious payload. Our analysis revealed a complex infrastructure that facilitated both encryption of files and communication with the threat actor’s command and control (C2) servers, emphasizing the need for robust detection capabilities within affected environments.
Initial Access
The initial access vector was traced back to well-crafted phishing emails that contained malicious attachments masquerading as legitimate documents. These documents employed macros to execute a PowerShell script, which downloaded the ransomware payload from a remote server upon user interaction. The sample we examined typically used file names indicating urgent action, such as `Invoice_2023.docm`, to entice victims to enable macros. This tactic aligns with the **Phishing** technique in the MITRE ATT&CK framework, specifically associated with **T1566**.
Execution & Persistence
Upon execution, the ransomware deployed itself to the user’s profile directory, specifically to a subfolder at %APPDATA%\LocalTemp\, which is a common staging area to evade detection. We noted that it made persistent modifications to the registry by creating new keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure the implant would execute upon system reboot. The persistence technique leveraged here correlates directly with **T1547 – Boot or Logon Autostart Execution**.
Command and Control
Our investigation into the C2 infrastructure revealed that the actor utilized a dual-layer approach, employing both HTTP and DNS tunneling to communicate with the compromised systems. The initial connection was established over HTTP, while the ransomware later transitioned to DNS for its beaconing activity, indicative of a strategy to evade network detections. The discussions with the C2 server utilized unique user agents to mimic legitimate web traffic, complicating detection efforts. This behavior corresponds with **T1071 – Application Layer Protocol** as it spans multiple application protocols for command and control communication.
Lateral Movement & Discovery
The actors demonstrated an advanced level of capability regarding lateral movement within the compromised environment. By leveraging credentials harvested during the initial runtime phase, they utilized **T1086 – PowerShell** scripts to execute commands on remote hosts. The observed PowerShell commands were designed to enumerate network shares and user sessions, facilitating the identification of additional targets for encryption. Furthermore, the actors exploited the **T1210 – Exploitation of Remote Services** technique, gaining access to additional systems through RDP sessions using stolen credentials.
Impact & Objectives
The primary objective of the ransomware was to encrypt targeted files across connected systems, with a focus on documents, databases, and cloud backups. Each file type was meticulously chosen to maximize operational impact. Additionally, we identified a data exfiltration stage, where sensitive information was targeted prior to encryption, with the threat actor likely leveraging this data for double extortion tactics. We observed that the ransomware demanded a ransom in cryptocurrency, further indicating the actor’s intent to monetize their attack comprehensively.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access was achieved through phishing emails with malicious attachments.
- T1547 – Boot or Logon Autostart Execution: Persistence mechanism established via registry key modifications.
- T1071 – Application Layer Protocol: C2 communications established over HTTP and later transitioned to DNS tunneling.
- T1210 – Exploitation of Remote Services: Lateral movement was facilitated via exploitation of RDP services using stolen credentials.
Detection Opportunities
- Monitor for suspicious email attachments that leverage macros or PowerShell scripts.
- Implement detection for registry modification activities targeting
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Employ network traffic analysis to identify anomalous DNS requests indicative of C2 communications.
Analyst Notes
This examination highlights the evolving sophistication of ransomware attacks, emphasizing the importance of comprehensive cyber hygiene practices such as user training, endpoint detection and response (EDR) solutions, and robust network segmentation. It’s crucial to stay current with threat intelligence to anticipate the tactics and techniques used by actors. Enhancing incident response plans and regularly conducting tabletop exercises can further prepare organizations to respond effectively to this ever-evolving threat landscape.
Source: Original Report