Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- The attack exploited a carefully crafted phishing email to deliver a ransomware payload.
- Indicators of Compromise (IOCs) include specific file hashes and C2 IP addresses associated with the dropper’s activities.
- Lateral movement was executed using T1075: Pass the Ticket technique, indicating a sophisticated level of access.
Executive Summary
During our analysis of a recent ransomware attack, we observed a multi-faceted approach by the threat actor that showcased both social engineering tactics and advanced technical maneuvers. The incident began with a targeted phishing campaign, leveraging enticing subject lines that led unsuspecting users to download a malicious executable. This executable served as the initial dropper, which deployed the ransomware across compromised systems. The ensuing chaos from the attack not only locked critical files but also presented a grim lesson in the necessity of vigilance and effective incident response strategies.
Initial Access
The initial access vector in this incident was a phishing email that masqueraded as a legitimate request from a well-known supplier. Our investigation revealed that the sender’s email address had been spoofed, effectively bypassing email filters. The attached document included macros that, when enabled, dropped a malicious executable file at C:\Users\[USERNAME]\AppData\Local\Temp\malicious.exe. The use of macros is a commonly seen tactic in phishing attacks, corresponding with T1137: Trusted Developer Utilities. Following the execution of this dropper, the payload initiated communication with its command-and-control (C2) server.
Execution & Persistence
Once executed, the dropper attempted to maintain persistence by modifying the Windows registry. We found entries under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run that pointed to the malicious executable, ensuring it was launched on startup. This technique aligns with T1543: Create or Modify System Process. The persistent nature of this implant meant that even after a system restart, the ransomware would re-engage, securing the attacker’s foothold on the network.
Command and Control
The communication patterns with the C2 server were particularly telling. Our analysis indicated that the malware utilized HTTP POST requests to transmit stolen data, responding to commands from the threat actor. The C2 infrastructure appeared to leverage a mix of static and dynamic DNS for resilience against takedown attempts. Specifically, the IP addresses we tracked were linked to several known malicious domains, providing further clarity on the tactics employed. This behavior maps closely to T1071: Application Layer Protocol, demonstrating the actor’s ability to blend in with legitimate traffic.
Lateral Movement & Discovery
The threat actor did not stop at initial system compromise. By exploiting credentials harvested during the initial phase, the actor executed lateral movement. We assessed that the ransomware propagated through shared directories, utilizing T1075: Pass the Ticket, leveraging Windows Kerberos tickets to access additional systems on the network without prompting the user for credentials. Evidence of this lateral movement was found in logs, indicating a rapid escalation of privileges that allowed the actor to access sensitive folders across multiple systems.
Impact & Objectives
The overarching objective of the attack was to maximize the disruption caused by the ransomware deployment. Once the ransomware encrypted files, it appended the extension “.locked” to affected documents, effectively rendering them inaccessible to users. Our analysis of the ransom note left behind indicated a demand for Bitcoin payment in exchange for decryption keys. The financial implications of the attack, combined with potential reputational damage to the organization, aligned with typical objectives for such actors — exploitation and extortion being primary motivators.
MITRE ATT&CK Mapping
- T1137 – Trusted Developer Utilities: Utilizing trusted developer utilities to execute malicious macros.
- T1543 – Create or Modify System Process: Modifying registry keys for persistence.
- T1071 – Application Layer Protocol: Using application layer protocols for C2 communication.
- T1075 – Pass the Ticket: Using Kerberos tickets to move laterally through the network.
Detection Opportunities
- Implement monitoring for unusual registry modifications under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Use threat intelligence feeds to identify known malicious C2 IPs and domains.
- Deploy Endpoint Detection and Response (EDR) solutions that can recognize lateral movement behaviors.
Analyst Notes
This incident underscores the importance of user training in recognizing phishing attempts and the continual monitoring of network traffic for anomalies. Enhanced endpoint protections and timely patching of vulnerabilities are critical in mitigating future risks. Additionally, maintaining regular backups and practicing incident response drills can significantly lessen the impact of such ransomware attacks.
Source: Original Report