Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- Ransomware deployed through phishing emails with malicious document payloads
- Use of T1193 (Spear Phishing Link) for initial access
- Beaconing patterns observed indicating interaction with multiple C2 servers
Executive Summary
During our investigation into a recent ransomware incident, we observed a sophisticated attack chain leveraging social engineering as an entry point. The sample we examined provided insight into a complex interaction between the malware and the system, characterized by a series of well-orchestrated stages from initial entry to executing the ransomware payload. The attacker employed tailored phishing emails that bypassed standard filtering mechanisms, leading to the inevitability of further system compromise.
Initial Access
Initial access was achieved via targeted phishing emails sent to employees within the organization. These emails contained malicious hyperlinks to documents that, when opened, triggered the download of a malicious Excel document designed to exploit vulnerabilities in Microsoft Office applications. Our analysis revealed the use of T1193 (Spear Phishing Link), which highlights the importance of user awareness and training in mitigating such threats. The document utilized a macro (Macro-Enabled Document) that discreetly downloaded the first stage payload from a remote server.
Execution & Persistence
Once executed, the macro unleashed a download and execute script that fetched the next stage of the malware, identified during our analysis as LockBit variant. This ransomware employed T1059.001 (Command-Line Interface) for execution. As part of its persistence strategy, the malware created a Windows service with the name TaskSchedulerSvc, ensuring it was initiated upon system boot. This service was registered under the path HKLM\SYSTEM\CurrentControlSet\Services\TaskSchedulerSvc, which is often exploited to maintain persistence.
Command and Control
Throughout the investigation, we identified multiple Command and Control (C2) communication patterns indicative of a well-coordinated malware operation. The sample utilized Domain Generation Algorithms (DGA) to obfuscate its communication, making it difficult for security solutions to pinpoint the C2 infrastructure. We noted beacons sending regular traffic to domains such as example-c2.domain and another-c2.service. Each beaconing phase consisted of RESTful API-like calls that often resulted in the retrieval of additional payloads or command instructions, aligning with technique T1071.001 (Application Layer Protocol: Web Protocols).
Lateral Movement & Discovery
Post initial execution, the LockBit ransomware leveraged techniques for lateral movement using T1086 (PowerShell) to execute commands remotely on networked systems. We observed that the ransomware dropped a PowerShell script into the C:\Windows\Temp directory that could execute commands across the network. The script scanned for shares and utilized legitimate administrator credentials that were harvested during the initial infection. This phase underscored the ease with which the actor could escalate privileges and gain broader access to network resources.
Impact & Objectives
The primary objective of this ransomware attack was evident – to encrypt files and demand a ransom for decryption keys. Our analysis indicated a notable characteristic of this variant: it encrypted not only document files but also crucial databases, complicating the recovery efforts considerably. During the incident response, we noted the presence of ransom notes under the default name READ_ME.txt in the directories that contained encrypted files, demonstrating the typical objectives of financial gain through extortion.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: Initial access vector through targeted malicious links in emails
- T1059.001 – Command-Line Interface: Command execution through the command line or scripting languages
- T1071.001 – Application Layer Protocol: Web Protocols: Communication through web protocols for C2
- T1086 – PowerShell: Usage of PowerShell for lateral movement and execution of commands
Detection Opportunities
- Monitor for unusual outbound traffic patterns indicating potential C2 communication
- Identify and analyze any PowerShell execution in non-administrative contexts, especially calls to PowerShell scripts from temporary directories
- Deploy heuristics to identify creation of suspicious services or modifications to the registry related to service persistence
Analyst Notes
Looking back, it is evident that the actor employed a well-structured attack chain through social engineering and malware tactics. Enhancing user training about phishing threats and employing advanced endpoint detection tools could have mitigated the initial access phase. This incident serves as a stark reminder of the importance of incident response teams being prepared for such multi-layered attacks, emphasizing proactive measures to not just react but anticipate future threats.
Source: Original Report