Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- This ransomware campaign employs phishing emails to gain initial access to corporate networks.
- The malicious payload utilizes the Windows Management Instrumentation (WMI) for persistence and lateral movement after an initial infection.
- Indicators of compromise (IOCs) include specific registry keys and file paths associated with the implant and command and control (C2) infrastructure.
Executive Summary
During our investigation of a recent ransomware incident, we observed a sophisticated attack chain that began with a targeted phishing campaign. The primary goal of this threat actor was to establish a foothold within the corporate network, followed by lateral movement and data encryption to extort the organization. Our analysis revealed the use of various techniques across multiple stages of the attack, highlighting a significant level of sophistication typically associated with advanced persistent threat (APT) groups.
Initial Access
The initial access vector involved a series of phishing emails, strategically crafted to appear as legitimate communications from trusted vendors. Each email contained an embedded link leading to a malicious document, which upon execution, triggered the download of the primary payload. The sample we examined was identified as Gnagee, a known ransomware variant. The triggering mechanism for the download utilized PowerShell commands to evade detection, executing a series of encoded commands that reached out to the threat actor’s infrastructure.
Execution & Persistence
Once the payload was executed, it performed a series of operations to establish persistence on the infected machine. Specifically, it created several Scheduled Tasks that initiated the ransomware executable at system boot. Additionally, we identified modifications to the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, which allowed the malware to reinfect the system upon user login. Furthermore, the implant made extensive use of WMI to gather information and maintain persistence, which is indicative of technique T1047 – Windows Management Instrumentation.
Command and Control
The command and control structure implemented by the threat actor demonstrated a robust evasion strategy. Communication with the C2 was established via HTTP over encrypted channels, making detection more challenging. The actor frequently changed their domains and IP addresses to circumvent security mechanisms. The C2 infrastructure was analyzed, revealing several domains that had been registered shortly before the attack. These domains were used to transmit encryption keys and receive commands to execute further actions on the infected hosts.
Lateral Movement & Discovery
Our analysis revealed that once initial access was achieved, the actor engaged in extensive lateral movement. Utilizing Remote Desktop Protocol (RDP) and Windows Admin Shares, the actor moved through the network quietly. They employed Credential Dumping techniques (specifically T1003) to gather credentials, which facilitated further elevation of privilege and access to additional critical systems. We also observed attempts to scan for vulnerable services and open ports across the network, collecting valuable data about the network topology.
Impact & Objectives
Ultimately, the threat actor’s primary objective was to encrypt critical files on the infected systems and demand a ransom from the victims. Once the ransomware executed, it began systematically encrypting files based on specific extensions and established a ransom note that provided instructions on how victims could pay for decryption. Our investigation showed that the damage was extensive, as crucial operational files were locked away, and recovery without the decryption key posed significant risks to business continuity.
MITRE ATT&CK Mapping
- T1566 – Phishing: The use of deceptive emails to gain initial access.
- T1047 – Windows Management Instrumentation: Utilized for executing commands and maintaining persistence.
- T1075 – Credential Dumping: Techniques employed to gather credentials for lateral movement.
Detection Opportunities
- Monitor for unusual file creation under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Set alerts for unexpected PowerShell commands that include the Invoke-WebRequest or Invoke-Expression cmdlets.
- Utilize network traffic analysis tools to identify suspicious outbound connections to newly registered domains.
Analyst Notes
As we assess the evolution of cyber threats, this ransomware incident serves as a chilling reminder of the persistent and sophisticated approaches employed by threat actors today. Comprehensive security training for employees to recognize phishing attempts and robust network monitoring solutions can mitigate these risks. Additionally, establishing a thorough incident response plan will be essential for organizations to respond swiftly and effectively, should they encounter a similar attack.
Source: Original Report