In-Depth Analysis of a New Variant of the XYZ Ransomware: Tactics, Techniques, and Procedures

Sarah Chen — Malware Reverse Engineer

Key Takeaways

• This variant of XYZ ransomware employs sophisticated obfuscation methods and utilizes legitimate tools for lateral movement.
• The payload exhibits a multi-stage infection process that enhances its evasion capabilities against traditional detection methods.
• Indicators of Compromise (IOCs) linked to this campaign include unique hash values, command and control server IPs, and modified registry keys.

Executive Summary

In our analysis of the latest variant of XYZ ransomware, we observed a series of sophisticated tactics employed by the threat actor aimed at maximizing impact while minimizing detection. The attack leverages common infection vectors but significantly enhances its evasion techniques, making it a pressing concern for organizations worldwide. This report delves into the nuanced phases of the attack, exploring initial access, execution mechanisms, command control setups, and lateral movement strategies along with the overall impact of the malware.

Initial Access

The primary method of initial access we identified during our investigation was through spear phishing emails containing malicious links. These emails appeared to originate from trusted internal communication channels, increasing the likelihood that users would interact with the payload. Once the link is clicked, the victim is redirected to a remote hosting service where a .zip file containing the dropper is hosted. The dropper executable, once extracted, uses PowerShell to enable file execution, circumventing many endpoint security solutions.

Execution & Persistence

Upon execution, the dropper initiates a series of commands that drop the primary payload into the directory C:\ProgramData\svc.exe. This executable is signed with a valid certificate, a tactic used by the actor to evade detection mechanisms. Furthermore, the payload employs Persistence Mechanism techniques by modifying the registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure that the malware runs each time the system is rebooted. This approach further entrenches the threat within the environment, as it operates with user-level permissions.

Command and Control

Once the ransomware is deployed, it establishes a command and control (C2) channel to exfiltrate data and receive instructions. Our analysis revealed that the malware utilizes a blend of DNS tunneling and HTTPS requests to communicate with its C2 servers. The communication is often obfuscated using Base64 encoding, making it difficult for security solutions to identify malicious traffic. The C2 servers were primarily hosted on cloud infrastructure, indicating a strategy to maintain flexibility and resiliency.

Lateral Movement & Discovery

The ransomware does not limit itself to the initially compromised host. Our investigation found evidence of Lateral Movement techniques utilized by the actors to spread the infection across the network. Specifically, the malware exploits vulnerabilities in the SMB protocol to access shared network resources. We observed the execution of Pass-the-Hash techniques to authenticate against other machines without needing to know user passwords directly, thereby facilitating rapid deployment across the environment. Additionally, the malware uses tools such as Mimikatz to harvest credentials from memory, further enhancing the actor’s ability to propagate their malicious presence.

Impact & Objectives

As with prior iterations of XYZ ransomware, the primary objective of this campaign is data encryption with an added emphasis on data theft. The actor appears to systematically exfiltrate sensitive data prior to encryption, potentially leveraging the data for double extortion tactics. Victims are informed that their data will be published if the ransom is not paid, making any decision to ignore the threat a risky proposition. The financial motive behind the attack is further underscored by the ransom note left on the victim’s systems, indicating the actor’s demand for payment in cryptocurrencies.

MITRE ATT&CK Mapping

• T1059.001 – Command-Line Interface: Malicious commands are executed via PowerShell, allowing for script execution and further payload deployment.
• T1071.001 – Application Layer Protocol: Web Protocols: Communication with C2 servers is accomplished through HTTPS and DNS tunneling.
• T1086 – PowerShell: The malware makes extensive use of PowerShell for deployment and command execution.
• T1010 – Application Layer Protocol:**: The attack takes advantage of applications like SMB to facilitate lateral movement in the environment.
• T1021.001 – Remote Services: RDP: The malware attempts to use stolen credentials for RDP connections to access additional machines on the network.