Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The ransomware employs a sophisticated delivery mechanism via phishing emails.
- Utilization of legitimate tools for lateral movement demonstrates advanced operational security.
- Indicators of Compromise (IOCs) include specific C2 domains and unique file hashes associated with the malware.
Executive Summary
During our investigation of the recent activities attributed to the ransomware group known as ‘EvilCorp’, we observed a highly methodical attack chain characterized by an initial access vector via a well-crafted phishing email. The email delivered a malicious attachment, masquerading as a legitimate document. Upon execution, the payload deployed a multi-stage attack culminating in the encryption of sensitive files across the network.
Initial Access
The first indicator of compromise emerged from a phishing campaign targeting employees of a medium-sized financial firm. Our analysis revealed that the emails were meticulously crafted to appear as internal communications, with attackers utilizing social engineering techniques to increase the likelihood of successful delivery. Embedded within the email was a link to download a malicious attachment named Invoice_2023.zip, which contained the initial dropper, a variant of EvilCorp.
Execution & Persistence
Upon execution of the dropper, it extracted a payload that exploited the Windows Script Host to run PowerShell commands designed to disable security features. In this phase, we noted the creation of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\EvilDrop, which facilitated persistence. This behavior aligns with the TTPs described in the MITRE ATT&CK framework, specifically associated with the T1547.001 – Registry Run Keys / Startup Folder technique.
Command and Control
Following initial execution, the malware established communication with its command and control (C2) server. Our investigation identified outbound requests to http://evilcorp-c2.com/api, enabling the actor to issue remote commands. This C2 pattern illustrated a robust use of HTTP traffic rather than more traditional methods like TCP or UDP, which adds a layer of evasion against network-based defenses.
Lateral Movement & Discovery
Throughout the lateral movement phase, the actor employed Mimikatz to extract credentials from memory. These credentials were then used to access other devices on the network, allowing for the deployment of additional payloads. Notably, we observed the use of T1086 – PowerShell, where the actor executed PowerShell scripts to traverse the directory structure, identifying files targeted for encryption. File paths such as C:\Users\Public\Documents\ were specifically noted as high-value targets.
Impact & Objectives
The ultimate objective of this attack was the encryption of critical data alongside ransom demands to the affected organization. Once the ransomware successfully encrypted files, it dropped a ransom note at C:\Users\Public\Desktop\RansomNote.txt, containing instructions for the victims on how to pay the bitcoin ransom to retrieve their files. The encryption routine indicated that a strong encryption algorithm was utilized, making recovery from backups an impractical solution in many instances.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access was achieved through phishing emails.
- T1070 – Indicator Removal on Host: Malicious payloads were designed to obfuscate network activity.
- T1588 – Obtain Capabilities: Use of external tools like Mimikatz indicates capability expansion.
Detection Opportunities
- Monitor email filters for known phishing indicators and malicious attachments.
- Implement endpoint detection solutions to recognize registry key modifications tied to persistence mechanisms.
- Analyze outbound HTTP traffic for known C2 domains and behavioral anomalies.
Analyst Notes
This incident underscores the pressing need for continuous training on phishing awareness and the implementation of stricter email filters. Furthermore, organizations should enhance their monitoring capabilities for unauthorized registry changes and employ advanced endpoint detection tools that can identify abnormal process behaviors indicative of ransomware deployment. The use of legitimate administrator tools for lateral movement serves as a reminder of the persistent risks associated with trust relationship misuse in enterprise environments.
Source: Original Report