Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The Hail Mary ransomware utilizes sophisticated phishing campaigns as its initial access vector.
- It employs advanced techniques for persistence, including the manipulation of scheduled tasks and Windows services.
- Communication with command and control (C2) servers is accomplished through encrypted channels, obfuscating the traffic.
Executive Summary
During our investigation into the Hail Mary ransomware, we observed an intricate attack chain that leverages multiple techniques to establish foothold and propagate within target environments. The actor’s methodology is indicative of their advanced capabilities and suggests a high level of sophistication in operation design. Our analysis focused on a sample of the malware that was detected during a recent cyber incident and performed extensive reverse engineering to delineate its behavior.
Initial Access
The attack began with a well-crafted phishing email, containing a malicious attachment disguised as a legitimate invoice PDF. The attachment, when opened, prompted the user to enable macros, thereby executing a VBA script embedded within. This script was responsible for downloading the primary loader of the Hail Mary ransomware from a remote URL. Upon execution, the loader dropped the ransomware binary into the user’s profile directory at C:\Users\Public\Documents\invoice.bat and initiated its execution.
Execution & Persistence
Upon execution, the ransomware revealed its capability to change its appearance and evade detection mechanisms actively. Initial analysis showed that it encoded its strings, and our examination of the binary indicated that it checks for the presence of security tools on the system, aborting execution if any are found. To maintain persistence, Hail Mary manipulated the Windows Task Scheduler using PowerShell to create a scheduled task at C:\Windows\System32\Tasks\HailMaryTask, configured to trigger at user logon. Furthermore, it established a Windows service with the name HailMaryService, ensuring the payload persisted through reboots.
Command and Control
Our analysis revealed that the ransomware implemented robust command and control mechanisms. It communicated with its C2 servers over HTTPS, using a series of randomly generated subdomains, which obfuscated its detection during reconnaissance efforts. The network traffic exhibited characteristics consistent with encrypted payloads, complicating our ability to analyze the communications. The use of domain fronting techniques raised the stakes, indicating that the actor had a clear understanding of how to bypass traditional security measures.
Lateral Movement & Discovery
As part of the attack progression, the ransomware utilized techniques such as credential dumping with T1003 – Credential Dumping, leveraging tools like Mimikatz to extract login credentials from memory. We observed attempts to move laterally across the network using these harvested credentials to access other machines. The actor also deployed the T1046 – Network Service Scanning technique to identify additional targets within the network, focusing on services that were vulnerable or misconfigured.
Impact & Objectives
The primary objective behind Hail Mary ransomware was to encrypt critical user files and demand a ransom payment in Bitcoin. During our investigation, we noted that the ransomware employed strong encryption algorithms, rendering files irrecoverable without the decryption key. The threat actor’s goal appeared to be financial gain, but the systemic implications of the data loss could also lead to reputational damage and concerns regarding data privacy for the victims.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Attachment: Delivery method using an enticing document to trick the user into enabling macros, executing malicious code.
- T1053 – Scheduled Task/Job: Leveraged to maintain persistence, executing the ransom payload consistently.
- T1003 – Credential Dumping: Used to gather credentials to facilitate lateral movement within the environment.
Detection Opportunities
- Monitor for abnormal scheduled tasks being created, especially those that reference unusual or non-standard paths.
- Implement EDR solutions to detect obfuscated payloads and suspicious PowerShell scripts that may indicate intrusion attempts.
- Analyze outbound traffic for signs of HTTPS requests to known malicious IPs or rapid subdomain generation that express C2 behavior.
Analyst Notes
Our investigation into the Hail Mary ransomware highlights the necessity for proactive defense postures that leverage user training, robust email filtering, and comprehensive endpoint detection and response strategies. Given the sophistication observed, organizations must remain vigilant, ensuring that both employee awareness and technical defenses are regularly updated to counteract evolving threats in the landscape.
Source: Original Report