Priya Nair — Digital Forensics Analyst
Key Takeaways
- The attack commenced with a well-crafted phishing email that included a malicious attachment.
- We identified the malware as LockBit, deployed via a double extension technique to mislead users.
- Robust communication patterns with the C2 infrastructure leveraged encrypted protocols, complicating detection efforts.
Executive Summary
During our investigation of a recent ransomware incident, we uncovered a sophisticated attack chain that commenced with targeted phishing emails delivered to employees within the organization. The emails were crafted to mimic internal communications, increasing the likelihood of user engagement. Our analysis revealed that the infection vector was a malicious attachment disguised as a legitimate document, which successfully executed LockBit ransomware upon opening. The ensuing chaos involved the encryption of critical files, significantly impacting business operations.
Initial Access
The initial vector for this ransomware attack was a carefully constructed phishing email that appeared to come from a trusted source. The email contained an attachment named Invoice_March_2023.docx.exe, utilizing a double extension technique. We observed that many users failed to recognize the executable extension due to their familiarity with the document format. Once opened, the attachment triggered the execution of the ransomware payload.
Execution & Persistence
Once the LockBit payload executed, it brushed aside any user prompts and began its encryption routine. Our analysis of the sample indicated it leveraged PowerShell scripts for execution to maintain stealth and environment compatibility. Additionally, it created persistence mechanisms by writing a new registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\, thus ensuring its execution on system reboot. The registry key was named WindowsUpdate to mask its malicious intent.
Command and Control
Following deployment, the malware initiated communication with its command and control (C2) infrastructure. The analysis revealed that it used multiple layers of encryption over HTTPs, making traditional network-based detection methods ineffective. The C2 domain appeared to have been freshly registered, exhibiting a pattern consistent with actors trying to evade detection. We noted that the beaconing occurred every 30 seconds, attempting to establish a robust channel for receiving further instructions.
Lateral Movement & Discovery
After establishing communication with its C2 server, the malware employed T1071.001 – Application Layer Protocol: Web Protocols to command lateral movement across the network. Utilizing stolen credentials harvested from the initial compromised machine, the malware spread to other machines using T1021.001 – Remote Services: Remote Desktop Protocol. As it moved laterally, it employed various discovery commands to identify other active sessions and potential targets, including enumeration of network shares via net view commands.
Impact & Objectives
The principal objective of the attack was financial gain through ransomware deployment. Our investigation revealed that the actors behind LockBit typically demanded ransoms ranging from several thousand to hundreds of thousands of dollars based on the organization’s size and perceived ability to pay. The rapidity with which files were encrypted and the extensive file types targeted indicated a well-planned operation, emphasizing the actor’s experience in maximizing impact during such incidents.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access method via malicious email attachments.
- T1203 – Exploitation for Client Execution: The execution of malicious software upon user engagement with the attachment.
- T1071.001 – Application Layer Protocol: Web Protocols: Use of web protocols for command and control communication.
- T1021.001 – Remote Services: Remote Desktop Protocol: Lateral movement through exploitation of remote access services.
Detection Opportunities
- Implement email filtering solutions to block suspicious emails containing double extensions.
- Monitor registry changes specifically for new Run keys post-execution of attachments.
- Employ network anomaly detection tools to identify unusual outbound communications, especially with newly registered domains.
Analyst Notes
This attack serves as a stark reminder of the increasing sophistication of ransomware threats. It highlights the importance of user education regarding phishing and the vulnerabilities associated with executable files disguised as documents. As the attack landscape evolves, organizations must adopt a proactive security posture that includes comprehensive monitoring, user training, and automated responses to potential threats. Continuous threat intelligence sharing will also enhance detection and response capabilities against emerging TTPs.
Source: Original Report