Priya Nair — Digital Forensics Analyst
Key Takeaways
- Ransomware deployers are increasingly utilizing phishing emails as the vector for initial access.
- We observed the use of custom command and control (C2) infrastructure to maintain persistence and evade detection.
- Lateral movement techniques employed included exploitation of vulnerable systems and stolen credentials.
Executive Summary
During our investigation of a recent ransomware attack, we analyzed the attacker’s strategy, the malware characteristics, and the forensic artifacts left behind. The analysis revealed a well-coordinated campaign that exploited multiple vulnerability vectors and employed a range of tactics, techniques, and procedures (TTPs) aligned with the MITRE ATT&CK framework. The attack commenced with a targeted phishing email that delivered an initial payload, which enabled the actor to gain a foothold within the network.
Initial Access
The initial access phase was facilitated by a phishing email containing a malicious attachment disguised as an important document. Upon being opened, the document executed a PowerShell script that downloaded the main payload from the C2 server. The sample we examined revealed the use of obfuscated scripts to evade typical email security solutions. Additionally, the attachment had a unique filename pattern that suggested it was tailored for specific targets, hinting at a reconnaissance phase prior to the attack.
Execution & Persistence
Once the malware was executed, it established persistence by creating a scheduled task. Our analysis revealed the task was configured to invoke the payload every time the system started. The task was found registered under C:\Windows\System32\Tasks\MalwareTask. The malware employed techniques associated with T1203 – Exploitation for Client Execution by leveraging known vulnerabilities in Microsoft products to escalate privileges and execute additional malicious code. The presence of multiple registry entries under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run indicated additional persistence mechanisms were in place, further complicating detection efforts.
Command and Control
The implant communicated with a C2 server using custom HTTP requests designed to blend in with legitimate traffic. We discovered that this C2 server resolved to a dynamic DNS provider, indicating an attempt by the actor to maintain operational security. During our investigation, we noted specific patterns in the HTTP user-agent strings, which were unique and had specific time-based attack patterns. The server returned various commands to the malware depending on its operational state, which allowed the attacker to control the malware’s actions remotely.
Lateral Movement & Discovery
To facilitate lateral movement, the actor employed multiple techniques, including T1078 – Valid Accounts to leverage stolen credentials. We observed the malware harvesting credentials stored in browsers and from application pools, with specific emphasis on accessing remote desktop protocols (RDP) in other systems. Additionally, exploitation scripts were deployed that scanned the network for vulnerable systems, leading to further breaches across endpoints. Network segmentation was circumvented through a combination of credential dumping and lateral movement via Windows Management Instrumentation (WMI) calls.
Impact & Objectives
The primary objective of the actor appeared to be data exfiltration followed by deployment of ransomware. Evidence from the compromised environment suggested that significant volumes of sensitive data were extracted before the ransomware was deployed. The final payload utilized cryptographic algorithms to encrypt files with recursive paths, thus affecting not just local devices but extensive shares on the network. As observed, files were renamed with a specific extension, severely disrupting business operations and requiring a substantial recovery effort.
MITRE ATT&CK Mapping
- T1566 – Phishing: Used to gain initial access through a malicious email with attachments.
- T1203 – Exploitation for Client Execution: Executing code from a vulnerable application post initial access.
- T1078 – Valid Accounts: Utilizing stolen credentials for lateral movement.
Detection Opportunities
- Monitor for anomalous PowerShell instances executing scripts from user directories.
- Implement detection of scheduled tasks created outside of administrative control.
- Establish logging and alerting on unusual DNS requests and HTTP traffic patterns indicative of C2 communications.
Analyst Notes
The investigation underscores the necessity of robust phishing defenses and the importance of user training regarding suspicious emails and attachments. Additionally, effective monitoring for unusual account behavior and timely patch management could significantly mitigate risks associated with similar ransomware attacks. We recommend maintaining an updated inventory of known vulnerabilities and implementing layered security models to prevent unauthorized lateral movement.
Source: Original Report