Deep Dives

Comprehensive Analysis of a Targeted Ransomware Attack: Investigating the Latest Threat Dynamics

by n8n admin

Priya Nair — Digital Forensics Analyst

Key Takeaways

  • This ransomware employs a multi-stage infection process, utilizing a dropper to execute the second-stage payload.
  • We uncovered several TTPs consistent with the MITRE ATT&CK framework, specifically focused on persistence and lateral movement.
  • The Command and Control (C2) infrastructure reveals shifts that indicate the actors are continuously evolving their tactics to evade detection.

Executive Summary

During our investigation of a recent ransomware incident, we meticulously examined the malware sample and traced the infection chain from initial access to impact. The attack began with a phishing email containing a malicious attachment, which, when executed, deployed a dropper that subsequently installed the main payload. The target organization was a mid-sized financial institution, and the attack vector allowed the actors to maintain a low profile while conducting reconnaissance before executing the ransomware payload.

Initial Access

The initial access was gained through a phishing campaign that utilized a Microsoft Word document. This document contained a malicious macro that, upon opening, prompted the user to enable macros, a tactic often employed to trick less security-conscious users. Our analysis revealed that the document’s macro executed a PowerShell command to download the dropper from a remote server, indicating the use of Phishing as a technique (T1566) from the MITRE ATT&CK framework. The dropper was subsequently saved to %TEMP%\tempdrop.exe.

Execution & Persistence

Upon execution, the dropper we examined installed the main ransomware payload and set itself to run at startup. This was achieved by creating a new registry key under HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run with a value pointing to the main payload, utilizing registry run keys as a persistence mechanism. The payload was named update.exe and was located in the C:\ProgramData directory, utilizing the Registry Run Keys / Startup Folder technique (T1547).

Command and Control

Our investigation revealed a complex C2 architecture that leveraged both HTTP and DNS for communication. Once the payload was executed, it began beaconing to the specified C2 server every five minutes using a random subdomain to obfuscate its true target. The DNS queries followed a pattern that indicated Domain Generation Algorithms (DGA) were utilized. This employed the Application Layer Protocol: Web Service technique (T1071.001) and demonstrated the actor’s effort to remain undetected by changing the communication channels frequently.

Lateral Movement & Discovery

Post-compromise, the actors initiated lateral movement within the network to find additional assets to encrypt. They employed tools such as Mimikatz to harvest credentials from memory, allowing access to other machines without alerting security measures. The reconnaissance phase involved scanning the network for additional Windows hosts utilizing the Network Service Scanning technique (T1046). We identified multiple instances where the actors successfully moved laterally across the network to further infect other systems.

Impact & Objectives

The objective of the attack was primarily financial gain, resulting in the encryption of critical files and the subsequent ransom demand. Upon encryption, the malware created ransom notes in the root directories of the infected machines. Notably, the ransom demand was set in a variety of cryptocurrencies to complicate tracing efforts. The operational security of the actors was evident in the structured methodology behind file encryption, where they specifically targeted files with extensions often used in business environments, such as .docx, .xlsx, and .pptx.

MITRE ATT&CK Mapping

  • T1566 – Phishing: The actors deployed phishing emails with malicious document attachments to gain initial access.
  • T1071.001 – Application Layer Protocol: Web Service: The malware utilized web services for C2 communications.
  • T1547 – Registry Run Keys / Startup Folder: Persistence was achieved through registry modifications to auto-start the ransomware at system boot.

Detection Opportunities

  • Monitor for unusual PowerShell activity, particularly those that download files from external sources.
  • Implement rules to detect changes to HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run registry key.
  • Utilize DNS logging and threat intelligence feeds to identify suspicious domain behavior related to known DGAs.

Analyst Notes

This incident reinforces the importance of multi-layered defenses that encompass user training against phishing, robust endpoint security, and continuous monitoring of network anomalies. As threat actors evolve their TTPs, organizations must remain vigilant and adaptive to emerging tactics, techniques, and procedures.

Source: Original Report

Related Posts