Priya Nair — Digital Forensics Analyst
Key Takeaways
- RansomeXXX utilizes spear-phishing emails as its primary attack vector.
- The malware employs T1543.003 to establish persistence via scheduled tasks.
- Command and Control is achieved through a multi-layered approach, employing both HTTP and WebSocket communications.
Executive Summary
During our investigation of an active ransomware campaign dubbed RansomeXXX, we observed a sophisticated attack leveraging spear-phishing emails as the initial access point. The malware is engineered to encrypt user files and demand ransom, employing a range of obfuscation techniques to evade detection. Our analysis revealed a well-organized attack lifecycle, which encompassed initial access, execution, command and control, lateral movement, and ultimately, impact. Through our detailed exploration, we have identified key indicators of compromise and crafted tailored detection strategies to bolster defenses.
Initial Access
Initial access was achieved through a carefully crafted spear-phishing email that used social engineering techniques to entice users into clicking a malicious hyperlink. The link led to a downloadable ZIP file containing the payload disguised as an invoice document. Upon extraction, the file presented an executable that initiated the infection process. The use of social engineering tactics was apparent; the email mimicked an official communication from a known supplier, making it more likely to bypass security awareness training.
Execution & Persistence
Upon execution, the RansomeXXX malware employed process injection techniques to run stealthily under a benign process. We identified that it injected code into explorer.exe to mask its activities. Furthermore, to maintain persistence, the malware created a scheduled task using T1543.003 – Create or Modify System Process. The task was configured to execute the malware at system startup and was named UpdateService, residing under the task scheduler library at \Microsoft\Windows\UpdateService. This desensitization allowed it to potentially re-infect systems if the initial execution were to fail.
Command and Control
Our investigation revealed that the malware utilized a hybrid command and control (C2) infrastructure, employing both HTTP POST requests and WebSocket connections. The C2 domain used was associated with a server located in a geographically obfuscated region, making attribution challenging. Our analysis showed the malware sent beacons every 60 seconds to c2.examplemalicious.com, where it awaited further instructions or keys for file encryption. The command responses were encrypted using a proprietary scheme, ensuring secure communications with the C2.
Lateral Movement & Discovery
Post-compromise, the actor deployed lateral movement techniques leveraging T1021.001 – Remote Services: Windows Admin Shares. The malware scanned for accessible admin shares across the network, which were then exploited using stolen credentials obtained previously through keystroke logging. Additionally, it employed T1083 – File and Directory Discovery to locate sensitive files, particularly those pertinent to financial and customer data, ensuring maximum impact upon encryption. The identification of these files was critical to their overall extortion strategy.
Impact & Objectives
The primary objective of RansomeXXX was to encrypt critical business data and demand a ransom payment for decryption keys. During our analysis, we noted that the malware was capable of encrypting files with extensions commonly associated with business operations, such as .docx, .xlsx, and .pdf. The ransom note, which appeared on compromised systems, demanded payment in cryptocurrency, further emphasizing the actor’s intent to remain anonymous. Successful execution of the ransomware resulted in significant operational disruption, with organizations facing downtime, loss of productivity, and potential reputational damage.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: Utilizes WebSocket and HTTP for C2 communications.
- T1543.003 – Create or Modify System Process: Establishes persistence through scheduled tasks.
- T1021.001 – Remote Services: Windows Admin Shares: Leverages admin shares for lateral movement.
Detection Opportunities
- Monitoring for unusual outbound connections to ephemeral ports associated with HTTP and WebSocket traffic might indicate C2 activity.
- Analyzing scheduled tasks for anomalies, particularly those invoking unfamiliar applications or located in uncommon directories.
- Deploying file integrity monitoring on sensitive directories to detect unauthorized encryption or file modifications.
Analyst Notes
This investigation showcased the evolving nature of ransomware attacks and the increasing sophistication of threat actors. Recognizing TTPs associated with RansomeXXX can provide critical insights for incident response teams. Organizations are encouraged to enhance their monitoring capabilities and initiate targeted training to combat social engineering attacks effectively. With proper vigilance and response strategies, it is possible to mitigate the impact of such threats and enhance the overall security posture.
Source: Original Report