{"id":123901,"date":"2022-10-18T11:00:00","date_gmt":"2022-10-18T18:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=123901"},"modified":"2023-09-11T16:14:36","modified_gmt":"2023-09-11T23:14:36","slug":"defenders-beware-a-case-for-post-ransomware-investigations","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/10\/18\/defenders-beware-a-case-for-post-ransomware-investigations\/","title":{"rendered":"Defenders beware: A case for post-ransomware investigations"},"content":{"rendered":"\n

Ransomware is one of the most pervasive threats that Microsoft Detection and Response Team (DART) responds to today. The groups behind these attacks continue to add sophistication to their tactics, techniques, and procedures (TTPs) as most network security postures increase.<\/p>\n\n\n\n

In this blog, we detail a recent ransomware incident in which the attacker used a collection of commodity tools and techniques, such as using living-off-the-land binaries, to launch their malicious code. Cobalt Strike was used for persistence on the network with NT AUTHORITY\/SYSTEM (local SYSTEM) privileges to maintain access to the network after password resets of compromised accounts.<\/p>\n\n\n\n

This incident highlights an attacker\u2019s ability to have a longstanding dwell time on a network before deploying ransomware. We will also discuss the various techniques used as well as the recommended detections and defense techniques that customers can use to increase protection against these types of attacks.<\/p>\n\n\n\n

Microsoft recommends hunting proactively for pre-ransomware behaviors and hardening your network to prevent impact. Refer to https:\/\/aka.ms\/ransomware-as-a-service<\/a> for more information about defending against ransomware-related incidents.<\/p>\n\n\n\n

What we found<\/h2>\n\n\n\n
\"Timeline
Figure 1. Overall timeline of activities of the ransomware incident<\/figcaption><\/figure>\n\n\n\n

Initial access<\/h3>\n\n\n\n

DART was unable to determine the initial entry vector of this attack due to the age of this compromise and limited retention of security solutions, along with encrypted devices being reimaged before analysis. The earliest observed activity showed the actor with domain administrator credentials.<\/p>\n\n\n\n

Persistence<\/h3>\n\n\n\n

In DART\u2019s post ransomware investigation of this engagement, the team found multiple instances of scheduled tasks and services being created by the attack for persistence after they had gained access to highly privileged credentials. Services and Scheduled Tasks have the option to run as NT AUTHORITY\\System, allowing their malicious code to run with highly privileged access. Because the actor created those tasks and services on a domain controller, the Local SYSTEM access allowed them to easily access domain administrator accounts. The deployment of a backdoor to a domain controller can help an actor bypass common incident response recovery activity, such as resetting compromised accounts, in the hope of staying resident on the network.<\/p>\n\n\n\n

Service: Cobalt Strike<\/strong><\/p>\n\n\n\n

Cobalt Strike was seen on a large scale across the network, on domain controllers, servers, and administrator workstations. The actor created Windows services to persist their payload executing rundll32<\/em> to load the Cobalt Strike DLL through invoking the \u201cAllocConsole\u201d<\/em> exported function of a variation of the Termite family of malware. These services were observed to execute with a combination of SYSTEM and domain administrator credentials. Termite malware is often used by crimeware groups to load Cobalt Strike while bypassing antivirus detections. Further information on the Termite malware family can be found in this blog: (Ex)Change of Pace: UNC2596 Observed Leveraging Vulnerabilities to Deploy Cuba Ransomware<\/a>.<\/p>\n\n\n\n

\"Screenshot
Figure 2. Example of the actor executing Cobalt Strike through rundll32.exe<\/em> with system integrity<\/figcaption><\/figure>\n\n\n\n

The Cobalt Strike DLLs were in C:\\Windows\\Temp<\/em> and used a naming scheme based on the first and local octet of the command and control (C2). Once the actor installed Cobalt Strike on a domain controller, the malware was spread using a PowerShell script, which copied the DLL to C:\\Windows\\Temp<\/em> via SMB, and then executed it through remote service creation.<\/p>\n\n\n\n

\"Event
Figure 3. Example of the threat actor copying Cobalt Strike through SMB<\/figcaption><\/figure>\n\n\n\n

The actor elevated their permissions to \u201cNT AUTHORITY\\System\u201d<\/em> through service creation. This service creation was likely done through Cobalt Strike, using a pseudorandom service name, such as \u201c4aedb00\u201d.<\/p>\n\n\n\n

Scheduled task: OpenSSH<\/strong><\/p>\n\n\n\n

The actor installed OpenSSH on the client\u2019s network to maintain persistence on critical servers, including domain controllers and domain administrator workstations. The actor installed OpenSSH within C:\\Windows\\OpenSSH<\/em>, rather than the standard OpenSSH path in System32.<\/p>\n\n\n\n

The actor created a scheduled task for a persistent SSH connection to their C2 as \u201cNT AUTHORITY\\System\u201d<\/em>. The actor used TCP 443 for their SSH traffic rather than the standard TCP 22. In many organizations, TCP 22 outbound may be blocked, but as TCP 443 is needed for web traffic the port is often open. The actor also enabled port forwarding on TCP 7878 to allow the tunneling of malicious tools through the SSH connection.<\/p>\n\n\n\n

The actor was also observed renaming ssh.exe<\/em> to \u201cC:\\Windows\\OpenSSH\\svchost.exe\u201d<\/em> in a likely attempt to evade detection.<\/p>\n\n\n\n

\"Screenshot
Figure 4. Example of the process masquerading to hide SSH usage<\/figcaption><\/figure>\n\n\n\n

Four days after the actor deployed the ransomware, the actor returned to the compromised network through their existing OpenSSH persistence to install further persistence SSH services on additional domain controllers and domain administrator workstations.<\/p>\n\n\n\n

The actor used OpenSSH\u2019s sftp-server to transfer files between their C2 and the compromised host. The actor generated SSH keys on compromised hosts using ssh-keygen.exe<\/em>, a tool apart of the OpenSSH tool suite. This allowed the actor to SSH using the keys rather than credentials, after credentials had been reset.<\/p>\n\n\n\n

Lateral movement<\/h3>\n\n\n\n

Impacket (WMI)<\/strong><\/p>\n\n\n\n

Impacket\u2019s WMI modules were used throughout the early stages of the compromise for remote execution and discovery. Impacket<\/a> is an open-source collection of scripts for working with network protocols. This toolkit has recently been used by a large variety of crimeware groups for lateral movement and network discovery.<\/p>\n\n\n\n

The actor used Impacket to execute PowerShell scripts out of \u201cC:\\Perflogs\\\u201d<\/em>, which created .txt<\/em> files within the same directory. All commands executed through Impacket output the results of the command to \u201c\\\\127.0.0.1\\ADMIN$\\__1648051380.61\u201d<\/em>. The actor then deleted the PowerShell scripts and text files after execution.<\/p>\n\n\n\n

\"Screenshot
Figure 5. Sample Impacket query with results being output into a file within the ADMIN$ directory<\/figcaption><\/figure>\n\n\n\n

The actor also used Impacket to test if the destination server was able to ping the actor\u2019s C2 before deploying Cobalt Strike to the device.<\/p>\n\n\n\n

\"Screenshot
Figure 6. Actor testing the connectivity to their C2 through Impacket<\/figcaption><\/figure>\n\n\n\n

PsExec<\/strong><\/p>\n\n\n\n

The actor used PsExec.exe<\/em> to spread the ransomware on the victims\u2019 network. The actor first executed \u201copen.bat\u201d<\/em>, which executed \u201cnet share [C-Z]=[C-Z]:\\ \/grant:everyone,FULL\u201d<\/em>. This shared every drive on the host, granting access to everyone. \u201cA.exe\u201d<\/em>, \u201cAnet.exe\u201d<\/em>, and \u201cAus.exe\u201d<\/em> are all variants of the Cuba ransomware.<\/p>\n\n\n\n

\"Screenshot
Figure 7. Command lines the actor executed through PsExec<\/figcaption><\/figure>\n\n\n\n

Remote desktop protocol<\/strong><\/p>\n\n\n\n

While the attacker had access to lateral movement and remote code execution via Impacket and PsExec, the main method they used for lateral movement in this incident was Remote Desktop Protocol (RDP), which allowed them to use a GUI environment to change system settings and install malware. The actor used domain administrator accounts to RDP between devices.<\/p>\n\n\n\n

Credential access<\/h3>\n\n\n\n

WDigest<\/strong><\/p>\n\n\n\n

The actor abused WDigest to cache credentials early in the compromise. This enabled the actor to gain access to domain administrator credentials.<\/p>\n\n\n\n

WDigest is a Windows feature that when enabled, caches credentials in clear text. This is often abused by credential access tools, such as Mimikatz. To detect if WDigest has been enabled within your network, the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential<\/em> will be set to 1. This can be disabled by setting the value to 0.<\/p>\n\n\n\n

\"Screenshot
Figure 8. Example of the actor enabling WDigest<\/figcaption><\/figure>\n\n\n\n

NTDSUtil Dumping<\/strong><\/p>\n\n\n\n

The actor obtained the Active Directory database (NTDS.dit<\/em>) twice. On the first instance, the actor obtained the NTDS.dit<\/em> five months into the compromise. Four days after the deployment of ransomware, the actor obtained the NTDS.dit<\/em> a second time. The actor was able to create a copy of the NTDS.dit<\/em> through the usage of the native tool ntdsutil.exe<\/em>, copying the .dit<\/em> to \u201cC:\\Windows\\Temp\\data\\audit\\Active Directory\\ntds.dit\u201d<\/em>.<\/p>\n\n\n\n

\"Screenshot
Figure 9. Actor command to obtain ntds.dit<\/em><\/figcaption><\/figure>\n\n\n\n

Volume shadow copy access<\/strong><\/p>\n\n\n\n

The actor used a second method to obtain the Active Directory database, they used \u201cvssadmin\u201d<\/em> to create a volume shadow copy of a domain controller. This technique creates a static copy of system files that a user would not typically be able to access. Once the volume shadow copy was created, the actor copied the NTDS.dit<\/em>, SYSTEM hive and SECURITY hive to C:\\Windows\\<\/em>, where they could then remotely copy through the ADMIN$ share.<\/p>\n\n\n\n

\"Screenshot
Figure 10. Actor commands to create Volume Shadow Copy and copy the ntds.dit<\/em><\/figcaption><\/figure>\n\n\n\n

Exfiltration<\/h3>\n\n\n\n

Compression<\/strong><\/p>\n\n\n\n

The actor was observed using 7-Zip to compress files before exfiltration. 7z.exe<\/em> was executed out of C:\\Windows\\Temp<\/em>. The actor did not include a password for the archive and used the device hostname as the name of the archive (for example: DC01.7z<\/em>).<\/p>\n\n\n\n

PSCP<\/strong><\/p>\n\n\n\n

The actor used PuTTY Secure Copy (PSCP) to remotely exfiltrate network shares to an actor controlled C2. This version of PSCP had been renamed to \u201clsas.exe\u201d<\/em> in an attempt to masquerade itself as the legitimate \u201clsass.exe\u201d<\/em> service. PSCP was executed out of C:\\Windows\\Temp<\/em>. The actor targeted Staff and Financial related resources.<\/p>\n\n\n\n

\"Screenshot
Figure 11. Masqueraded PSCP to exfiltrate files<\/figcaption><\/figure>\n\n\n\n

Defense evasion<\/h3>\n\n\n\n

Disabling antivirus<\/strong><\/p>\n\n\n\n

The actor disabled Microsoft Defender Antivirus on multiple devices after files had been quarantined by the antivirus. The actor turned off Microsoft Defender Antivirus through the Windows Security GUI application while connected via RDP to the device.<\/p>\n\n\n\n

\"Screenshot
Figure 12. Microsoft Defender for Endpoint alert from the actor disabling real-time monitoring<\/figcaption><\/figure>\n\n\n\n

Kernel driver<\/strong><\/p>\n\n\n\n

The actor used an Avast anti-rootkit driver. Unit 42 recently released a blog<\/a> on how Cuba ransomware groups have used this driver to disable antivirus software before deploying the Cuba ransomware.<\/p>\n\n\n\n

The actor installed the driver using the \u201csc\u201d<\/em> command, enabling kernel-level permissions. The actor then started the service with \u201csc start aswSP-ArPot2\u201d<\/em>. This service was used by the actor to disable the victims\u2019 antivirus products through Kernel privileges. Antivirus products being disabled within the victim network ensured that their ransomware would spread without the malware being quarantined or prevented.<\/p>\n\n\n\n

\"Screenshot
Figure 13. Vulnerable driver being installed<\/figcaption><\/figure>\n\n\n\n

The actor also created benign binaries to trigger the driver vulnerability. These binaries would iterate through a list of common antivirus executable names, providing each one to the control code 0x9988C094<\/em> and subsequently tasking the driver to kill those processes.<\/p>\n\n\n\n

Discovery<\/h3>\n\n\n\n

The actor was observed executing generic system enumeration commands. While these commands are not malicious, when seen together, it can often indicate an unauthorized user is enumerating the system.<\/p>\n\n\n\n

The actor was seen executing the following commands:<\/p>\n\n\n\n