REvil

One idea they are thinking about is to auto-email stock exchanges, such as NASDAQ, to let them know about the company's attack and hurt the value of their stock.

In other cases involving the spread of Sodinokibi, registered in Italy on 7th June 2019, were utilized malvertising attack

German police also added Anatoly Sergeevitsch Kravchuk, a 43-year-old Russian, to the wanted list, accusing him of developing REvil during the same period.

Since then, the ransomware has been deployed in a number of ways, including via malicious spam campaigns, exploit kits, and RDP brute-forcing.

The U.S. and German government’s action today addresses the abuse of virtual currency to launder ransom payments.

게시글은 인간은 이해할 수 없는 문장이 작성되어 있지만 검색 엔진은 이 내용을 잘못 판단하여 검색 결과 상위에 노출시킨다(SEO-Poisoning 기법).

The RaaS cybercriminal business model involves a developer, who creates the ransomware malware and sets up the infrastructure, and affiliates recruited to breach and encrypt victims.

This delivery technique can also be classified in External Remote Services (ATT&CK T1133).

Attackers compromised WordPress sites and injected JavaScript over the content of the original site to spread Sodinokibi.

Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server.

Sodinokibi ransomware was distributed through a compromised version of WinRAR downloaded from the WinRAR Italia website.

“The adversary accessed the target environment via another MSP” and abused “the trust relationships between MSPs and their customers.”

Affiliates have used spam campaigns to distributed Sodinokibi ransomware... “Booking.com” campaign... it may induce the victims to open the attachment.

The content repeatedly describes threat actors sending spearphishing or phishing emails with malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM files, and executables disguised as documents.

Malicious spam emails with spear-phishing links or attachments

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

Deployment of Group Policy Objects to create scheduled tasks to download and execute the SODINOKIBI ransomware

APPENDIX MITRE’s ATT&CK Techniques Observed ... T1059 Command-Line Interface.

“The batch file contained a Base64-encoded PowerShell script that was subsequently executed.” The script used WebClient DownloadString and Invoke-Expression (IEX).

“cmd.exe and powershell.exe are both descendants of the ScreenConnect.WindowsClient.exe process,” and ScreenConnect copied a batch file to endpoints.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

유포 페이지에서 다운로드 받은 JS 파일 실행 시 감염 프로세스가 시작된다. JS 파일은 C2로부터 추가 스크립트를 다운로드하여 실행하는 역할을 한다.

According to security researcher Kevin Beaumont, the ransomware is delivered via an automated software update in Kaseya.

REvil can use Native API for execution and to retrieve active services.

sample.exe 除了具有檔案數位簽章之外,同時也是個 Dropper。在其檔案資源區塊中,具有兩個資源檔 MODLIS.RG 與 SOFTIS.RG。檔案執行之後,會分別在 C:\Windows\ 路徑下建立 mpsvc.dll 與 MsMpEng.exe

The REvil group has likely used a zero-day exploit against Kaseya’s management server, allowing the attackers to deploy the malware remotely on Windows devices running the VSA agent application.

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

REvil has been executed via malicious MS Word e-mail attachments.

Known Services Killed by Ransomware

MsMpEng.exe : This is an outdated version of Microsoft’s Antimalware Service that is vulnerable to a technique known as DLL Hijacking. mpsvc.dll : This is the packed REvil payload, which is loaded by MsMpEng.exe through the DLL Hijacking technique.

Deployment of Group Policy Objects to create scheduled tasks to download and execute the SODINOKIBI ransomware

The RaaS cybercriminal business model involves a developer, who creates the ransomware malware and sets up the infrastructure, and affiliates recruited to breach and encrypt victims.

如果使用 -smode 模式,會將當前帳號和密碼更改為 DTrump4ever ,並設定登入後自動執行。

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

This delivery technique can also be classified in External Remote Services (ATT&CK T1133).

and are observed adding user accounts, presumably in an attempt to maintain persistence on victim machines and also in a further attempt to keep a low profile on victim networks.

Installation of web shells on internet-facing victim web servers

Change the default boot configuration to safe mode with networking, by running this command: bcdedit /set {current} safeboot network... When the ransomware has finished encrypting, it runs the following command... bcdedit /deletevalue {current} safeboot

another sample configures the device to launch REvil Safe Mode with a default password of 'DTrump4ever.' [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "AutoAdminLogon"="1"

Deployment of Group Policy Objects to create scheduled tasks to download and execute the SODINOKIBI ransomware

“PowerShell... was leveraged in an attempt to inject shellcode into itself” and Elastic prevented several process-injection attempts.

At this point, the code spawns the ImagingDevices.exe process and injects itself into it via process hollowing.

If " exp " field is "true" then a 32 or 64 bit shellcode is executed with the exploit CVE-2018-8453 through the elevation of privilege.

The RaaS cybercriminal business model involves a developer, who creates the ransomware malware and sets up the infrastructure, and affiliates recruited to breach and encrypt victims.

如果使用 -smode 模式,會將當前帳號和密碼更改為 DTrump4ever ,並設定登入後自動執行。

Attempting to escalate its privilege via CVE-2018-8453, or token impersonation

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

REvil can launch an instance of itself with administrative rights using runas.

Deployment of Group Policy Objects to create scheduled tasks to download and execute the SODINOKIBI ransomware

Change the default boot configuration to safe mode with networking, by running this command: bcdedit /set {current} safeboot network... When the ransomware has finished encrypting, it runs the following command... bcdedit /deletevalue {current} safeboot

another sample configures the device to launch REvil Safe Mode with a default password of 'DTrump4ever.' [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "AutoAdminLogon"="1"

BlackMatter also attempts to elevate its privileges when it is limited by User Account Control (UAC). It does so via an elevated COM interface

There is a second option: To escalate using DelegateExecute... when an attempt is made to execute ComputerDefaults, we get a shell with scaled privileges. | It then makes use of CompMgmtLauncher and explorer.exe. The aim is to create a new instance of explorer.exe, which will launch CompMgmtLauncher. | Once the bas64 is deobfuscated, a dll is obtained, which is responsible for bypassing the UAC seen in the dynamic section in the previous point.

VBA (Visual Basic for Applications) codes were split into modules and functions for the purpose of obfuscation.

The behavior of the following samples was analyzed for this report: Sample SHA256 REvil packed ... REvil not packed ...

This algorithm is often used for hashing function names... I just replaced the hashing algorithm to CRC32 ... static LPVOID getAPIAddr(HMODULE h, unsigned int myHash) ... if (crc32(pFuncName, strlen(pFuncName)) == myHash)

REvil can save encryption parameters and system information in the Registry.

REvil has used encrypted strings and configuration files.

Its artifacts usually mimic the names of known executables for Defense Evasion, such as a Microsoft Word update file name (MicrosoftOfficeWord_upd.v.88735.34.5.exe).

REvil can mimic the names of known executables.

“PowerShell... was leveraged in an attempt to inject shellcode into itself” and Elastic prevented several process-injection attempts.

At this point, the code spawns the ImagingDevices.exe process and injects itself into it via process hollowing.

REvil has used PowerShell to delete volume shadow copies and download files.

The RaaS cybercriminal business model involves a developer, who creates the ransomware malware and sets up the infrastructure, and affiliates recruited to breach and encrypt victims.

Attempting to escalate its privilege via CVE-2018-8453, or token impersonation

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

REvil can launch an instance of itself with administrative rights using runas.

REvil can decode encrypted strings to enable execution of commands and payloads.

It will then decode the agent.crt file using the legitimate Windows certutil.exe command to extract an agent.exe file to the same folder, which is then launched to begin the encryption process.

The MsMPEng.exe is an older version of the legitimate Microsoft Defender executable used as a LOLBin to launch the DLL and encrypt the device through a trusted executable.

Here is a list of all the MITRE ATT&CK TTP’s that we have found that are relevant to this incident or REvil ransomware: ... T1218.003 ...

... copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking\agent.crt c:\kworking\agent.exe ...

REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.

By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.

Để kiểm tra môi trường thực thi xem có phải 64-bit hay không, mã độc thường gọi hàm API IsWow64Process. Nếu kết quả trả về là TRUE, mã độc sẽ biết được tiến trình 32-bit của nó đang thực thi trên Windows 64 bit.

The executed script included “Start-Sleep -s 1000000.”

MsMpEng.exe : This is an outdated version of Microsoft’s Antimalware Service that is vulnerable to a technique known as DLL Hijacking. mpsvc.dll : This is the packed REvil payload, which is loaded by MsMpEng.exe through the DLL Hijacking technique.

Loading in PowerShell memory via reflective loading instead of executing a binary

Attempting to escalate its privilege via CVE-2018-8453, or token impersonation and creating a mutex

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Deployment of Group Policy Objects to create scheduled tasks to download and execute the SODINOKIBI ransomware

該惡意程式具有檔案數位簽章,可藉此躲避防毒軟體的偵測。...據信,該簽章憑證為駭客攻擊前所竊取而來。所對應 MITRE 的攻擊手法編號為 T1553.002。

Once on the system, the ransomware actors stop administrator access to the VSA platform and proceed to drop malicious files on the client system. Microsoft Defender is disabled or modified to prevent real-time monitoring.

...including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.

The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine... focusing on command-line executions involving the 'netsh' command to enable network discovery.

Safe boot then forces the system to reboot into safe mode before encryption.

Cybercriminals employ the features of Mimikatz for credential dumping to extract usernames, passwords, and other credentials that might be used to escalate privilege in other phases of the attack.

ProcDump to obtain process memory of the Windows Local Security and Authorisation Sub-system (LSASS)

The REvil payload is associated with some of the following attack vectors: ... Windows Remote Desktop (RDP) brute force entry

Password spraying, exploiting unpatched systems, and initial access malware families – such as IcedID or Qakbot – and now supply-chain attacks, are all methods of distributing REvil.

Passwords for privileged local administrator or domain accounts stored as cpassword objects within legacy group policy preferences • Credentials stored within domain shares... • Credentials stored in user profiles, such as text files or Excel spreadsheets

REvil can enumerate active services.

REvil can query the Registry to get random file extensions to append to encrypted files.

Additional legitimate tools, namely AdFind, SharpSploit, BloodHound, and NBTScan, are also observed to be employed for network discovery.

AdFind can be used to discover computers, users, or groups with AD as a reconnaissance tool...

待加密勒索核心解析組態設定檔後,會搜集並儲存該受害主機的基本資訊,包含帳號、主機名稱、網域名稱、Windows 版本名稱等。

Additional legitimate tools, namely AdFind, SharpSploit, BloodHound, and NBTScan, are also observed to be employed for network discovery.

cybercriminals have weaponized this function for ransomware campaigns to discover and terminate arbitrary processes and services, including those that are antimalware-related.

REvil can identify the domain membership of a compromised host.

“The PowerShell script that was executed checked the processor architecture before utilizing the .NET WebClient class to download content.”

REvil has the ability to identify specific files and directories that are not to be encrypted.

Files on local disk and network folder are numbered (if the “ net ” parameter of JSON configuration is a “ true ” value) then proceed with file encryption.

AdFind can query AD for computers, identify domain users and domain groups, extract subnet information from AD, and collect information about organizational units on domain trusts.

By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.

Để kiểm tra môi trường thực thi xem có phải 64-bit hay không, mã độc thường gọi hàm API IsWow64Process. Nếu kết quả trả về là TRUE, mã độc sẽ biết được tiến trình 32-bit của nó đang thực thi trên Windows 64 bit.

The executed script included “Start-Sleep -s 1000000.”

REvil ランサムウェアがどのような仕組みで感染すべきでない言語を判定しているのかを詳細解説しています。

Attempting to escalate its privilege via CVE-2018-8453, or token impersonation and creating a mutex

REvil can identify system drive information on a compromised host.

It appears that the attackers used a zero-day vulnerability to remotely access internet facing VSA Servers.

In June 2019, an REvil affiliate targeted MSPs via Remote Desktop and then used their management software to push ransomware installers to all of the endpoints that they manage.

PsExec can also be used for propagation and remote execution of ransomware.

According to security researcher Kevin Beaumont, the ransomware is delivered via an automated software update in Kaseya.

It has also been observed that this ransomware exploits a vulnerability in Oracle Weblogic servers.

Then the threat actor used that information and reached out directly to executives over email and threatened to release the data of the alleged 'misconduct by the management' publicly

Operators can use RDP and PsExec for lateral movement and for dropping and executing other components and the ransomware itself.

the Sodinokibi crew told BleepingComputer that they encrypted the entire Travelex network and copied more than 5GB of personal data

In ScreenConnect, when extended logging is enabled, all screenshare sessions are recorded, so anytime someone (authorized or not) remotes into a computer using the software, user activity is captured.

attackers are also scanning the networks of some victims for credit card or point of sale (PoS) software

However, in case this option is set to “true,” the malware sends a POST request to available addresses with information about the infected machine, such as the encryption key and the machine name.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

The combination of an anonymous browser Tor and Monero can quite successfully make a person’s financial activity completely invisible to the police and government agencies.

The notes included a web address leading to an open-source privacy network known as Tor, as well as the link to a publicly accessible website address the victims could visit to recover their files.

The notes included a web address leading to an open-source privacy network known as Tor, as well as the link to a publicly accessible website address the victims could visit to recover their files. Upon visiting either website, victims were given a ransom demand and provided a virtual currency address to use to pay the ransom.

The actor used ScreenConnect “to connect and copy a batch file to the target endpoint,” while the PowerShell script used “the .NET WebClient class to download content from Pastebin.”

“The powershell.exe process was created as a descendant of ScreenConnect.WindowsClient.exe” and the actor “leveraged ScreenConnect remote desktop software to connect and copy a batch file to the target endpoint.”

Sodinokibi makes a connection with each domain of this list generating a URL through a DGA algorithm

Sodinokibi makes a connection with each domain of this list generating a URL through a DGA algorithm

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

REvil has encrypted C2 communications with the ECIES algorithm.

If a victim did not pay the ransom, Polyanin typically posted the victims’ exfiltrated data or claimed he sold the exfiltrated data to third parties.

“gegevens stelen” en in het voorbeeld: “10GB data naar server in Finland.”

We also finished work on a blog in which data from compromised systems will be published. We urged all adverts to copy information as often as possible...

Sodinokibi operators may steal data in advance and then resort to extortion tactics that exceed the ability of the malware itself. | Those who refuse to pay up, relying on their ability to recover data, will then receive threats to have that data exposed on an auction site the group calls The Happy Blog.

As evidence, the Sodin hackers have posted documents on the Dark web purporting to be from the victims including company computer file directories, partial customer lists, customer quotes, copies of contracts, and even what appears to be several official IDs.

Installation of commercial cloud data synchronisation platform software to upload targeted data. Once installed, the commercial synchronisation software will upload targeted data to the cloud platform.

some ransom notes also inform victims that if they don't pay the ransom fee, the stolen data will be published online on so-called "leak sites"

REvil has the capability to destroy files and folders.

Sodinokibi encrypts files and adds a random extension such as “test.jpg.1cd8t9ahd5”.

也將 prc 區塊中的程序終止 | 若使用 -silent 模式,則會從組態設定檔中將 svc 區塊中的服務停止並刪除

It runs vssadmin.exe to delete all volume shadow copies on the system to prevent recovery ... and uses bcdedit.exe twice to disable automatic Windows recovery features.

it will also create a bitmap containing a note that the machine is also infected

After encrypting the files, REvil changes the user’s background: Image set by REvil as the user’s background

Triple extortion follows a straightforward formula: adding DDoS attacks to the aforementioned encryption and data exposure threats.

For example, -w parameter can be used to stop all running virtual machines with the help of the esxcli command-line utility

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...

“naast het slachtoffer worden ook diens klanten, partners of andere derde partijen afgeperst.”