BlueSky Ransomware

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

It first emerged in late June 2022 and has been observed to spread via phishing emails, phishing websites, and trojanized downloads.

It first emerged in late June 2022 and has been observed to spread via phishing emails, phishing websites, and trojanized downloads.

It first emerged in late June 2022 and has been observed to spread via phishing emails, phishing websites, and trojanized downloads.

It first emerged in late June 2022 and has been observed to spread via phishing emails, phishing websites, and trojanized downloads.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

Before the execution of the encryption function, the ransomware writes data needed for the recovery of the locked files in the registry.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

Adjust the privilege of the process to SE_DEBUG via ntdll.RtlAdjustPrivilege

The modules required for the ransomware are dynamically loaded and addresses of interesting functions are stored in an array for later use.

Following the process termination, the ransomware empties the recycle bin by calling shell32.SHEmptyRecycleBinA .

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

Adjust the privilege of the process to SE_DEBUG via ntdll.RtlAdjustPrivilege

The ransomware decodes all the strings at runtime.

The ransomware creates a global mutex by calling kernel32.CreateMutexA API.

The malware checks if the process ID is of its own process or of explorer.exe. After the check, a handle to process is retrieved via kernel32.OpenProcess API. Only “non-critical” processes are terminated to prevent bug check (Blue Screen of Death).

Hides the main thread from debugger by calling ntdll.ZwSetInformationThread by passing ThreadHideFromDebugger (0x11) as ThreadInformationClass

Before the execution of the encryption function, the ransomware writes data needed for the recovery of the locked files in the registry.

The initial access occurred via a brute-force attack, where the threat actors mainly targeted the System Admin (“sa”) account. During the intrusion, we observed over 10,000 failed attempts before successful login.

Retrieves the following: MachineGUID from SOFTWARE\Microsoft\Cryptography DigitalProductID and InstallDate from SOFTWARE\Microsoft\Windows NT\CurrentVersion

After creating the ransom note, the ransomware enumerates the processes running on the compromised system.

The files are enumerated via kernel32.FindFirstFileExW and kernel32.FindNextFileW . If it is a directory, the thread function is recursively called to perform the file enumeration.

The main thread calls mpr.WNetOpenEnumW for enumerating network resources

The malware checks if the process ID is of its own process or of explorer.exe. After the check, a handle to process is retrieved via kernel32.OpenProcess API. Only “non-critical” processes are terminated to prevent bug check (Blue Screen of Death).

Hides the main thread from debugger by calling ntdll.ZwSetInformationThread by passing ThreadHideFromDebugger (0x11) as ThreadInformationClass

Around 15 minutes after initial access, the threat actors then moved laterally toward domain controllers and file shares using remote service creation.

The BlueSky ransomware binary named vmware.exe was dropped on the beachhead, which upon execution, resulted in network wide ransomware.

If the passed process handle is not critical, it is terminated via kernel32.TerminateProcess.