A BlackByte Ransomware intrusion case study

by Contributed | May 18, 2024 | Technology

This article is contributed. See the original author and article here.

Introduction 

As ransomware attacks grow in number and sophistication every year, threat actors can quickly impact business operations if organizations are not well prepared. In this blog, we detail an investigation into a ransomware event. During this intrusion the threat actor progressed through the full attack chain, from initial access through to impact, in less than five days, causing significant business disruption for the victim organization.  

During the investigation, the Microsoft Incident Response team (formerly known as DART) identified the threat actor employing a range of tools & techniques to achieve their objectives, including:  

• Exploitation of unpatched internet exposed Microsoft Exchange Servers 


• Web Shell deployment facilitating remote access 


• Use of living of the land tools for persistence and reconnaissance 


• Cobalt Strike beacons for command and control 


• Process Hollowing and the use of vulnerable drivers for defense evasion 


• Deployment of custom developed backdoors to facilitate persistence 


• Deployment of a custom developed data collection and exfiltration tool 

Forensic analysis

Initial Access 

In order to obtain initial access into the victim’s environment, the Threat Actor was observed exploiting known vulnerabilities (ProxyShell) on unpatched Microsoft Exchange Servers: 

• CVE-2021-34473  


• CVE-2021-34523 


• CVE-2021-31207 

The exploitation of these vulnerabilities allowed the Threat Actor to: 

• Attain SYSTEM level privileges on the compromised Exchange host  


• Enumerate LegacyDN of users by sending an Autodiscover requests, including SIDs of users 


• Construct a valid authentication token and use it against the Exchange Powershell backend 


• Impersonate domain admin users and creates a web shell by using the New-MailboxExportRequest cmdlet 


• Create web shells in order to obtain remote control on the affected servers

The Threat Actor was observed operating from the following IP to exploit ProxyShell and access the web shell: 

• 185.225.73[.]244 

Persistence 

Backdoor 

Microsoft IR identified the creation of Registry Run Keys, a common persistence mechanism employed by threat actors to maintain access to a compromised device, where a payload is executed each time a specific user logs in. 

api-msvc.dll, detected by Microsoft Defender Antivirus as Trojan:Win32/Kovter!MSR, was determined to be a backdoor capable of collecting system information such as installed antivirus products, device name and IP address. This information is then sent via HTTP POST request to a command and control (C2) channel: 

• hxxps://myvisit[.]alteksecurity[.]org/t 

Unfortunately, the organization was not using Microsoft Defender as the primary AV/EDR solution, preventing to take action against the malicious code.

An additional file name, api-system.png, was identified with similarities to api-msvc.dll.  This file behaved like a DLL, had the same default export function, and also leveraged Run Keys for persistence.  

Cobalt Strike Beacon 

The threat actor leveraged Cobalt Strike, a common commercial penetration testing tool, to achieve persistence.  The file sys.exe, detected by Microsoft Defender Antivirus as Trojan:Win64/CobaltStrike!MSR, was determined to be a Cobalt Strike beacon and was downloaded directly from the file sharing service temp.sh: 

• hxxps://temp[.]sh/szAyn/sys.exe 

This beacon was configured to communicate with the following command and control (C2) channel: 

• 109.206.243[.]59:443 

AnyDesk 

Microsoft IR frequently observes threat actors leveraging legitimate remote access during an intrusion, in an effort to blend in on a victim network. In this case, the threat actor utilized AnyDesk, a common remote administration tool to maintain persistence and move laterally within the network. AnyDesk was installed as a Service and was executed from the following paths: 

• C:systemtestanydeskAnyDesk.exe 


• C:Program Files (x86)AnyDeskAnyDesk.exe


• C:ScriptsAnyDesk.exe 

Successful connections were observed in AnyDesk Logs (ad_svc.trace) involving anonymizer service IP addresses linked to TOR and MULLVAD VPN. This is a common technique that actors employ to obscure their source IP ranges.  

Reconnaissance and Privilege Escalation 

Microsoft IR found the presence and execution of the network discovery tool NetScan being used by the threat actor to perform network enumeration, under the following executable names: 

• netscan.exe 


• netapp.exe 

In addition, execution of AdFind, an Active Directory reconnaissance tool, was observed in the environment.  

Credential Access 

Evidence of likely Mimikatz usage, a credential theft tool commonly used by threat actors, was also uncovered, through the presence of a related log file mimikatz.log. 

Microsoft IR assesses that Mimikatz was likely used to attain credentials for privileged accounts.  

Lateral Movement 

Using compromised domain admin credentials, the threat actor used Remote Desktop Protocol and Powershell Remoting to obtain access to other servers in the environment, including Domain Controllers. 

Data Staging and Data Exfiltration 

A suspicious file named “explorer.exe” was identified. The file was recognized by Microsoft Defender Antivirus as “Trojan:Win64/WinGoObfusc.LK!MT” and quarantined, but after disabling Windows Defender Antivirus service, the threat actor was able to execute the file using the following command: 

• explorer.exe P@$$w0rd 

Explorer.exe was reverse engineered by Microsoft IR and determined to be ExByte, a GoLang based tool developed and commonly used in BlackByte ransomware attacks for collection and exfiltration of files from victim networks. 

The binary is capable of enumerating files of interest across the network, and upon execution creates a log file containing a list of files and associated metadata.  

Multiple log files were uncovered during the investigation in the path:  

• C:ExchangeMSExchLog.log 

Analysis of the binary revealed a list of file extensions which are targeted for enumeration. 

Binary analysis showing file extensions enumerated by explorer.exe 

Forensic analysis identified a file named data.txt that was created and later deleted after ExByte execution. This file contained obfuscated credentials which ExByte leveraged to authenticate to the popular file sharing platform Mega NZ, via it’s API at: 

• hxxps://g.api.mega.co[.]nz 

Binary analysis showing explorer.exe functionality for connecting to file sharing service MEGA NZ 

Microsoft IR also determined that this tool was crafted specifically for the victim, as it contained a hardcoded device name belonging to the victim and an internal IP address. 

Execution Flow 

Upon execution ExByte decodes several strings and checks if the process is running with privileged access by reading .PHYSICALDRIVE0: 

• If this check fails, ShellExecuteW is invoked with IpOperation parameter RunAs which runs explorer.exe with elevated privilege. 

After this access check, explorer.exe attempts to read data.txt file in the current location: 

• If the text file doesn’t exist, it invokes a command for self-deletion and exits from memory: 

C:Windowssystem32cmd.exe /c ping 1.1.1.1 -n 10 > nul & Del explorer.exe /F /Q 

• If data.txt exists, explorer.exe reads the file, passes the buffer to Base64 decode function and then decrypts the data using the key provided in the command-line. The decrypted data is then parsed as JSON below and fed for login function: 

{ 

“a”:”us0”, 

“user”:”” 

} 

Finally, it then forms an URL for login to the API of file sharing service MEGA NZ: 

• hxxps://g.api.mega.co[.]nz/cs?id=1674017543 

Data Encryption and Destruction 

MICROSOFT IR found several devices where files had been encrypted and identified suspicious executables, detected by Microsoft Defender Antivirus as Trojan:Win64/BlackByte!MSR, with the following names: 

• wEFT.exe 


• schillerized.exe 

The files were analyzed and determined to be BlackByte 2.0 binaries responsible for encryption across the environment. This binary requires an 8-digit key number to encrypt files. 

Two modes of execution were identified: 

• When the -s parameter is provided, the ransomware self-deletes and encrypts the machine it was executed on 


• When the -a parameter is provided, the ransomware conducts enumeration and uses an UPX packed version of PsExec to deploy across the network. 

• Several domain admin credentials were hardcoded in the binary, facilitating the deployment of the binary across the network. 

Depending on the switch (-s or -a), execution may create below files: 

• C:SystemDataM8yl89s7.exe (Random Name – UPX Packed PsExec) 


• C:SystemDatawEFT.exe (Additional BlackByte binary) 


• C:SystemDataMsExchangeLog1.log (Log file)


• C:SystemDatarENEgOtiAtES


• A Vulnerable (CVE-2019-16098) driver RtCore64.sys, used to evade detection by installed AV/EDR software


• C:SystemDataiHu6c4.ico (Random Name – BlackBytes icon)


• C:SystemDataBB_Readme_file.txt (BlackByte ReadMe File)


• C:SystemDataskip_bypass.txt (Unknown) 

Some capabilities identified for the BlackByte 2.0 ransomware were: 

AV/EDR Bypass: 

• The file rENEgOtiAtES created matches RTCore64.sys, a vulnerable driver (CVE-2049-16098) that allows any authenticated user to read/write to arbitrary memory. 


• The BlackByte binary then creates and starts a service named RABAsSaa calling rENEgOtiAtES, and exploits this service to evade detection by installed AV/EDR software. 

Process Hollowing 

• Invokes svchost.exe, injects to it to complete device encryption, and self-deletes by executing the following command: 

• cmd.exe /c ping 1.1.1.1 -n 10 > Nul & Del “PATH_TO_BLACKBYTE” /F /Q 

Modification / Disabling of Windows Firewall 

• The following commands are executed to either modify existing Windows Firewall rules, or to disable Windows Firewall entirely: 

• cmd /c netsh advfirewall set allprofiles state off 


• cmd /c netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=Yes 


• cmd /c netsh advfirewall firewall set rule group=”Network Discovery” new enable=Yes 

Modification of Volume Shadow Copies 

• The following commands are executed to destroy volume shadow copies on the machine: 

• cmd /c vssadmin Resize ShadowStorge /For=B: /On=B: /MaxSuze=401MB 


• cmd /c vssadmin Resize ShadowStorage /For=B: /On=B: /MaxSize=UNBOUNDED 

Modification of Registry Keys/Values 

• The following commands are executed to modify the registry, facilitating elecated execution on the device: 

• cmd /c reg add HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f 

• cmd /c reg add HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem /v EnableLinkedConnections /t REG_DWORD /d 1 /f 


• cmd /c reg add HKLMSYSTEMCurrentControlSetControlFileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f 

Additional Functionality 

• Ability to terminate running services and processes. 


• Ability to enumerate and mount volumes and network shares for encryption. 

• Perform anti-forensics technique time-stomping (sets the file time of encrypted and ReadMe file to 2000-01-01 00:00:00) 


• Ability to perform anti-debugging techniques.

Recommendations

To guard against BlackByte ransomware attacks, Microsoft IR recommends the following:  

• Ensure that you have a patch management process in place and that patching for internet exposed devices is prioritized.  

• Implement an EDR solution like Microsoft Defender for Endpoint to gain visibility of malicious activity in real time across your network 


• Ensure antivirus signatures are updated regularly and that your AV solution is configured to block threats 


• Block inbound traffic from Ips specified in the Indicators of Compromise table 


• Block inbound traffic from TOR Exit Nodes 


• Block inbound access from unauthorized public VPN services 

• Enable tamper protection to prevent components of Microsoft Defender Antivirus from being disabled 


• Understand and assess your cyber exposure with advanced vulnerability and configuration assessment tools 

Indicators of compromise (IOC)

The table below shows IOCs observed during our investigation. We encourage our customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems. 

NOTE: These indicators should not be considered exhaustive for this observed activity. 

Detections

Microsoft 365 Defender 

Microsoft Defender Antivirus 

• Trojan:Win32/Kovter!MSR 


• Trojan:Win64/WinGoObfusc.LK!MT


• Trojan:Win64/BlackByte!MSR


• HackTool:Win32/AdFind!MSR


• Trojan:Win64/CobaltStrike!MSR

Microsoft Defender for Endpoint 

Microsoft Defender for Endpoint customers should watch for these alerts that can detect behavior observed in this campaign. Note however that these alerts are not indicative of threats unique to the campaign or actor groups described in this report.

• ‘CVE-2021-31207’ exploit malware was detected 


• An active ‘NetShDisableFireWall’ malware in a command line was prevented from executing. 


• Suspicious registry modification. 


• ‘Rtcore64’ hacktool was detected 


• Possible ongoing hands-on-keyboard activity (Cobalt Strike) 


• A file or network connection related to a ransomware-linked emerging threat activity group detected 


• Suspicious sequence of exploration activities 


• A process was injected with potentially malicious code 


• Suspicious behavior by cmd.exe was observed 


• ‘Blackbyte’ ransomware was detected 

Microsoft Defender Vulnerability Management 

Microsoft Defender Vulnerability Management surfaces impacted devices that may be affected by the Exchange (ProxyShell) and drivers vulnerabilities used in the attack: 

• CVE-2021-34473 


• CVE-2021-34523 


• CVE-2021-31207 


• CVE-2019-16098 

Advanced hunting queries

Microsoft 365 Defender and Microsoft Sentinel

ProxyShell Web Shell Creation Events 

DeviceProcessEvents 

| where ProcessCommandLine has_any (“ExcludeDumpster”,”New-ExchangeCertificate”) and ProcessCommandLine has_any ((“-RequestFile”,”-FilePath”) 

Suspicious Vssadmin Events 

DeviceProcessEvents 

| where ProcessCommandLine has_any (“vssadmin”,”vssadmin.exe”) and ProcessCommandLine has “Resize ShadowStorage” and ProcessCommandLine has_any (“MaxSize=401MB”,” MaxSize=UNBOUNDED”) 

Conclusions

BlackByte Ransomware attacks are still targeting organizations having infrastructure with old unpatched vulnerabilities, allowing them to accomplish their objectives with a minimum effort.  According to Shodan, at the time this blog was written, there are nearly 3300 public facing servers still affected to ProxyShell vulnerabilities, making this an easy target for threat actors looking to impact organizations around the world. 

As Microsoft shows in the Microsoft Digital Defense Report, key practices like “Keep up to date” in conjunction to other good practices mentioned from a basic security hygiene strategy, could protect against 98 percent of attacks. 

As new tools are being developed by threat actors, a modern threat protection solution M365 Defender is necessary to prevent and detect the multiple techniques used in the attack chain, especially where the threat actor attempts to evade or disable specific defense mechanisms.  

Hunting for malicious behavior should be performed regularly in order to detect potential attacks that could evade detections, as a complementary activity for continuous monitoring from security tools alerts and incidents. 

To understand how Microsoft can help you secure your network and respond to network compromise, visit https://aka.ms/MicrosoftIR. 

Appendix

Encryption 

Different file extensions are targeted by BlackByte binary for Encryption: 

File extensions targeted by BlackByte binary for encryption 

Also, the following Shared Folders are targeted to encrypt: 

Example: IP_AddressDownloads 

Extensions ignored: 

Folders ignored: 

Files ignored: 

Process terminated by BlackByte binary 

Services terminated by BlackByte binary  

EDR/AV drivers Blackbyte can bypass