A new type of ransomware encrypts files and appends the extension ".SaveTheQueen", spreading through the SYSVOL network folder on Active Directory domain controllers.
Our clients recently encountered this malware. Below, we present our complete analysis, results, and conclusions.
Detection
One of our clients reached out to us after they encountered a new type of ransomware that appended the extension ".SaveTheQueen" to newly encrypted files in their environment.
During our investigation, specifically in the source infection tracing phase, we discovered that the spread and tracking of infected victims were conducted using the SYSVOL folder on the client's domain controller.
SYSVOL is a key folder for each domain controller, used to deliver Group Policy Objects (GPO) and login/logout scripts to domain computers. The content of this folder is replicated among domain controllers to synchronize this data across the organization's sites. Writing to SYSVOL requires high domain privileges; however, once compromised, this asset becomes a powerful tool for attackers who can use it to rapidly and effectively spread malware across the domain.
The Varonis audit chain quickly revealed the following:
- An infected user account was creating a file named “hourly” in SYSVOL
- Multiple log files were created in SYSVOL — each named after the domain device
- Various IP addresses were accessing the file “hourly”
We concluded that the log files were used to track the infection process on new devices, and that “hourly” is a scheduled task that executed the malware on new devices using a Powershell script – samples “v3” and “v4”.
It appears that the attacker obtained and leveraged domain administrator privileges to write files to SYSVOL. On the infected nodes, the attacker executed PowerShell code that created a scheduled task to open, decrypt, and launch the malware.
Malware Decryptor
We unsuccessfully tried several methods to decrypt the samples:
We were almost ready to give up when we decided to try the 'Magic' method of the excellent
utility developed by GCHQ. 'Magic' attempts to guess the file encryption by performing a brute-force password attack on different encryption types and measuring entropy.
Translator's Note See. and . This article and comments do not intend to discuss the details of the methods used by the authors, either in third-party or proprietary software.
'Magic' determined that a GZip packer with base64 encoding was used, allowing us to unpack the file and find the code for injection – the 'injector'.
Dropper: 'There's an outbreak in the area! Mass vaccinations. Foot-and-mouth disease.'
The dropper was an ordinary .NET file with no protection. After analyzing the source code using , we realized that its sole purpose was to inject shell code into the winlogon.exe process.
Shell Code or Simple Complexities
We used the Hexacorn authoring tool to 'compile' the shell code into an executable file for debugging and analysis. We then discovered that it worked on both 32-bit and 64-bit machines. Writing even simple shell code in native assembly can be challenging; writing full shell code that operates on both types of systems requires elite skills, so we began to marvel at the attacker's sophistication.
When we dissected the compiled shell code using
x64dbg dynamic .NET libraries , such as clr.dll and mscoreei.dll. This struck us as strange – typically, attackers try to make their shell code as small as possible by invoking native OS functions instead of loading them. Why would someone want to embed Windows functionality in shell code instead of making direct calls on demand? Why would anyone need to embed Windows functionality in shell code instead of making a direct request?
It turned out that the author of the malware did not write this complex shellcode at all – it utilized specific software designed to convert executable files and scripts into shellcode.
We found a tool , which we thought could compile similar shellcode. Here is its description from GitHub:
Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL (including .NET assemblies). This shellcode can be injected into any Windows process to execute in
of RAM.
To confirm our theory, we compiled our own code using Donut and compared it to the sample – and... yes, we discovered another component of the toolkit used. After that, we were able to extract and analyze the original .NET executable file.
Code protection
This file was obfuscated using :
ConfuserEx is an open-source .NET project for protecting other developers' code. Software of this class allows developers to protect their code from reverse engineering through methods such as: character replacement, control flow obfuscation, and hiding reference methods. Malware authors use obfuscators to avoid detection and to make reverse engineering more challenging.
Thanks to we unpacked the code:
The result – payload
The payload obtained from the transformations is a very simple ransomware. There is no presence assurance mechanism in the system, no connections to a command center – just the good old asymmetric encryption to make the victim's data unreadable.
The main function takes the following parameters:
- File extension to use after encryption (SaveTheQueen)
- Author's email to include in the ransom note file
- Public key used for encrypting files
The process looks as follows:
- The malware scans local and connected drives on the victim's device
- Looks for files to encrypt
- Attempts to terminate the process using the file it is about to encrypt
- Renames the file to 'Original_file_name.SaveTheQueenING', using the MoveFile function, and encrypts it
- After the file is encrypted with the author's public key, the malware renames it to "Original_File_Name.SaveTheQueen"
- The ransom note is created in the same folder as the file.
Based on the use of the native 'CreateDecryptor' function, one of the malware's functions appears to include a decryption mechanism that requires the private key as a parameter.
Ransomware DOES NOT encrypt files, stored in the directories:
C:windows
C:Program Files
C:Program Files (x86)
C:Users\AppData
C:inetpub
It also DOES NOT encrypt the following file types:EXE, DLL, MSI, ISO, SYS, CAB.
Summary and Conclusions
Although the ransomware itself did not contain any unusual features, the attacker creatively used Active Directory to spread the dropper, and the malware itself presented us with interesting, albeit not particularly complex, challenges during analysis.
We believe that the author of the malware:
- Wrote the ransomware with an embedded injection into the winlogon.exe process, as well as
functionality for encrypting and decrypting files. - Masked the malicious code using ConfuserEx, transformed the result with Donut, and further concealed the dropper using base64 Gzip.
- Gained elevated privileges in the victim's domain and used them to copy
the encrypted malware and scheduled tasks to the SYSVOL network folder on domain controllers. - Executed a PowerShell script on domain devices to spread the malware and log attack progress in SYSVOL.
If you have any questions about this variant of the ransomware, or any other investigations carried out by our forensic and incident response teams, or request , where we always answer questions during a Q&A session.
Source: habr.com
