REvil

Tetra was able to confirm that the “Tech Support” account, and all its administrative-level privileges, was compromised. This single user gave the threat actor full access to the network.

Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.

Once the code was in place, a task named “RanCommand” was performed, effectively starting the Sodinokibi encryption process across the network.

Windows versions 5.2 and later, under PowerShell: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}

Windows versions 5.1 and earlier: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Once the code was in place, a task named “RanCommand” was performed, effectively starting the Sodinokibi encryption process across the network.

Tetra was able to confirm that the “Tech Support” account, and all its administrative-level privileges, was compromised. This single user gave the threat actor full access to the network.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.

Prior to version 2.1, REvil ransomware persists on the machine if the arn configuration field is set to true. It writes its path to the registry key SOFTWARE for persistence.

Once the code was in place, a task named “RanCommand” was performed, effectively starting the Sodinokibi encryption process across the network.

It then performs a process hollowing on that executable to load the Delphi component.

REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host.

Tetra was able to confirm that the “Tech Support” account, and all its administrative-level privileges, was compromised. This single user gave the threat actor full access to the network.

Prior to version 2.1, REvil ransomware persists on the machine if the arn configuration field is set to true. It writes its path to the registry key SOFTWARE for persistence.

Another technique always is executed if the process is not elevated. It relies on calling ShellExecuteW to prompt the user to run the sample as an administrator. This is accomplished in an infinite loop until the user agrees to run the elevated process.

REvil ransomware incorporates techniques to make the task of static analysis more difficult for an analyst. Most of the strings used during execution are decrypted at runtime only when needed.

The behavior of the following samples was analyzed for this report: Sample SHA256 REvil packed ... REvil not packed ...

During its initialization phase, REvil starts by dynamically resolving the imports it needs to function correctly... each value is decoded and resolved to the correct API... additional APIs are resolved by their names with the help of the GetProcAddress API.

It then performs a process hollowing on that executable to load the Delphi component.

Finally, REvil ransomware marks its binary code for deletion during the next reboot and terminates execution.

Tetra was able to confirm that the “Tech Support” account, and all its administrative-level privileges, was compromised. This single user gave the threat actor full access to the network.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

One popular technique we're seeing at this time is the use of living-off-the-land binaries — or "LoLBins"... LoLBins are used by different actors combined with fileless malware and legitimate cloud services to improve chances of staying undetected within an organisation, usually during post-exploitation attack phases.

With everything in place, REvil creates a global mutual exclusion object (mutex) with a hard-coded name... This is used to ensure only a single instance of the ransomware sample is running.

For the check to succeed and REvil to exit, both a whitelisted system language and a whitelisted keyboard layout must be present. Otherwise, the ransomware continues its execution normally.

Popular malware like Sodinokibi and Gandcrab have used reflect DLL loaders in the past that allows attackers to load a dynamic library into process memory without using Windows API... the obfuscated Cobalt Strike beacon... gets deobfuscated with a static XOR key and loaded into memory using reflective loading techniques.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.

Then it will terminate all processes with names that match the elements of the prc JSON array...

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

-nolan Does not encrypt files on shared network storage.

For the check to succeed and REvil to exit, both a whitelisted system language and a whitelisted keyboard layout must be present. Otherwise, the ransomware continues its execution normally.

Next, REvil checks the configuration field dbg to see if it’s running in debug mode. If that is not the case, geolocation checks based on the system’s language and the keyboard layout are conducted so the ransomware does not attempt to encrypt files on whitelisted systems.

They confirmed the ransomware variant as Sodinokibi/REvil, and the root point of compromise to be from a cloud-based RMM (Remote Management and Monitoring) solution named “ConnectWise Control.”

In ScreenConnect, when extended logging is enabled, all screenshare sessions are recorded, so anytime someone (authorized or not) remotes into a computer using the software, user activity is captured.

REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers.

The first stage script only exists to fetch the second stage code, cycling through three different hardcoded web domains if necessary.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

Exfiltrates encrypted information on the infected host to remote controllers.

On top of client applications such as those provided by Mega, many ransomware families may use other software or built-in operating system utilities to exfiltrate data. We’ll use Mega as the example here... you can look for execution of any process that is not chrome.exe ... initiating a network connection to the domains mega.io or mega.co.nz .

Encrypts files on local and network storage.

First, it will try to stop and delete services if the names match one of the regular expressions in the svc JSON configuration list... | Then it will terminate all processes with names that match the elements of the prc JSON array, for instance: "prc":[ "w3wp", "thunderbird", "mydesktopqos", "powerpnt", "outlook" ... ]

Finally REvil will delete the volume shadow copies. The way this is accomplished depends on the Windows version: Windows versions 5.1 and earlier: cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures Windows versions 5.2 and later, under PowerShell: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}

He and his co-conspirators demanded ransom payments in cryptocurrency and used exchangers and mixing services to hide the money. | If targeted organizations refused to pay, the attackers “threatened to publicly disclose victims’ data.”