BitPaymer

3.3 Point d’eau ... L’infection, par point d’eau ou par courriel d’hameçonnage pointant vers une URL malveillante, consiste en l’apparition d’une fausse mise à jour de navigateur, qui conduirait à l’installation du code malveillant FakeUpdates, puis de la propagation de Dridex

Initial Access Trusted Relationship Subcontractors or ESN compromises

Actors typically distribute Dridex malware through phishing e-mail spam campaigns.

In July 2019, BitPaymer’s victims were compromised via phishing campaigns [4]. ... Initial Access Spearphishing Attachment

In July 2019, BitPaymer’s victims were compromised via phishing campaigns [4]. ... Initial Access Spearphishing link

Execution Command-Line Interface arp / nslookup / etc.

Bitpaymer adds a .cmd file to the registry key (“HKCU\Software\Classes\mscfile\shell\open\command”)... and that, in turn, executes the .cmd file that runs the ransomware binary.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Execution Service Execution Alternate Data Stream

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Persistence Modify Existing Service

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7... LockBit 2.0 can bypass UAC through creating the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration.

Privilege Escalation Exploitation for Privilege Escalation Apple Update 0-day

Persistence Modify Existing Service

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7... LockBit 2.0 can bypass UAC through creating the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration.

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

It’s also worth mentioning that both Dridex and FriedEx use the same malware packer.

It resolves all system API calls on the fly by searching for them by hash...

Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed

Defense evasion Deobfuscate/Decode Files or Information

Defense evasion Exploitation for Defense Evasion Windows Defender

The malware finds a clean system file, copies itself to the clean file’s ADS, and then executes itself as a service component of the clean file. This makes it appear that the clean file is the source of the ransomware behavior.

Persistence Hidden Files and Directories Alternate Data Stream

Anchor has used NTFS to hide files. APT32 used NTFS alternate data streams to hide their payloads. Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Use of Dridex banking trojan, Pentest tool Powershell Empire, credentials viewer tool Mimikatz and administration tool PsExec have been reported.

FriedEx focuses on higher profile targets and companies rather than regular end users and is usually delivered via an RDP brute force attack.

Discovery System Network Connections Discovery

The malware finds a clean system file, copies itself to the clean file’s ADS, and then executes itself as a service component of the clean file.

To perform the propagation, Threat Actors firstly sought to compromise network administrators accounts ... Discovery Account Discovery

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

It has also been observed to be delivered through weakly protected RDP accesses [1]. ... extensive use of RDP connections could help detect lateralization phase of a BitPaymer attack.

Use of Dridex banking trojan, Pentest tool Powershell Empire, credentials viewer tool Mimikatz and administration tool PsExec have been reported. After taking over the network’s administrators accounts, Threat Actors use them to deploy the ransomware

The response can be a simple acknowledgment or a longer set of instructions, a module or executable... In many cases the C2 server response only contains an updated version of the binary... If the victim is infected with the latest version of Emotet... the latest modules are downloaded.

When encrypting a victim's systems, Hades creates a ransom note named 'HOW-TO-DECRYPT-[extension].txt' resembling ransom notes dropped by REvil ransomware.

In addition to the encryption of accessible files, BitPaymer is able ... to wipe shadow copies of file systems. ... Impact Inhibit System Recovery

Impact Disk Content Wipe

In addition to the encryption of accessible files, BitPaymer is able to deactivate some AV products ... Defense evasion Disabling Security Tools Windows Defender