How Trend Micro handled detection and response to a Play ransomware attack

How Trend Micro handled detection and response to a ransomware attack Play | Trend Micro (FI)

Ransomware

Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.

By: Trent Bessell

August 22, 2024

Reading time: ( words)

Report Highlights

We show how a Play ransomware infection was quickly identified and contained thanks to a rapid and coordinated response from Trend Micro Managed Detection and Response (MDR).
The Play ransomware group used the following malicious tools: SYSTEMBC, a proxy malware that can deliver other payloads like ransomware, and GRIXBA, a custom tool designed to bypass signature-based detections.
In this particular attack, the ransomware group also used legitimate tools like PsExec and Remote Desktop Protocol (RDP). This is another example of a common cybercriminal technique called “living-off-the-land,” which allows malicious actors to conduct stealthy attacks to avoid detection by security services.

Introduction

Ransomware threats have been around for quite some time now and are one of the most pernicious forms of cybercrime. One such ransomware group that has gained notoriety is the Play ransomware group, which has become known for its aggressive tactics and significant impact on various organizations since June 2022.

Earlier this year, Trend Micro Managed Detection and Response (MDR) identified a highly sophisticated and well-coordinated intrusion attempt linked to the notorious Play ransomware group. Using the Trend Micro Vision One platform, the MDR team was able to quickly identify and respond to the threat. The swift and decisive actions effectively thwarted the attack, preventing any potential data loss or operational impact. This incident underscores the critical importance of implementing robust cybersecurity measures to defend against increasingly complex cyber threats.

Incident Overview

Trend Micro MDR was alerted to the security vulnerability via Vision One Workbench alerts following the detection via the Apex One Endpoint Protection Platform (EPP) agent of a command and control tool identified as SYSTEMBC. The tool, which was dropped in the “C:\Users\Public\Music\” directory of a Windows server, is a proxy malware that uses SOCKS5 and can deliver other payloads, such as ransomware. Despite the backdoor being quarantined by the EPP agent, the threat actor still gained access to the endpoint using valid login credentials. The source host was identified as originating from an IP address within the victim’s virtual private network (VPN) subnet.

Figure 1. SYSTEMBC Detection Event (Vision One)

The threat actor transferred a legitimate administration tool, PsExec, from their attacker machine over the VPN. PsExec, which is designed to execute programs and run commands on remote systems, was deployed in the same directory used to stage the previously detected SYSTEMBC binary.

PSEXEC Detection (Vision One) — Figure 2. PSEXEC detection (Vision One)

The malicious actor also modified the Remote Desktop Protocol (RDP) settings by editing the Windows Registry. This involved modifying a specific registry value, “fdenyTS Connections“, as highlighted in the Observed Attack Technique (OAT). This modification allowed RDP access to the host.

Figure 3. Editing the RDP registry (Vision One)

An additional tool, GT_NET.exewas introduced on the host and executed, which resulted in a series of network reconnaissance tasks to identify hosts reachable on the network. The resulting list of endpoints was placed in a file and archived in data.zip. This file was identified as GRIXBA after an analysis of the malware after its execution. GRIXBA is a custom tool that the Play ransomware group uses and provides. While the use of custom tools is not new, their use offers advantages for both an attacker and a defender:

Advantages for attackers
- Stealth and Evasion: Custom tools are often tailored for intrusion or provided with obfuscation wrappers to avoid signature-based detections. Rapid development can be performed to avoid newly developed defensive techniques.
- Modular functionality: Customs tools are often designed to be modular, deploying only the functionality needed based on the hacked environment.
- Benefits for Defenders
- Attribution: Custom tool detection can help defenders quickly attribute the threat actor. This allows defenders to better understand the unique tactics, techniques, and procedures employed and stay one step ahead of the adversary.
- Behavioral Analysis: Since signature-based detections are a weaker method of detecting custom tools, behavior-based detections, such as behavior monitoring (BM) or predictive machine learning (PML), help identify potential changes to the tooling by focusing on the intended purpose and methods employed by the tooling.

Following this, an attempt was made to dump the memory of the running LSASS process via Task Manager. However, this action was successfully blocked by the Behavior Monitoring (BM) module of the Apex One EPP agent. The BM module effectively detected the suspicious activity and intervened to prevent the breach of sensitive artifacts of the LSASS process.

LSASS Process Memory Dump (Vision One) — Figure 4. LSASS process memory dump (Vision One)

Timeline of events

Through diligent and continuous monitoring of the victim organization’s environment, Trend Micro’s MDR team was able to meticulously reconstruct the threat actor’s activity. This comprehensive monitoring allowed the team to implement rapid and effective response measures to contain the threat. Additionally, they were able to quickly notify the victim organization, ensuring immediate action could be taken. This rapid and coordinated response ultimately prevented the Play ransomware group from achieving other objectives, such as data collection, exfiltration, and encryption, which could have resulted in serious data breaches and significant operational disruptions for the victim organization.

Mitigation strategies

The FBI, CISA, and ASD ACSC recommend that organizations implement several key mitigations to limit the potential malicious use of common system and network discovery techniques. These measures are critical to reducing the risk of compromise by Play ransomware. Below is an overview of some of the recommended strategies:

Update and patch systems regularly: Make sure all systems and software are up to date with the latest patches and updates. This helps close vulnerabilities that attackers could exploit.
Implement network segmentation: Divide your network into segments to limit the spread of ransomware and other malicious activity. This can help limit the damage in the event of an intrusion.
Use multi-factor authentication (MFA): Apply multi-factor authentication to access critical systems and sensitive data. Multi-factor authentication adds an extra layer of security, making it harder for attackers to gain unauthorized access.
Monitor network traffic: Continuously monitor network traffic for unusual activity that may indicate an intrusion. Use advanced threat detection tools to identify and respond to potential threats in real time.
Back up your data regularly: Perform regular backups of critical data and store them in a secure offsite location. Make sure backups are not connected to the main network to prevent ransomware from encrypting them as well.
Deploy Endpoint Protection: Use robust endpoint protection solutions to detect and block malicious activity on individual devices. This includes using anti-malware and anti-ransomware tools.

Implementing these mitigations can help organizations significantly reduce the risk of being compromised by Play ransomware and other similar threats. For a complete guide and detailed recommendations, refer to the #STOPRANSOMWARE Play Ransomware guide.

Conclusion

The successful detection and containment of the Play ransomware intrusion underscores the vital importance of proactive security measures in today’s digital landscape. This incident underscores the need for organizations to be vigilant and adopt comprehensive strategies, including managed detection and response (MDR) services. By leveraging Trend Micro’s MDR service, organizations benefit from continuous monitoring and expert analysis 24/7/365. Additionally, multi-layered defenses, utilizing a range of security tools and practices referenced in the #STOPRANSOMWARE playbook, are essential to creating a robust barrier against sophisticated and evolving cyber threats.

For more information about the Play ransomware group, read Trend Micro’s Ransomware Spotlight article to learn some interesting facts about the group.

Indicators of Compromise (IoC)

Name/Detail	Indicator	Trend Micro Detection/OAT
SYSTEMBC	File name: Socks32.dll File path: C:\Users\Public\Music\ SHA1: 2b7e28442bc7ef5e7b37afde5423b29e897a59ca	Backdoor.Win32.COROXY.SMRTI
GRIXBA	File name: GT_NET.exe File path: C:\Users\Public\Music\list (2)\ SHA1: 3890272563cd044761a9a5c0ab049a2117b38884	Trojan.MSIL.GRIXBA.A
PsExec	File name: PsExec.exe File path: C:\Users\Public\Music\PsExec.exe SHA1: a0ee0761602470e24bcea5f403e8d1e8bfa29832	OAT: Suspicious file creation in unusual folder
Editing the registry	Process command: “C:\Windows\system32\reg.exe” add “\\\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server » /v fDenyTSConnections /t REG_DWORD /d 0 /f	OAT: Changing RDP settings via Reg.exe
Dumping LSASS process memory	Process file path: C:\Windows\System32\Taskmgr.exe Object file path: C:\Users\\AppData\Local\Temp\lsass.DMP	OAT: Dump LSASS process memory via Taskmgr

Keywords

sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk