Huntress Details SafePay Ransomware Tactics and Detection Opportunities
Summary
Huntress analyzes two SafePay ransomware incidents, detailing RDP access with valid credentials, data archiving, network-share encryption, malware behavior, and detection opportunities.
Key points
- In both incidents, attackers used valid credentials to access systems via RDP; Huntress observed no new accounts or persistence.
- In one incident, the attacker used ShareFinder.ps1 to map shares, archived files with WinRAR, and later deployed ransomware across network shares.
- FileZilla was installed and run during one incident, but Huntress collected no network evidence confirming FTP exfiltration.
- The ransomware encrypts files and supports double extortion; its code shares substantial overlap with leaked LockBit Black source code.
- SafePay attempts to disable security and backup protections, including Windows Defender and Volume Shadow Copies.
- Huntress recommends detection opportunities including monitoring Defender setting changes, UAC bypass behavior, and suspicious WinRAR archiving.
Article Details
- Attack Vectors
- SafePay operators accessed customer endpoints using valid credentials over Remote Desktop Protocol (RDP).
- In Incident 1, the actor used ShareFinder.ps1 to identify accessible network shares, then archived files from user directories on multiple hosts with WinRAR.
- The actor deployed ransomware through network shares using regsvr32.exe to execute locker.dll. The article reports that encryption was also deployed via UNC paths in Incident 1.
- SafePay encrypts files and uses double extortion, threatening to leak stolen data if the ransom is not paid. WinRAR archiving was observed before possible FTP exfiltration, but network evidence of FTP exfiltration was not collected.
- Defensive Notes
- Monitor for unusual changes to Windows Defender settings, including GUI-based changes, and review Windows Defender events 5001 and 5007.
- Detect suspicious use of the CMSTPLUA COM interface for UAC bypass, especially when the elevated child process is an unsigned binary, scripting interpreter, or system binary used for proxy execution.
- Use Sigma detections for suspicious WinRAR archiving behavior, including recursive subfolder archiving and specified volume sizes.
- Monitor for network share discovery, remote archiving of user directories, and regsvr32.exe execution of DLLs from network paths.
- Alert on deletion of Volume Shadow Copies and disabling Windows recovery settings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 | SHA-256 hash identified for locker.dll in Incident 1. |
MITRE ATT&CK
T1048 · Exfiltration Over Alternative ProtocolThe article maps possible exfiltration over FTP, while noting that no network evidence of this activity was collected.T1059 · Command and Scripting InterpreterThe article maps command and scripting activity to PowerShell use for share discovery and file handling.T1059.001 · PowerShellShareFinder.ps1 was executed to identify accessible network shares.T1059.003 · Windows Command ShellThe article maps Windows command-shell use to launching the malicious DLL.T1070.004 · File DeletionThe article maps removal of a downloaded ZIP file and files after archiving to file deletion.T1135 · Network Share DiscoveryShareFinder.ps1 was used to discover network shares.T1202 · Indirect Command Executionregsvr32.exe was used to execute locker.dll.T1486 · Data Encrypted for ImpactSafePay encrypted files on victim systems.T1490 · Inhibit System RecoveryThe actor deleted Volume Shadow Copies and disabled Windows recovery in the boot configuration.T1548.002 · Bypass User Account ControlThe article describes UAC bypass using the CMSTPLUA elevated COM interface to execute a malicious DLL.T1560.001 · Archive via UtilityWinRAR was used to archive files before possible exfiltration.T1562.001 · Disable or Modify ToolsThe actor disabled or modified Windows Defender settings.
People
Alden SchmidtNamed in the article's acknowledgments for contributions to the investigation and write-up.Jamie LevyNamed in the article's acknowledgments for contributions to the investigation and write-up.John HammondNamed in the article's acknowledgments for contributions to the investigation and write-up.Jonathan JohnsonNamed in the article's acknowledgments for contributions to the investigation and write-up.Matt AndersonNamed in the article's acknowledgments for contributions to the investigation and write-up.
Threat Actors
Malware
Vendors
Products
Microsoft Windowsof the threat actor’s activity was an attempt to run ShareFinder.ps1, which was detected and blocked by Windows Defender. The threat actor had accessed the endpoint via the Remote Desktop Protocol (RDP), and as such,Windows Defenderthe threat actor’s activity was an attempt to run ShareFinder.ps1, which was detected and blocked by Windows Defender. The threat actor had accessed the endpoint via the Remote Desktop Protocol (RDP), and as such,
Tools
FileZillaA short time after that, FileZilla was installed using FileZilla_3.67.1_win64_sponsored-setup.exe, and filezilla.exe and fzsftp.exe both executed after that. They were quickly uninstalled as well.ShareFinder.ps1During incident 1, the first observed indication of the threat actor’s activity was an attempt to run ShareFinder.ps1, which was detected and blocked by Windows Defender. The threat actor had accessed the endpoint viaWinRARAbout 40 minutes later, the same user archived files from the host with WinRAR.exe. An example command line of the attacker archiving files can be seen as follows: