Huntress Details KawaLocker Ransomware Attack and Attempts to Disable Security Tools
Summary
Huntress traced a KawaLocker attack that began with RDP access using a compromised account. Attackers disabled security tools, attempted to enable RDP on other endpoints, and encrypted files; Huntress response prevented further access.
Key points
- The attackers accessed a victim endpoint via RDP on August 8 using a compromised account.
- They used kill.exe and HRSword, along with associated drivers, to identify and disable security tooling; related security services crashed.
- After scanning for devices and services, the attackers used PsExec to attempt to enable RDP and disable the firewall on additional endpoints.
- KawaLocker was run against the E:\ volume. Huntress used Windows Security Auditing events to identify encrypted files and recover the ransom note.
- After deployment, the attackers deleted Volume Shadow Copies, cleared Windows Security, System, and Application event logs, and removed the ransomware executable.
- Huntress analysts said their investigation and response prevented the attackers from accessing other endpoints, limiting further impact to the victim’s infrastructure.
Article Details
- Attack Vectors
- A threat actor accessed a victim endpoint over RDP using a compromised account.
- The actor used advanced_port_scanner.exe to enumerate devices and services, then used PsExec.exe to run a batch file on listed hosts.
- The actor enabled RDP on additional endpoints and disabled the Windows firewall.
- KawaLocker was manually deployed against the E:\ volume.
- Defensive Notes
- Huntress analysts' detections and response prevented the actor from accessing additional endpoints.
- Monitor for HRSword, attempts to disable security tools, installation or removal of sysdiag.sys and hrwfpdr.sys, and use of sc.exe to control those drivers.
- Monitor for Volume Shadow Copy deletion, Windows Security/System/Application event-log clearing, and ransomware self-deletion.
- Audit Security Event Log 4663 events to help identify files accessed during encryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
kawa4096@onionmail[.]org | Email address listed in the KawaLocker ransom note. | |
| SHA256 | 01a3dabb4684908082cb2ac710d5d42afae2d30f282f023d54d7e945ad3272f5 | SHA-256 hash of hrwfpdrv.sys, a driver included in HRSword. |
| SHA256 | 11b262c936ffa8eb83457efd3261578376d49d6e789c7c026f1fa0b91929e135 | SHA-256 hash of sysdiag.sys, identified as a driver installed as part of the threat actor's tooling. |
| SHA256 | db8f4e007187795e60f22ee08f5916d97b03479ae70ad95ad227c57e20241e9d | SHA-256 hash of kill.exe, identified as a tool used to kill processes. |
| SHA256 | e4fb852fed532802aa37988ef9425982d272bc5f8979c24b25b620846dac9a23 | SHA-256 hash of e.exe, identified as the KawaLocker ransomware executable. |
| SHA256 | ecca86e9b79d5a391a433d8d782bf54ada5a9ee04038dbaf211e0f087b5dad52 | SHA-256 hash of s.exe, identified as the HRSword executable. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe actor accessed the victim endpoint over Remote Desktop Protocol and enabled RDP on additional endpoints.T1021.002 · SMB/Windows Admin SharesThe actor used PsExec.exe to execute a batch file on hosts listed in 1.txt.T1046 · Network Service DiscoveryThe actor ran advanced_port_scanner.exe, apparently to enumerate devices and services in the infrastructure.T1070.001 · Clear Windows Event LogsThe actor cleared the Security, System, and Application Windows Event Logs using wevtutil.T1070.004 · File DeletionThe ransomware self-deleted e.exe from the user's Desktop after execution.T1083 · File and Directory DiscoveryThe actor used tasklist.exe and a find command to locate specific security tooling.T1486 · Data Encrypted for ImpactKawaLocker was deployed against the E:\ volume and encrypted files.T1490 · Inhibit System RecoveryAfter deploying the ransomware, the actor ran vssadmin.exe to delete all Volume Shadow Copies.T1562.001 · Disable or Modify ToolsThe actor deployed kill.exe and HRSword to disable security tooling and security services were observed crashing.T1562.004 · Disable or Modify System FirewallThe actor disabled the Windows firewall using a netsh command.
People
Malware
Vendors
HuntressHuntress analysts recently observed an incident where a newer ransomware variant, KawaLocker (also known as KAWA4096) ransomware, was deployed.Huorong Network TechnologyBoth sysdiag.sys and hrwfpdr.sys appear to be associated with China-based Huorong Network Technology, as both have certificates issued by Beijing Huorong Network Technology Co., Ltd., and both drivers contain file
Products
AkiraSome aspects of KawaLocker bear similarities to other variants, such as Qilin and Akira—for example, its data leak site has a similar design to the leak site of Akira, while its ransom note is nearly identical to thatHRSwordInitial access and HRSwordKawaLockerHuntress analysts recently observed an incident where a newer ransomware variant, KawaLocker (also known as KAWA4096) ransomware, was deployed.QilinSome aspects of KawaLocker bear similarities to other variants, such as Qilin and Akira—for example, its data leak site has a similar design to the leak site of Akira, while its ransom note is nearly identical to that
Tools
advanced_port_scanner.exeEarly in their logon session, the threat actor had run advanced_port_scanner.exe, likely as a means of enumeration of devices and services within the infrastructure.kill.exeThe threat actor deployed kill.exe and HRSword, which is designed to monitor various system components and can give them visibility across the system.PsExecPsExec.exe -h @1.txt -d -c "\\[REDACTED]\1.bat"sc.exeThe kernel drivers installed as part of the threat actor’s tooling, sysdiag.sys and hrwfpdr.sys, were installed and later removed using a batch file that employed the Service Control Manager, sc.exe.vssadminvssadmin.exe delete shadows /all /quietwevtutilcmd.exe /c wevtutil cl security | wevtutil cl system | wevtutil cl application