Huntress Details Multi-Endpoint Activity Before INC Ransomware Deployment
Summary
Huntress analysts traced a recurring pattern before INC ransomware deployment, including attempts to disable security tools and prepare data for collection. Hunting for the pattern helped identify other potentially affected endpoints and alert customers.
Key points
- Huntress observed INC ransomware deployed in a customer environment and identified a recurring pattern of earlier activity across multiple endpoints.
- The actor used the native SystemSettingsAdminFlows.exe utility to modify Windows Defender settings; Windows Defender Operational logs recorded the changes as event ID 5007.
- On an endpoint with CylancePROTECT, av.exe terminated its service. Windows Defender detected and quarantined the file, but it had already stopped the service.
- Other observed activity included access through compromised accounts and RDP, a rogue ScreenConnect installation, and use of rclone with an include list.
- On one endpoint, the actor installed 7-Zip and MEGAsync, launched 28 7zG.exe processes to archive data, then uninstalled both applications.
- Huntress used the recurring activity to identify other customers who might face the same attack and notify them before ransomware deployment; the article says this helped avert encryption activity.
- Huntress provided a Sigma rule for detecting direct use of SystemSettingsAdminFlows.exe to tamper with Windows Defender and recommended monitoring unapproved remote-access and file-sync tools.
Article Details
- Attack Vectors
- The initial means of access varied across endpoints; observed access included a valid, previously compromised account over Remote Desktop Protocol (RDP) and access through a rogue ScreenConnect installation.
- The actor used SystemSettingsAdminFlows.exe to disable Windows Defender and attempted to terminate CylancePROTECT using av.exe.
- On one endpoint, the actor used net.exe to change an existing account's password.
- The actor used rclone to copy selected files from drive E:, and used 7Zip to archive data before using MEGAsync.
- Defensive Notes
- Monitor direct use of SystemSettingsAdminFlows.exe to tamper with Windows Defender; the article notes Huntress provided a Sigma rule that filters out common legitimate parent processes.
- Monitor and limit unapproved RMM and remote-control/desktop tools, including ScreenConnect.
- Monitor unapproved file-sync or backup utilities, including MEGAsync.
- Huntress analysts used the observed activity pattern to identify potentially affected endpoints and notify customers before ransomware deployment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 36eb4290aa11a950e60d12ab18a8e139d25464355ce761f98891e1ea94f39445 | SHA-256 hash of av.exe, which was detected as Trojan:Script/Wacatac.H!ml and used to terminate the CylancePROTECT service. |
| SHA256 | fc39cca5d71b1a9ed3c71cca6f1b86cfe03466624ad78cdb57580dba90847851 | SHA-256 hash of kaz.exe, an executable observed in the attack; its functionality was not determined. |
MITRE ATT&CK
T1059.003 · Windows Command ShellThe article maps observed command-line activity to Windows Command Shell.T1078.002 · Domain AccountsA valid, previously compromised account was used to access an endpoint via RDP; the article maps domain accounts to this activity.T1078.003 · Local AccountsThe article's ATT&CK mapping lists local accounts among the account types used during the activity.T1105 · Ingress Tool TransferThe article's ATT&CK mapping lists ingress tool transfer, though it provides no specific transferred file or transfer mechanism.T1133 · External Remote ServicesThe article's ATT&CK mapping lists external remote services as an initial-access method.T1219 · Remote Access ToolsThe article's ATT&CK mapping identifies remote-access software, including a rogue ScreenConnect installation, in the activity.T1486 · Data Encrypted for ImpactINC ransomware was deployed in a customer environment, and the article maps the activity to data encryption for impact.T1537 · Transfer Data to Cloud AccountThe actor used MEGAsync after archiving data with 7Zip; the article maps this use to transfer to a cloud account.T1543.003 · Windows ServiceThe article's ATT&CK mapping lists Windows Service activity; av.exe terminated the CylancePROTECT service.T1560.001 · Archive via UtilityThe actor ran 7zG.exe processes to archive data before using MEGAsync; the article also maps rclone activity to this technique.T1562.001 · Disable or Modify ToolsSystemSettingsAdminFlows.exe was used to disable Windows Defender, and av.exe terminated the CylancePROTECT service.
People
Dray AghaCredited for assistance in developing the article.Faith StrattonCredited for assistance in developing the article.Greg LinaresCredited for assistance in developing the article.Harlan CarveyNamed author of the article.Jai MintonCredited for assistance in developing the article.Jamie LevyCredited for assistance in developing the article.
Malware
Vendors
Products
7ZipOn the compromised endpoint, the threat actor installed 7Zip and MEGASync, then ran a total of 28 7zG.exe processes to archive data.CylancePROTECTFor example, on one endpoint where CylancePROTECT was installed, the following command line was observed:MEGASyncHuntress also observed the use of MEGAsync.exe within one infrastructure.ScreenConnectFor example, one endpoint had already generated an alert for a rogue ScreenConnect installation, and a detailed investigation indicated that the infrastructure employed an entirely different RMM tool.Windows DefenderThe threat actor used SystemSettingsAdminFlows.exe, a native Windows utility, to essentially disable Windows Defender.