Huntress Traces MSSQL Attack That Installed AnyDesk and Created a Local Account
Summary
Huntress traced an automated MSSQL attack that extracted and ran staged files, created a local account, and installed AnyDesk. Analysts isolated the endpoint before ransomware deployment.
Key points
- An analyst identified similar activity on a different endpoint on February 23, 2024, drawing on Huntress’s earlier MSSQL attack investigation.
- The attacker used MSSQL’s xp_cmdshell and bcp utility to extract an executable and batch files from a database table.
- EDR telemetry and Windows Event Logs showed a batch file creating a local account and adding it to local groups.
- Another batch file installed AnyDesk; Huntress observed successful installation in Windows Event Logs.
- An administrator accessed the endpoint through ScreenConnect, authenticated with Duo, and began remediation shortly after AnyDesk was installed.
- Huntress said prompt alerting and endpoint isolation prevented ransomware deployment; similar TTPs in separate AhnLab-investigated incidents had led to Mimic ransomware.
Article Details
- Attack Vectors
- MSSQL xp_cmdshell was used to execute commands on the endpoint.
- The bcp utility extracted pre-staged files from the MSSQL table uGnzBdZbsi into C:\users\public\music\.
- A batch file created the local admins124 account and added it to local groups.
- AD.exe silently installed AnyDesk, providing remote access.
- Defensive Notes
- Maintain an accurate, up-to-date inventory of systems, applications, and services for patching.
- Restrict access to or remove unnecessary applications and services to reduce the attack surface.
- Prompt alerting and endpoint isolation, along with monitoring-app notifications, prevented ransomware deployment in this incident.
MITRE ATT&CK
Malware
Products
AnyDeskFrom this point, Windows Event Logs demonstrated that AnyDesk had been successfully installed, as indicated by the messages in several event records.Duoadministrator accessed the endpoint via ScreenConnect version 23.9.10.8817, successfully authenticated via Duo, and began remediating the endpoint.MSSQLHomeBlogAttacking MSSQL Servers, Pt. IIScreenConnectAt 14:57:00 UTC (a bit more than three minutes later), an administrator accessed the endpoint via ScreenConnect version 23.9.10.8817, successfully authenticated via Duo, and began remediating the endpoint.