Huntress Reconstructs a Week-Long Intrusion Linked to INC Ransomware
Summary
Huntress traced a week of activity indicative of an INC ransomware attack, from compromised-account RDP access and data staging to lateral movement and attempted encryption. The initial access method was undetermined.
Key points
- Huntress observed brief connections followed by RDP access using compromised credentials; early activity included domain enumeration.
- Over the next two days, the actor used 7-Zip to stage files and installed MEGASync, which Huntress said was presumably for exfiltration.
- On day seven, the actor used credential-access commands, then copied and launched the encryptor across endpoints using WMIC and PsExec.
- The actor also used tools including Advanced IP Scanner, PuTTY, and native Windows utilities during reconnaissance and lateral movement.
- Huntress saw no indication of encrypted files or ransom notes on Server 3 and observed attempts to troubleshoot the encryptor.
- Huntress lacked full infrastructure visibility; it could not determine the initial access method, and some systems were taken offline before logs could be collected.
Article Details
- Attack Vectors
- The initial access method was not determined. The investigation observed brief connections followed by RDP access using compromised valid credentials.
- The actor used 7-Zip to archive and stage data, then installed MEGASync, reportedly to facilitate exfiltration.
- The actor used credential-access commands consistent with lsassy.py, then copied the ransomware executable to multiple endpoints and launched it remotely using WMI and PsExec.
- Defensive Notes
- Investigate activity across multiple systems and over time; the observed activity began about a week before encryption.
- Monitor for unusual RDP logins, domain enumeration, bulk 7-Zip archiving, MEGASync installation, credential-dumping activity, and remote execution through WMI or PsExec.
- The ransomware executable was named for the impacted organization; Huntress also reported the .inc encrypted-file extension and .inc-readme.txt or .inc-readme.html ransom-note patterns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | accd8bc0d0c2675c15c169688b882ded17e78aed0d914793098337afc57c289c | SHA-256 hash of the ransomware executable identified in the investigation. |
MITRE ATT&CK
T1003.001 · LSASS MemoryCredential-access commands observed across three servers were indicative of lsassy.py use.T1021.001 · Remote Desktop ProtocolThe actor accessed servers and moved between them using RDP.T1021.002 · SMB/Windows Admin SharesThe actor used PsExec to launch the ransomware executable on remote systems.T1047 · Windows Management InstrumentationThe actor used wmic.exe process call create to launch the executable on remote endpoints.T1059.001 · PowerShellThe actor issued commands to stage data and deploy the ransomware executable.T1059.003 · Windows Command ShellThe actor used cmd.exe commands, including copy commands to distribute the executable.T1078.002 · Domain AccountsThe actor used compromised valid accounts to access systems.T1482 · Domain Trust DiscoveryThe actor ran net group domain admins /domain and nltest.exe during enumeration.T1486 · Data Encrypted for ImpactThe actor deployed a ransomware executable that encrypted files; the article's listed ID T186 is not used here.T1560.001 · Archive via UtilityThe actor used 7-Zip commands to archive and stage collected data.T1567.002 · Exfiltration to Cloud StorageThe actor installed MEGASync, reportedly to facilitate data exfiltration.
People
Threat Actors
Malware
Products
Tools
7-ZipOn day three, the Huntress team observed an RDP login to Server 2, via previously observed credentials, during which there are numerous 7-Zip archival commands to collect and stage data for exfiltration.Advanced IP ScannerThe seventh day began with the threat actor accessing Server 3 via RDP, installing the Advanced IP Scanner, and shortly thereafter, moving laterally to Server 2 via RDP.lsassy.pyApproximately three hours after the initial logon to Server 3, the threat actor was observed running credential access commands on all three servers, all of which were indicative of the use of lsassy.py.MEGAsyncFinally, the threat actor installed MEGASync on Server 2, presumably to facilitate data exfiltration.PsExecThe Huntress team also observed the use of PSExec to launch the file encryption executable, illustrated as follows:PuTTYwell as using mstsc.exe to (attempt to) move laterally to other systems. The threat actor also installed PuTTY.