Huntress Used a Harmless File to Block the Kaseya VSA Ransomware Payload
Summary
Huntress analyzed the Kaseya VSA attack and pushed a harmless agent.exe text file to partner endpoints, aiming to block certutil from writing the REvil payload under the same filename.
Key points
- Huntress reported that REvil used a Kaseya VSA-delivered command to disable several Windows security protections, decode agent.crt with certutil, and run agent.exe.
- The attack’s payload process relied on certutil not being able to decode the file when a file with the output name already existed.
- Huntress pushed a harmless agent.exe text file to checking-in Huntress agents, intending to block creation of the ransomware payload.
- The workaround had limitations: attackers could change the filename or directory, and the VSA working directory was configurable.
- Huntress notified Kaseya and other vendors of the file hashes to help avoid false positives; some partners initially mistook the file for malicious.
Article Details
- Defense Focus
- Prevent REvil/Sodinokibi ransomware execution in Kaseya VSA environments by placing a benign file named agent.exe in the configured agent temporary directory before the decoded payload is written.
- Detection Methods
- Review the VSA-delivered command sequence for disabling Windows protection settings, copying certutil.exe to cert.exe, appending data to alter the executable hash, decoding agent.crt to agent.exe, deleting the intermediate files, and launching agent.exe.
- Investigate the configured VSA agent temporary directory, identified in the article as #vAgentConfiguration.AgentTempDir#, rather than assuming it is always C:\kworking.
- Distinguish the benign Huntress agent.exe text file from the ransomware payload using its file contents and the supplied hashes.
- Data Sources
- Endpoint command-line and process execution records
- File-system observations in the configured VSA agent temporary directory
- File hashes for the Huntress vaccine file
- Platforms
- Huntress platform
- Defensive Actions
- Deploy a benign agent.exe file to the configured VSA agent temporary directory so certutil will not decode the malicious payload to that filename.
- Verify the directory configuration before relying on the vaccine; the default C:\kworking path may have been changed.
- Treat the vaccine as a temporary, name-dependent measure: the attackers could change the filename or directory.
- Use the published MD5, SHA1, and SHA256 values to identify the Huntress text-file vaccine and avoid mistaking it for the ransomware payload.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 10ec4c5b19b88a5e1b7bf1e3a9b43c12 | MD5 hash Huntress provided for its benign agent.exe text-file vaccine to help prevent false positives. |
| SHA1 | a4636c16b43affa1957a9f1edbd725a0d9c42e3a | SHA1 hash Huntress provided for its benign agent.exe text-file vaccine to help prevent false positives. |
| SHA256 | 5dca077e18f20fc7c8c08b9fd0be6154b4c16a7dcf45bdf69767fa1ce32f4f5d | SHA256 hash Huntress provided for its benign agent.exe text-file vaccine to help prevent false positives. |
MITRE ATT&CK
T1059.001 · PowerShellThe payload command invoked Windows PowerShell to change Microsoft Defender preferences.T1105 · Ingress Tool TransferThe article says the VSA server delivered agent.crt to endpoints for decoding into the ransomware executable.T1140 · Deobfuscate/Decode Files or InformationThe attacker used certutil.exe, copied as cert.exe, to decode agent.crt into the executable agent.exe.T1562.001 · Disable or Modify ToolsThe observed command used Set-MpPreference to disable real-time monitoring, intrusion prevention, IOAV protection, and script scanning, and to weaken other Windows security settings.
Threat Actors
Malware
Vendors
Products
Huntress platformThe Huntress platform allows us to pull files in case we need to run some extra investigation on suspicious activity, something we did a lot during this attack, but it also allows us to push files down to endpoints withKaseya VSAransomware attacks in recent memory. As we’ve learned, REvil performed a sophisticated, timed attack on Kaseya VSA servers to distribute Sodinokibi ransomware out to clients and remove traces of them being there.