Ransomware Analysis & Defense - Kill Chain Breakdown

[Blacksec]

Ransomware Analysis & Defense - Kill Chain Breakdown ​

---

> Posted by: crypt_guard | Rank: Senior Member | Joined: 2023 [/I]

---

Spoiler: Defensive Research Only

This guide is for analyzing ransomware behavior and building defenses. Don't run these samples on production systems.

Ransomware is the #1 threat to organizations right now.

Double extortion, RaaS (Ransomware as a Service), targeted attacks - the landscape has changed. Let me walk you through how modern ransomware operates and how to detect it.

---

━━━ RANSOMWARE KILL CHAIN ━━━[/B]

┌────────────────────────────────────────────────────────────────┐
│                    RANSOMWARE KILL CHAIN                       │
├──────────┬──────────┬──────────┬──────────┬──────────┬─────────┤
│  RECON   │ INITIAL  │ PERSIST  │ ESCALATE │ ENCRYPT  │ EXTORT  │
│  TARGET  │  ACCESS  │  ANCE    │  PRIV    │  FILES   │  DATA   │
└────┬─────┴────┬─────┴────┬─────┴────┬─────┴────┬─────┴────┬────┘
     │          │          │          │          │          │
  • Email    • Phishing  • Registry  • Token     • File     • Crypto
    lists     links       Run keys    manipulation encryption  note
                 │          • Scheduled  • UAC      • Database     • Threat
                 │           Tasks      bypass     encryption     to publish
                 │          • Service   • Exploit   • SSD encryption
                 │           creation   patches     • VM snapshots
                 │          • WMI        • DCSync
                 │           event       • Golden
                 │           subscription ticket

---

━━━ POPULAR RANSOMWARE FAMILY ANALYSIS ━━━

LockBit 3.0 (LockCrypt):

# Infection vectors:
• RDP brute force (default credentials)
• EternalBlue exploit (MS17-010)
• Phishing emails with malicious attachments
• Supply chain compromise

# Technical characteristics:
- Python-based loader
- C++ main payload
- AES-256 + RSA-2048 encryption
- Drops .lockbit ransom note
- WMI persistence
- Disables Windows Defender
- Encrypts VSS (Volume Shadow Copies)

BlackCat (ALPHV):

# Key features:
- Rust-based (hard to reverse engineer)
- Polymorphic encryption
- Targeted exfiltration (selective files)
- Live-off-the-land techniques
- Anti-analysis techniques
- RDP connection hijacking

Conti (Discontinued but variants exist):

# Characteristics:
- Golang-based
- Domain Fronting for C2
- Mapped drive enumeration
- SQL Server backup file targeting
- Custom crypto modules

---

━━━ RANSOMWARE DETECTION SIGNATURES ━━━

Behavioral Indicators:

# File System Monitoring
• Rapid file modification (>100 files/sec)
• Unknown file extensions being added (.locked, .crypt, .enc)
• Ransom note files created (README*.txt, HOW_TO_DECRYPT*)
• Volume Shadow Copy deletion
• Shadow copy service stopped

# Process Monitoring
• crypt32.dll usage in unusual processes
• vssadmin.exe with delete shadows
• bcdedit.exe modifying boot configuration
• wmic.exe shadowcopy delete operations
• PsExec/Sysinternal tools usage
• PowerShell with encoded commands

YARA Rule for Ransomware Detection:

rule ransomware_generic {
    meta:
        description = "Generic ransomware detection rule"
        author = "crypt_guard"
        date = "2024-01-15"
        
    strings:
        $ransom_note = "Your files have been encrypted" ascii wide
        $decrypt_url = "http://.*\\.onion/.*" ascii wide
        $bitcoin_addr = "bc1[a-zA-Z0-9]{25,}" ascii wide
        $ransom_ext = /\.(locked|crypt|enc|encrypt|xor)$/ ascii wide
        $vssadmin = "vssadmin delete shadows" ascii wide
        $bcdedit = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" ascii wide
        
    condition:
        3 of them or (2 of them and filesize < 10MB)
}

---

━━━ RANSOMWARE ANALYSIS FRAMEWORK ━━━

#!/usr/bin/env python3
"""
Ransomware Behavior Analyzer
Sandbox analysis framework for ransomware samples
"""
import os
import subprocess
import hashlib
import json
import time
import shutil
from datetime import datetime
from pathlib import Path
import psutil

class RansomwareAnalyzer:
    def __init__(self, sample_path, output_dir='analysis'):
        self.sample_path = sample_path
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(exist_ok=True)
        self.monitoring_threads = []
        self.events = []
        
    def analyze_static(self):
        """Static analysis of ransomware sample"""
        print("[*] Running static analysis...")
        
        # File information
        file_info = {
            'name': os.path.basename(self.sample_path),
            'size': os.path.getsize(self.sample_path),
            'sha256': hashlib.sha256(open(self.sample_path, 'rb').read()).hexdigest(),
            'md5': hashlib.md5(open(self.sample_path, 'rb').read()).hexdigest(),
        }
        
        # Strings extraction
        try:
            result = subprocess.run(
                ['strings', self.sample_path],
                capture_output=True, text=True
            )
            file_info['strings'] = result.stdout.split('\n')[:1000]
            
            # Check for suspicious strings
            suspicious_patterns = [
                'ransom', 'bitcoin', 'decrypt', 'payment',
                'onion', ' TOR ', '.onion', 'encrypt',
                'vssadmin', 'bcdedit', 'cipher', 'wbadmin'
            ]
            file_info['suspicious_strings'] = [
                s for s in result.stdout.split('\n')
                if any(p in s.upper() for p in suspicious_patterns)
            ]
        except:
            file_info['strings'] = []
            file_info['suspicious_strings'] = []
            
        # PE header analysis (for Windows executables)
        if self.sample_path.endswith('.exe'):
            file_info['pe_info'] = self.analyze_pe()
            
        return file_info
    
    def analyze_pe(self):
        """Analyze PE header for Windows executables"""
        try:
            result = subprocess.run(
                ['pefile', self.sample_path],
                capture_output=True, text=True
            )
            return {'pe_analysis': result.stdout}
        except:
            return {}
    
    def monitor_behavior(self, duration=60):
        """Monitor ransomware behavior during execution"""
        print(f"[*] Monitoring for {duration} seconds...")
        
        # Record initial state
        initial_processes = set(p.pid for p in psutil.process_iter())
        initial_files = set(str(p) for p in Path('/tmp').glob('*'))
        
        # Execute the sample
        try:
            proc = subprocess.Popen(
                [self.sample_path],
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE
            )
            
            time.sleep(duration)
            proc.kill()
            
        except Exception as e:
            print(f"[-] Execution error: {e}")
            
        # Record final state
        final_processes = set(p.pid for p in psutil.process_iter())
        final_files = set(str(p) for p in Path('/tmp').glob('*'))
        
        # Analyze changes
        new_processes = final_processes - initial_processes
        new_files = final_files - initial_files
        
        return {
            'new_processes': list(new_processes),
            'new_files': list(new_files)[:100],
            'duration': duration,
        }
    
    def generate_report(self):
        """Generate comprehensive analysis report"""
        static = self.analyze_static()
        behavioral = self.monitor_behavior()
        
        report = {
            'analysis_id': f"RANSOM-{datetime.now().timestamp():.0f}",
            'timestamp': datetime.now().isoformat(),
            'static_analysis': static,
            'behavioral_analysis': behavioral,
            'threat_assessment': self.assess_threat(static, behavioral),
        }
        
        # Save report
        report_path = self.output_dir / f"report_{report['analysis_id']}.json"
        with open(report_path, 'w') as f:
            json.dump(report, f, indent=2)
            
        print(f"[+] Report saved: {report_path}")
        return report
    
    def assess_threat(self, static, behavioral):
        """Assess threat level based on analysis"""
        risk_score = 0
        
        # Check suspicious strings
        if static.get('suspicious_strings'):
            risk_score += len(static['suspicious_strings']) * 10
            
        # Check file modifications
        if len(behavioral.get('new_files', [])) > 50:
            risk_score += 30
            
        # Check new processes
        if len(behavioral.get('new_processes', [])) > 10:
            risk_score += 20
            
        # Determine threat level
        if risk_score > 100:
            return {'level': 'CRITICAL', 'score': risk_score}
        elif risk_score > 50:
            return {'level': 'HIGH', 'score': risk_score}
        elif risk_score > 20:
            return {'level': 'MEDIUM', 'score': risk_score}
        else:
            return {'level': 'LOW', 'score': risk_score}

if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument('--sample', required=True, help='Ransomware sample path')
    parser.add_argument('--output', default='analysis')
    args = parser.parse_args()
    
    analyzer = RansomwareAnalyzer(args.sample, args.output)
    report = analyzer.generate_report()
    print(json.dumps(report, indent=2))

---

━━━ DEFENSE STRATEGIES ━━━

1. BACKUP STRATEGY
   • 3-2-1 rule: 3 copies, 2 media types, 1 offsite
   • Immutable backups (write-once-read-many)
   • Offline/air-gapped backups
   • Regular restore testing

2. DETECTION
   • Endpoint Detection & Response (EDR)
   • File integrity monitoring
   • Behavioral analysis
   • Network traffic monitoring

3. PREVENTION
   • Email filtering & sandboxing
   • Web proxy with malware detection
   • Application whitelisting
   • Patch management
   • User training

4. RESPONSE
   • Incident response plan
   • Isolation procedures
   • Forensic preservation
   • Communication plan

---

━━━ RANSOMWARE IOCs ━━━

# === File-based IOCs ===
*.locked (LockBit)
*.crypt (BlackCat)
*.enc ( encrypted files)
*.R00T (R00t ransomware)
*.darkness (DarkSide)
readme_decrypt.txt (various)
HOW_TO_DECRYPT.html (various)

# === Registry Keys ===
HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Defender

# === Network IOCs ===
.onion domains (Tor hidden services)
Specific C2 IP ranges per family
DNS queries to random-looking domains (DGA)

---

━━━ TL;DR ━━━

✅ Track the ransomware kill chain
✅ Monitor for rapid file encryption
✅ Watch for VSS deletion commands
✅ Use YARA rules for detection
✅ Implement 3-2-1 backup strategy
✅ Test restore procedures regularly

---

What's your ransomware defense setup? Share below.
Next: Malware reverse engineering with Ghidra.

Last edited by crypt_guard; 45 minutes ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
crypt_guard | Senior Member | Ransomware Researcher
"The best defense is understanding the threat"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b]