---
description: >-
  Although I'm late to the Kaseya party, and this will be my first post here,
  but "Better late than Never"!!
---

# Revil - Kaseya Supply Chain Attack

## Trigger & Consequences

\
I work in a Cloud SOC and the Kaseya news was more easily received than a cup of Coffee. As a Cloud SOC's Hunting Team member, intelligence is your best friend and as soon as we got the news and details it was our way to start Hunting, evaluate post compromise scenarios.

While Hunting is perceived differently by different people, to me Threat Hunting always has a trigger point, I don't tend to sit between data trying to find out one pain-point and waste 100s of other opportunities, rather I believe in Finding what's known and derive knowledge from it to test and learn.

A lot of threat/blog posts have talked about it and they are amazing, content rich, full of TTPs & IOCs, but what I would have loved more is to actually test the sample myself and have first-hand Details of the Ransomware.

As much as I hate IOCs, it is indispensable, it's the shortest path to say "nope no threats found".

But to me IOCs are like Keys, if you have the key and know the correct lock (Reputation Platform), you have access to the gold (Malware Sample).

So, I acquired the IOCs (hashes in this case) and got my samples if interest downloaded from Virus total.

Renamed the File to Agent.exe and double-clicked it, in a few seconds a random-namedfile.txt  was generated on my desktop which had the ransom Message :&#x20;

![Ransom Note ](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MffN54K3Pwr9Jf2nN5_%2F-Mfh18YWEUawbAq_CGBV%2Fimage.png?alt=media\&token=bc965f8c-69ca-42d5-a6e1-6b6c97b1a52d)

```
$ Hash: d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
```

Executables and application were not encrypted and this was the first thing I could notice as the Ransom Note asked to Download TOR Browser and Open a Onion Link&#x20;

![RansomNote Instructions](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MffN54K3Pwr9Jf2nN5_%2F-Mfh2bvpXS-mWynU3BWZ%2Fimage.png?alt=media\&token=8e23bc8d-51fb-467a-aebf-6d5900464eaf)

Following on , I first thought of using Ransomware-ID to check the ransom-note and here's what i got , a confirmed sample of Revil :&#x20;

![ID-Ransomware](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MffN54K3Pwr9Jf2nN5_%2F-Mfh3zE0CbqQhAsnYCqU%2Fimage.png?alt=media\&token=1fe8450d-804a-497c-b4af-adf954ef93a1)

Now I followed the step 2 and tries accessing the Link provided in the note and paste the string given in the Ransom Note, but it was blocked by My ISP or unreachable. tried some URLScanning Tools to check if the IP was reachable (Urlscan.io) & it was not. Maybe the Domain was taken Down. \
So the only way left was to fallback to downloading TOR and using the Link provided.Which actually redirect me to the link where Decrypto is being sold and monero is being demanded. \


## Behaviour Study & Understanding

What I'm Interested more in now is what my EDR has captured and How can I write detection/study behaviours of this Sample in execution.

Falling back to my Kibana.

When I downloaded my malware sample it was named as "d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e" and i renamed it to "Agent.exe" to execute it as an executable. \
Since my EDR will be very noisy(as they are supposed to be), I'll find this event first and note the Timestamp as this is from where everything started!!

![Rename Event Performed](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MfkEHBR0DOa8Nhfk1Pp%2F-Mfm8OEX4EuRPnQNUvQA%2Fimage.png?alt=media\&token=a348b879-90bb-4f01-ba15-afd1bbd449b9)

### Process Tree Breakdown

#### Activities of Agent.exe Binary

This was the binary sample that was downloaded and invoked by me.

{% hint style="info" %}
Since we are invoking this binary ourselves we are already at execution phase of MITRE Framework and have no visibility over Initial Access Techniques.

But to note,  since this was a supply chain attack, we know this malicious entity came via "Kaseya VSA Hot-Fix Patch"
{% endhint %}

&#x20;Let's start investigating in a Timeline to observe what all did this executable do:&#x20;

```
process where process.name== "Agent.exe" 
AND process.hash.sha256=process.hash.sha256: "d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e"
```

Let's Check what all events did this Agent.exe Process created in it's execution Cycle.&#x20;

```
any where process.name == "Agent.exe"
```

![Execution Entry -Process Invocation](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MgyntUpa6WlSLybQ1lc%2F-MgzJwOal9cLmVl5kw1X%2Fimage.png?alt=media\&token=39a0f4c3-bb42-4788-9281-b6b82ac197fa)

{% hint style="warning" %}
The Process dropped two files  in temp location & Interestingly both of these files are named as **MsMpEng.exe**(Windows Defender Executable ) & **Mpsvc.dll** (DLL used by Defender ).
{% endhint %}

![Files Dropped on Machine](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MgyntUpa6WlSLybQ1lc%2F-MgzK3xOmyRdW73ngxtk%2Fimage.png?alt=media\&token=0676ee5c-5fcb-4491-8e35-035fa3f095b1)

| Dropped Files | SHA256 Hash                                                      | VT                                                                                                                           |
| :-----------: | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
|   mpsvc.dll   | 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd | [Reputation](https://www.virustotal.com/gui/file/d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e/detection) |
|  MsMpEng.exe  | 33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a | [Reputation](https://www.virustotal.com/gui/file/33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a/details)   |

Follow on the Reputation Links in above table to see the virusTotal Scores for both of the Dropped file hashes.

![Process Exit - Termination](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MgyntUpa6WlSLybQ1lc%2F-MgzKVqzzs33Crs1YCdb%2Fimage.png?alt=media\&token=d07bd878-f697-489f-a29e-595be066d63a)

From the Above events it was understood that the actual Agent file did'nt do anything Itself but was just the dropper/vector to bring in the malicious filesin  to the target environment, As expected from the Kaseya Agent, After all it's a supply chain Attack.

Changing the query a bit to identify what child processes did **"Agent.exe"** create :&#x20;

```
any where process.parent.name == "Agent.exe"
```

![MsMpeng.exe Spawned as Child-Process of Agent.exe](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MgyntUpa6WlSLybQ1lc%2F-MgzzSN3nUUGX6Oll97o%2Fimage.png?alt=media\&token=31eb899f-89e7-4237-b7a7-36ee0fe1d66b)

#### Activities of Dropped MsMpEng.exe Binary&#x20;

At first glance the count of Logs was more than 74k+, clustering them based ont he type of dataset to identify the nature of the logs, almost 74K logs belonged to File events, and it was no brainer understanding that these are file encryption logs where the malware encrypted all the files on my machines. , so discarding them from the scenario for a while let us check what else did this process do on my system apart from encryption.

**DLL Load events :**&#x20;

```
any where process.name == "MsMpEng.exe" and event.category == "library"
```

![DLL Loaded by MsMpEng.exe Process](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhKDDaeULOOHKzsQXgl%2F-MhKOtuqIX5kUVtzHbIj%2Fimage.png?alt=media\&token=844eb8f8-4dbd-4572-ab00-3ff8ed21288f)

{% hint style="warning" %}
Interestingly as can be observed in above screenshot of logs,  **dropped mpsvc.dll was loaded as a DLL library by the msmpeng.exe process** from the temporary location rather than the original Directory path.
{% endhint %}

**Registry Events**

```
any where process.name == "MsMpEng.exe" and event.category == "registry"
```

![Registry Modification Operations](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhKDDaeULOOHKzsQXgl%2F-MhKOOicss9gY_cW4AS3%2Fimage.png?alt=media\&token=48001452-cdef-4e19-ac67-f5c12cb8e7c8)

{% hint style="warning" %}
I ran this sample twice on two different VMs only to observe the malware creates Registry key as SID(S-1-5-21-\*)\Softwares\BlackLives\Matter under HKLM\_USERS hive. the values written are random and i could'nt understand them with current level of analysis.&#x20;
{% endhint %}

**File Events**

The last type of events that MsMpEng.exe generated & we didn't look into it is File Events.so let's quickly dive into it.

```
any where process.name == "MsMpEng.exe" and event.category == "file"
```

![Distribution of file operations performed by MsMpEng.exe](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhNs6lxW4Wa28dMwqQu%2F-MhNy9_FWUkwa_SJ4EAz%2Fimage.png?alt=media\&token=f8f7cf6d-f2cb-4c8a-afc8-49dbc60be0a8)

All my files are converted to add a file.extension: "5y0kd6c" at the end, these were interestingly reflected as file rename operations as per logs rather than being file-encryption events. I tried renaming it back to original, seeing that these are simple file rename operations as per the logs but it didn't work (as if it would!).

**Child Process of MsMpEng.exe**

```
any where process.parent.name == "MsMpEng.exe" 
```

![Invocation of netsh.exe](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhOOtGdeZks3pPjWdvh%2F-MhPDbrZsByUWGC99csd%2Fimage.png?alt=media\&token=458ec5fd-724d-415b-a26f-8078ae7be93f)

{% hint style="warning" %}
Netsh.exe was spawned as Child Process with the commands to enable network discovery on the Host.
{% endhint %}

```
any where process.name == "netsh.exe" and process.pid==9208
```

{% hint style="info" %}
Netsh also loaded a dll named bcrypt.dll which was a signed windows library, and is often required by netsh.exe binary, it provides cryptographic capabilities to the requestor process.
{% endhint %}

**Child Process of Netsh.exe**&#x20;

```
any where process.parent.name == "netsh.exe" 
```

![Invocation of Conhost.exe](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhOOtGdeZks3pPjWdvh%2F-MhPDbrZsByUWGC99csd%2Fimage.png?alt=media\&token=458ec5fd-724d-415b-a26f-8078ae7be93f)

{% hint style="info" %}
Conhost.exe is a windows executable that provides console/command-line capabilities for for interfacing with the system, also responsible for API call servicing and translation.\
Found Nothing Suspicious Here,  this Conhost.exe instance just interpreted the Netsh executables requests and completed it.&#x20;
{% endhint %}

{% hint style="info" %}
The Process Tree ended here. the Diagramatic representation(as shown below)from the EDR would be easier to understand.&#x20;
{% endhint %}

### Final Process Tree Representation from EDR

![](https://3222993412-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MZvGLK8a3yVQkH9aHKK%2F-MhOOtGdeZks3pPjWdvh%2F-MhPGHU6zQR5TtzQHe8B%2Fimage.png?alt=media\&token=a08f88a4-7dd8-4818-bc05-7f4fb46989ed)

### Hunting Revil based on Detected Behaviours

Now that we understand the Dynamic Nature of the execution lifecycle of this Revil Ransomware sample. let's get down to the actual business of crafting detections & Hunting the behaviours.&#x20;

{% hint style="info" %}
Searching IOCs is not Hunting
{% endhint %}

Let's Start with Executable Written in temporary Location. This is a Hunt, It can be structured as well as unstructured as well.

**Original Initial Access:  Compromised Software Supply Chain: T1195.002** &#x20;

{% hint style="info" %}
The Attack Surface Reduction Phase would be scoping out of all  Machines/endpoints/hosts/instances which runs Kaseya VSA Agents. This would significantly reduce the number of Logs/results returned back by your queries and reduce much of the Noise.
{% endhint %}

* Suspicious File-Write Operations(Dropper)
  * Executables/DLL (MZ) file write in temporary Location (unstructured)
  * MsMpEng.exe Binary dropped in Temporary Location (Structured)
  * Mpsvc.dll library Dropped in temporary locations (Structured)
* DLL Side-Loading :&#x20;
  * DLL library Loaded from a  temporary Location
* Registry Value Modification&#x20;
* Abnormally High Disk Write Operation - Data Encryption&#x20;
* Un-usual Child-Parent Process Relationship

&#x20;Reference Jupyter Notebook for Threat Detection & Hunting for this Sample study is under-way



