Full Report
The publication of the first blog post led a Huntress SOC analyst to identify and escalate a second, similar incident. A deeper investigation into the activity made it clear that the Huntress SOC had obviated several Trigona ransomware attacks, protecting customers from the impact of a ransomware infection.
Analysis Summary
# Incident Report: Trigona Ransomware Precursor - MSSQL Exploitation
## Executive Summary
A Huntress SOC analyst identified and interdicted an automated attack targeting an MSSQL server, which was later attributed as a precursor to Trigona ransomware. The threat actor leveraged the `xp_cmdshell` stored procedure to extract pre-staged malicious batch files and executables from database tables onto the host filesystem. The attack was successfully remediated within 12 minutes of the initial command execution, preventing the installation of unauthorized remote access tools and potential ransomware deployment.
## Incident Details
- **Discovery Date:** February 23, 2024
- **Incident Date:** February 23, 2024
- **Affected Organization:** Undisclosed (Huntress Managed Customer)
- **Sector:** Undisclosed
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** February 23, 2024, 14:45:08 UTC
- **Vector:** MSSQL Server Exploitation
- **Details:** Attackers gained sufficient privileges to execute the `xp_cmdshell` stored procedure, indicating either credential compromise or SQL injection.
### Lateral Movement
- **Details:** The attacker utilized the `bcp` (Bulk Copy Program) utility to export binary data from an MSSQL table (`uGnzBdZbsi`) into executable files (`AD.exe`) and batch scripts (`kur.bat`, `n.bat`, `user1.bat`) in the `C:\users\public\music\` directory.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported. The primary impact was the unauthorized creation of a local administrator account (`admins124`) and the installation of AnyDesk for persistent remote access.
### Detection & Response
- **Discovery:** 14:45 UTC - Huntress SOC identified activity mirroring a previously documented MSSQL attack pattern.
- **Response Actions:** 14:57 UTC - An administrator accessed the endpoint via ScreenConnect, authenticated via Duo MFA, and began manual remediation and containment.
## Attack Methodology
- **Initial Access:** MSSQL exploitation (Likely brute force or exploited vulnerability).
- **Persistence:** Installation of AnyDesk (`AD.exe`) and creation of a new local user account `admins124`.
- **Privilege Escalation:** Addition of the new user to "Administrators" and "Remote Desktop Users" groups.
- **Defense Evasion:** Use of `bcp.exe` (a legitimate SQL utility) to drop payloads; scripts included commands to delete themselves after execution (`del "%~f0"`).
- **Credential Access:** Attempted to enable WDigest caching via registry modification (`UseLogonCredential` set to 1) to facilitate future credential harvesting.
- **Discovery:** Automated scripts targeted localized administrator group names (e.g., "Administradores", "Administratoren").
- **Lateral Movement:** Provisioning RDP access via the `admins124` account.
- **Collection:** Pre-staging binaries in SQL tables for extraction.
- **Impact:** Preparation for Trigona ransomware deployment (obviated).
## Impact Assessment
- **Financial:** Minimal; restricted to incident response labor costs.
- **Data Breach:** None confirmed.
- **Operational:** Minimal; remediation occurred before business operations were disrupted.
- **Reputational:** None; incident was contained internally.
## Indicators of Compromise
- **File Indicators:**
- `C:\users\public\music\AD.exe`
- `C:\users\public\music\kur.bat`
- `C:\users\public\music\user1.bat`
- `C:\users\public\music\n.bat`
- `C:\users\public\music\FODsOZKgAU.txt`
- **Behavioral Indicators:**
- `xp_cmdshell` execution followed by `bcp` utility usage.
- Creation of user `admins124` with password `@@@Music123..`.
- Registry modification: `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\wdigest\UseLogonCredential` set to `1`.
## Response Actions
- **Containment:** Rapid identification by SOC prevented the attacker from utilizing the newly installed AnyDesk instance.
- **Eradication:** Removal of the `admins124` account and deletion of malicious files in `C:\users\public\music\`.
- **Recovery:** Restoration of secure registry settings and hardening of the MSSQL instance.
## Lessons Learned
- **Threat Intelligence Value:** The publication of "Part I" of this research directly enabled the SOC to identify this "Part II" incident in real-time.
- **Automation Speed:** The transition from initial command to full persistence (AnyDesk installation) took less than 8 minutes, highlighting the need for automated EDR alerts.
- **Living-off-the-Land:** The use of `bcp.exe` to reconstruct binaries from SQL tables is an effective evasion technique that bypasses standard file-download monitoring.
## Recommendations
- **Disable `xp_cmdshell`:** Disable this stored procedure on all MSSQL instances unless strictly required for business operations.
- **SQL Hardening:** Ensure MSSQL services run under low-privilege service accounts rather than `LocalSystem`.
- **Restrict `bcp.exe`:** Monitor or restrict the execution of the Bulk Copy Program utility by the SQL service account.
- **MFA:** Enforce Multi-Factor Authentication for all remote access points (as successfully demonstrated by the admin using Duo during remediation).
- **Egress Filtering:** Block or monitor outbound connections from database servers to unauthorized internet destinations.