Full Report
Huntress has observed INC ransomware deployed in the past but recent activity indicates a possible continued shift in/or improvement of tactics employed by these threat actors.
Analysis Summary
# Incident Report: LOLBin to INC Ransomware Deployment
## Executive Summary
Huntress analysts identified a series of incidents involving the deployment of INC ransomware, characterized by a specific pattern of Living-off-the-Land Binary (LOLBin) usage. Threat actors demonstrated significant prior knowledge of victim environments, specifically targeting and disabling security software like Windows Defender and CylancePROTECT before deploying the final payload. Huntress was able to head off several deployments by hunting for this specific pre-ransomware behavior across their infrastructure.
## Incident Details
- **Discovery Date:** May 1, 2024 (Report Published)
- **Incident Date:** April 2024
- **Affected Organization:** Multiple Huntress customers
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Variable; prior to ransomware deployment.
- **Vector:** Likely compromised user accounts (specific entry method not detailed in this report).
- **Details:** Threat actors operated using credentials known to be compromised within the customer’s infrastructure.
### Lateral Movement
- **Details:** The threat actor demonstrated "significant prior knowledge" of the infrastructure, suggesting lateral movement and reconnaissance had occurred prior to the observed LOLBin activity.
### Data Exfiltration/Impact
- **Details:** Deployment of INC ransomware. The threat actor verified effectiveness by opening the `INC-README.txt` file using `NOTEPAD.EXE`.
### Detection & Response
- **Discovery:** Detection of `SystemSettingsAdminFlows.exe` being used to modify Windows Defender settings.
- **Response Actions:** Huntress analysts identified the pattern and hunted for the same activity across all managed endpoints to notify customers before encryption could occur.
## Attack Methodology
- **Initial Access:** Compromised user accounts.
- **Persistence:** Not explicitly detailed in this report.
- **Privilege Escalation:** Use of `SystemSettingsAdminFlows.exe` (a native Windows utility).
- **Defense Evasion:**
- Disabling Windows Defender via LOLBins.
- Use of `av.exe` to terminate `CylanceSvc.exe` (CylancePROTECT).
- Use of a file `kaz.exe` after disabling Defender.
- **Credential Access:** Prior compromise of user accounts mentioned.
- **Discovery:** Demonstrated knowledge of installed security products (Defender, Cylance, Sophos).
- **Lateral Movement:** Not detailed, but implied by environment-wide knowledge.
- **Collection:** Not detailed.
- **Exfiltration:** Not detailed.
- **Impact:** Encryption via INC Ransomware and placement of `INC-README.txt`.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Intent was ransomware deployment; volume of data stolen not specified.
- **Operational:** Potential for total business disruption due to ransomware encryption.
- **Reputational:** Not disclosed.
## Indicators of Compromise
- **Network indicators:** None provided in the source text.
- **File indicators:**
- `av.exe` (Trojan:Script/Wacatac.H!ml) - Used to kill security services.
- `kaz.exe` (Original filename: `Treasury Secretary Steven Mnuchin`)
- `INC-README.txt` (Ransom note)
- **Behavioral indicators:**
- Use of `SystemSettingsAdminFlows.exe` to modify security settings.
- Execution of `NOTEPAD.EXE` to open a ransom note.
- Termination of `CylanceSvc.exe` via external tools.
- Windows Event ID 5007 (Defender configuration change) and 7031 (Service crash).
## Response Actions
- **Containment measures:** Isolation of endpoints where LOLBin patterns were detected.
- **Eradication steps:** Quarantine of `av.exe` by Windows Defender (though sometimes too late to stop the service kill).
- **Recovery actions:** Notification of customers to prevent full-scale encryption.
## Lessons Learned
- **LOLBin Vigilance:** Threat actors are increasingly using native Windows binaries (`SystemSettingsAdminFlows.exe`) to bypass traditional detection.
- **Security Software Targeting:** Actors are bringing specific tools to disable specific EDR/AV solutions, indicating they know exactly what defense is in place before they strike.
- **Proactive Hunting:** Monitoring for the *precursors* of ransomware (like disabling security tools) is more effective than waiting for the encryption event.
## Recommendations
- **Monitor LOLBins:** Implement monitoring for unauthorized execution of administrative Windows utilities like `SystemSettingsAdminFlows.exe`.
- **Tamper Protection:** Ensure "Tamper Protection" features are enabled and locked within EDR/AV solutions to prevent service termination.
- **Audit Event Logs:** Monitor for Windows Event ID 5007 (Defender changes) and Event ID 7031 (Security service failures) as high-priority alerts.
- **Credential Hygiene:** Rotate credentials and enforce MFA, as the actor relied on previously compromised accounts.