Two endpoints were minimally impacted by ransomware, with only a limited number of canary files encrypted, and there was no evidence of recon or lateral movement beyond the impacted endpoint. The activity appears tied to TeamViewer-based initial access and resembles the LockBit 3.0 scenario, with security software blocking some payloads and halting progress on one endpoint. #TeamViewer #LockBit3 #Huntress
Keypoints
- Two endpoints were minimally affected by ransomware, with only a few canary files encrypted and no evidence of broader reconnaissance or lateral movement.
- Endpoint A and Endpoint B showed distinct TeamViewer login sessions, lasting about 7.5 minutes and just over 10 minutes respectively.
- Initial access was achieved via TeamViewer, with logs indicating access by legitimate administrators and multiple endpoints referenced in the logs.
- Some TeamViewer access dates extend back years; one endpoint’s last login prior to intrusion was over three months earlier.
- Past Huntress observations include TeamViewer-based deployment of a cryptocurrency miner and use of curl.exe for data exfiltration in other incidents.
- The ransomware deployment began with a batch file on the desktop, used rundll32 to load a DLL, and security software quarantined payloads, halting further activity.
MITRE Techniques
- [T1133] External Remote Service – Initial access achieved via TeamViewer. The final entry from the TeamViewer connections_incoming.txt log file showed the threat actor’s access to each endpoint.
- [T1059.003] Windows Command Shell – The batch file on the desktop invoked a rundll32.exe command to load a DLL payload: ‘This batch file… ran the following rundll32.exe command: rundll32 C:UsersuserDesktopLB3_Rundll32_pass.dll,gdll -pass ‘
- [T1486] Data Encrypted for Impact – Endpoint A encryption was limited to the endpoint; ‘two disparate endpoints identified as being minimally impacted by ransomware; that is, only a limited number of ransomware canary files were encrypted.’ and ‘The ransomware impact on endpoint A was not simply limited, but limited to just that endpoint.’
- [T1041] Exfiltration – curl.exe was used for data exfiltration. ‘curl.exe was used for data exfiltration.’
Indicators of Compromise
- [Endpoint Name] threat actor endpoint name – WIN-8GPEJ3VGB8U, and an endpoint name containing -HOME suffix
- [SHA256] 60ab8cec19fb2d1ab588d02a412e0fe7713ad89b8e9c6707c63526c7768fd362 – LB3_Rundll32_pass.dll
- [Filename] LB3_Rundll32_pass.dll – DLL used in rundll32 invocation
- [File Path] C:UsersuserDesktopPP.bat – batch file used to start ransomware deployment
- [File Path] C:UsersuserDesktopLB3.exe – executable attempted by attacker and quarantined
Read more: https://www.huntress.com/blog/ransomware-deployment-attempts-via-teamviewer