Crowdstrike Indrik November 2018

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

BitPaymer can use net view to discover remote systems.

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

Indrik Spider has used PowerShell Empire for execution of malware.

Indrik Spider has used batch scripts on victim's machines.

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.

Indrik Spider has collected credentials from infected systems, including domain accounts.

BitPaymer can enumerate the sessions for each user logged onto the infected host.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

BitPaymer can set values in the Registry to help in execution.

BitPaymer can use the tokens of users to create processes on infected systems.

BitPaymer can search for network shares on the domain or workgroup using net view <host>.

BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.

BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.

Indrik Spider has used Group Policy Objects to deploy batch scripts.

BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.

Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.

BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.

BitPaymer has attempted to install itself as a service to maintain persistence.

BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.

BitPaymer has copied itself to the :bin alternate data stream of a newly created file.

Indrik Spider has served fake updates via legitimate websites that have been compromised.

Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.

Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.