Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
Procedure Examples |
|
| Name | Description |
|---|---|
| Clop |
Clop can kill several processes and services related to backups and security solutions.(Citation: Unit42 Clop April 2021)(Citation: Mcafee Clop Aug 2019) |
| LookBack |
LookBack can kill processes and delete services.(Citation: Proofpoint LookBack Malware Aug 2019) |
| Meteor |
Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.(Citation: Check Point Meteor Aug 2021) |
| WannaCry |
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.(Citation: FireEye WannaCry 2017)(Citation: SecureWorks WannaCry Analysis) |
| Royal |
Royal can use `RmShutDown` to kill applications and services using the resources that are targeted for encryption.(Citation: Cybereason Royal December 2022) |
| Diavol |
Diavol will terminate services using the Service Control Manager (SCM) API.(Citation: Fortinet Diavol July 2021) |
| Avaddon |
Avaddon looks for and attempts to stop database processes.(Citation: Arxiv Avaddon Feb 2021) |
| Olympic Destroyer |
Olympic Destroyer uses the API call |
| Cheerscrypt |
Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.(Citation: Trend Micro Cheerscrypt May 2022) |
| Prestige |
Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.(Citation: Microsoft Prestige ransomware October 2022) |
| Pay2Key |
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.(Citation: Check Point Pay2Key November 2020) |
| BlackCat |
BlackCat has the ability to stop VM services on compromised networks.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022) |
| RobbinHood |
RobbinHood stops 181 Windows services on the system before beginning the encryption process.(Citation: CarbonBlack RobbinHood May 2019) |
| Lazarus Group |
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.(Citation: Novetta Blockbuster Destructive Malware) |
| Babuk |
Babuk can stop specific services related to backups.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021) |
| REvil |
REvil has the capability to stop services and kill processes.(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019) |
| Conti |
Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of |
| Ryuk |
Ryuk has called |
| Cuba |
Cuba has a hardcoded list of services and processes to terminate.(Citation: McAfee Cuba April 2021) |
| Sandworm Team |
Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.(Citation: Microsoft Prestige ransomware October 2022) |
| LAPSUS$ |
LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.(Citation: NCC Group LAPSUS Apr 2022) |
| MegaCortex |
MegaCortex can stop and disable services on the system.(Citation: IBM MegaCortex) |
| Industroyer |
Industroyer’s data wiper module writes zeros into the registry keys in |
| KillDisk |
KillDisk terminates various processes to get the user to reboot the victim machine.(Citation: Trend Micro KillDisk 2) |
| Ragnar Locker |
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.(Citation: Sophos Ragnar May 2020) |
| SLOTHFULMEDIA |
SLOTHFULMEDIA has the capability to stop processes and services.(Citation: CISA MAR SLOTHFULMEDIA October 2020) |
| HotCroissant |
HotCroissant has the ability to stop services on the infected host.(Citation: Carbon Black HotCroissant April 2020) |
| EKANS |
EKANS stops database, data backup solution, antivirus, and ICS-related processes.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: Palo Alto Unit 42 EKANS) |
| AvosLocker |
AvosLocker has terminated specific processes before encryption.(Citation: Malwarebytes AvosLocker Jul 2021) |
| ROADSWEEP |
ROADSWEEP can disable critical services and processes.(Citation: Mandiant ROADSWEEP August 2022) |
| Wizard Spider |
Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.(Citation: DFIR Ryuk's Return October 2020) |
| Pysa |
Pysa can stop services and processes.(Citation: CERT-FR PYSA April 2020) |
| HermeticWiper |
HermeticWiper has the ability to stop the Volume Shadow Copy service.(Citation: Qualys Hermetic Wiper March 2022) |
| Maze |
Maze has stopped SQL services to ensure it can encrypt any database.(Citation: Sophos Maze VM September 2020) |
| Indrik Spider |
Indrik Spider has used PsExec to stop services prior to the execution of ransomware.(Citation: Symantec WastedLocker June 2020) |
| Netwalker |
Netwalker can terminate system processes and services, some of which relate to backup software.(Citation: TrendMicro Netwalker May 2020) |
| INC Ransomware |
INC Ransomware can issue a command to kill a process on compromised hosts.(Citation: Cybereason INC Ransomware November 2023) |
Mitigations |
|
| Mitigation | Description |
|---|---|
| Network Segmentation |
Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems. |
| Service Stop Mitigation |
Ensure proper process, registry, and file permissions are in place to inhibit adversaries from disabling or interfering with critical services. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations. Harden systems used to serve critical network, business, and communications functions. Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions. |
| User Account Management |
Manage the creation, modification, use, and permissions associated to user accounts. |
| Out-of-Band Communications Channel |
Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication systems. Leveraging these alternative channels reduces the risk of adversaries intercepting, disrupting, or tampering with sensitive communications and helps coordinate an effective incident response.(Citation: TrustedSec OOB Communications)(Citation: NIST Special Publication 800-53 Revision 5) |
| Restrict Registry Permissions |
Restrict the ability to modify certain hives or keys in the Windows Registry. |
| Restrict File and Directory Permissions |
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts. |
Detection
Monitor processes and command-line arguments to see if critical processes are terminated or stop running.
Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.
Alterations to the service binary path or the service startup type changed to disabled may be suspicious.
Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)
References
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
- Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
- Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.
- Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
- Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021.
- Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
- Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
- Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
- Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.
- Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
- Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
- Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.
- MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.
- Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
- Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
- Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.
- Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
- Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
- Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
- Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
- Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
- Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
- Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
- Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
- Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
- Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.
- Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.
- Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.
- Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.
- SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
- DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
- Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
- Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.
- Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
- Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
- Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.
- Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.
- Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
- The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
- CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.
- Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.
- Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.
- Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
- Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.
- Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
Связанные риски
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.