TTP Tuesday: Ransomware (Release 2)

Windows Ransomware using Live off the Land (LotL) Tools

Theme Overview

21 December 2021

Our current theme is ransomware, focusing on scenarios where threats use live off the land (LotL) binaries and custom payloads to accomplish their objectives. The ransomware theme will contain the following kill-chains:

1. Linux Ransomware using Live off the Land (LotL) Tools

2. Windows Ransomware using Live off the Land (LotL) Tools (Current Release)

3. Linux Ransomware using Custom Tools

4. Windows Ransomware using Custom Tools

Windows Ransomware using Live off the Land (LotL) Tools

This week's kill chain focuses on using Windows 10 PowerShell commands with the assistance of 7zip in order to perform a ransomware attack. We discover the current user's home directory and recursively compress it with the zip binary and a randomly generated password. The inclusion of 7zip is required as currently Windows does not natively support encrypting archive files or folders using a password. The inclusion of 7zip also requires a PowerShell script to perform the zip and password protection. PowerShell does not support the running of ps1 files without first setting set-executionpolicy remotesigned in a PowerShell administrator window.

Check it out on the Prelude chains website.

Watch a demonstration:

Next week, we will be dropping our Linux ransomware using custom tooling.

Staying up to date

Thanks for reading our first, new TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/channel/UCZyx-PDZ_k7Vuzyqr4-qK9A

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus