{"id":1144,"date":"2021-12-14T13:58:12","date_gmt":"2021-12-14T12:58:12","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=1144"},"modified":"2021-12-14T14:10:18","modified_gmt":"2021-12-14T13:10:18","slug":"cuba-ransomware-analysis","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/cuba-ransomware-analysis\/","title":{"rendered":"Cuba Ransomware Analysis"},"content":{"rendered":"\n

Due to the recent warning published by the FBI about Cuba ransomware<\/a> (original FBI warning no longer available online for unknown reasons), from Lab52 we decided to publish some information about this ransomware family. Despite the fact that the ransomware has been named Cuba, there is no clear evidence linking the country to the implementation or perpetration of this type of attacks.<\/p>\n\n\n\n

Nonetheless, the geopolitical analysis has revealed a few details of strategic interest. Firstly, the fact that most of the countries attacked, according to a McAfee report<\/a>, correspond to those located in Latin America, North America and Europe. Of these, the most targeted were: Spain, Colombia and Germany. However, when looking at the possible link between the countries attacked and the sectors compromised, it has not been possible to identify a clear interest in the attack, since although Colombia is a US ally in Latin America and a NATO observer state, and Spain is a member of the European Union and NATO with a good geostrategic position, none of them stand out among the critical sectors that have been attacked.<\/p>\n\n\n\n

Secondly, it has also been observed that the profile of the countries attacked is common to apt groups that share certain ideological lines, which may be contrary to those of the countries that have been targeted. However, this has not yet allowed us to identify the link between this ransomware and any specific country or APT group.<\/p>\n\n\n\n

For this post, we have analyzed a recent public sample, which has a compiler timestamp dated from August 23rd, 2021:<\/p>\n\n\n\n

936119bc1811aeef01299a0150141787865a0dbe2667288f018ad24db5a7bc27<\/p>\n\n\n\n

In this sample, we have observed some changes from the version described by McAfee in April 2021<\/a>, which is the only and most recent published analysis about this ransomware family.<\/p>\n\n\n\n

Firstly, the process retrieves the Input Locale identifiers (formerly called Keyboard Layout Handles) corresponding to the current set of input languages in the infected system. In case of finding the Russian language identifier (0x19) among the obtained list, the process terminates. Otherwise, it starts with its main activity.<\/p>\n\n\n\n

\"\"
Main function of the Cuba Ransomware sample<\/figcaption><\/figure><\/div>\n\n\n\n

Since the program accepts one argument, the main activity will start by parsing the given argument, looking for either “network”, some IP address, “local” or a specific path to encrypt. Thus, the usage of this sample by an operator would be as follows:<\/p>\n\n\n\n

cuba.exe [ network | [IP_addr] | local | [specific_path] ]<\/p>\n\n\n\n

\"\"
Principal function of Cuba Ransomware<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Flow diagram of the Cuba Ransomware sample<\/figcaption><\/figure><\/div>\n\n\n\n

According to this, we could distinguish between two network modes and two local modes. The network mode triggered by the “network” argument will call the windows API GetIPNetTable in order to obtain the ARP table and call NetShareEnum using each IP as the serverName parameter for this second API call. In the case of specifying an IP address, it will just enumerate the shares of that specific address.<\/p>\n\n\n\n

\"\"
Pseudocode of the “network” argument function calls<\/figcaption><\/figure><\/div>\n\n\n\n

The default (no argument given) or “local” argument mode will enumerate the volumes by their Device IDs in the system. If a path is specified as the argument, the ransomware will only encrypt that specified path.<\/p>\n\n\n\n

\"\"
Pseudocode of the default “local” mode<\/figcaption><\/figure><\/div>\n\n\n\n

Depending on the case there will be between 2 and 4 threads encrypting the information, which will be created by the same function, for which a different target will be given also depending on the initial argument.<\/p>\n\n\n\n

Before starting the encryption there are two different cases where the binary will first terminate some harcoded processes or services. As shown in the elaborated flow diagram, this will happen only if no argument or “local” is given, or if the specified IP address is 127.0.0.1.<\/p>\n\n\n\n

\"\"
Elevation of privileges prior to termination of processes<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Hardcoded services and processes names to terminate, along with the function calls to do so<\/figcaption><\/figure><\/div>\n\n\n\n

Just like the previous versions, this sample will use SeDebugPrivilege in order to obtain the necessary rights to terminate processes and services, in this sample they only added one new process to terminate: the Store Worker Process (Microsoft.Exchange.Store.Worker.exe), responsible for executing RPC operations for mailboxes on a database.<\/p>\n\n\n\n

Unlike the majority of ransomware families, two different instances of the same process could be executed at the same time, which could cause interferences between each other. However, to avoid double cyphering, the RANSOMWARE still adds to the encrypted file a 240 bytes header, with nothing but the string “FIDEL.CA” and four extra values in the consecutive words. Before encypting a file, the presence of this “file signature” will be checked.<\/p>\n\n\n\n

\"\"
Encrypted file header<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Encryption header check<\/figcaption><\/figure><\/div>\n\n\n\n

In the version analyzed by McAfee, they found that their sample could take a different list of arguments such as \/min, \/max, \/dm, \/net, or \/scan. However, the sample we analyzed only accepts one of the arguments described above. This means that for this version THERE IS NO POSSIBILITY THAT the ransomware operator CAN specify a maximum or minimunm file size to encrypt. Though, large files will only get encrypted their first MB for EVERY 9MB.<\/p>\n\n\n\n

\"\"
End of first Megabyte from encryption file<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Beginning of 9th Megabyte of encrypted file<\/figcaption><\/figure><\/div>\n\n\n\n

Most likely in order to avoid system failures, the ransomware will not encrypt files with extensions .exe, .dll, .sys, .ini, .lnk, .cuba, and it will ignore paths containing “\\windows\\”.<\/p>\n\n\n\n

\"\"
Cypher function checking files and routes to skip, with snippets of the called functions<\/figcaption><\/figure><\/div>\n\n\n\n

Once the threads have finished the cyphering task, the function to delete itself from disk will be called, INDEPENDENTLY FROM the argument provided, unlike the McAfee sample, where they affirmed that this function would be called when giving the “\/dm” argument. For this, the sample will call the Windows API CreateProcessW with “\\\\system32\\\\cmd.exe” as the ApplicationName and ” \/c \\del [exe_path] >> NULL ” as command line arguments.<\/p>\n\n\n\n

The complete list of stopped processes and services is shown in the following tables:<\/p>\n\n\n\n

MySQL<\/td>MSExchangePOP3BE<\/td><\/tr>
MySQL80<\/td>MSExchangePop3<\/td><\/tr>
SQLSERVERAGENT<\/td>MSExchangeNotificationsBroker<\/td><\/tr>
MSSQLSERVER<\/td>MSExchangeMailboxReplication<\/td><\/tr>
SQLWriter<\/td>MSExchangeMailboxAssistants<\/td><\/tr>
SQLTELEMETRY<\/td>MSExchangeIS<\/td><\/tr>
MSDTC<\/td>MSExchangeIMAP4BE<\/td><\/tr>
SQLBrowser<\/td>MSExchangeImap4<\/td><\/tr>
vmcompute<\/td>MSExchangeHMRecovery<\/td><\/tr>
vmms<\/td>MSExchangeHM<\/td><\/tr>
MSExchangeUMCR<\/td>MSExchangeFrontEndTransport<\/td><\/tr>
MSExchangeUM<\/td>MSExchangeFastSearch<\/td><\/tr>
MSExchangeTransportLogSearch<\/td>MSExchangeEdgeSync<\/td><\/tr>
MSExchangeTransport<\/td>MSExchangeDiagnostics<\/td><\/tr>
MSExchangeThrottling<\/td>MSExchangeDelivery<\/td><\/tr>
MSExchangeSubmission<\/td>MSExchangeDagMgmt<\/td><\/tr>
MSExchangeServiceHost<\/td>MSExchangeCompliance<\/td><\/tr>
MSExchangeRPC<\/td>MSExchangeAntispamUpdate<\/td><\/tr>
MSExchangeRepl<\/td><\/td><\/tr><\/tbody><\/table>
Stopped services<\/figcaption><\/figure>\n\n\n\n
sqlagent.exe<\/td>sqlbrowser.exe<\/td><\/tr>
sqlservr.exe<\/td>vmwp.exe<\/td><\/tr>
sqlwriter.exe<\/td>outlook.exe<\/td><\/tr>
sqlceip.exe<\/td>vmsp.exe<\/td><\/tr>
msdtc.exe<\/td>Microsoft.Exchange.Store.Worker.exe<\/td><\/tr><\/tbody><\/table>
Tertminated processes<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"

Due to the recent warning published by the FBI about Cuba ransomware (original FBI warning no longer available online for unknown reasons), from Lab52 we decided to publish some information about this ransomware family. Despite the fact that the ransomware has been named Cuba, there is no clear evidence linking the country to the implementation […]<\/p>\n","protected":false},"author":6,"featured_media":1165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-1144","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2021\/12\/cubaransom.jpeg","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2021\/12\/cubaransom.jpeg","author_info":{"display_name":"Dex","author_link":"https:\/\/lab52.io\/blog\/author\/dex\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/1144"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=1144"}],"version-history":[{"count":6,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/1144\/revisions"}],"predecessor-version":[{"id":1166,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/1144\/revisions\/1166"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/1165"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=1144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=1144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=1144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}