Step-by-step via the Cash Message ransomware – Sophos Information

In August 2023, the Sophos X-Ops Incident Response group was engaged to help a corporation in Australia contaminated with Cash Message ransomware.  This assault vector, recognized for its stealth, doesn’t append any file extensions to the encrypted knowledge, making it tougher for victims to establish the encrypted recordsdata just by recognizing such extensions.  

On this put up, we’ll take a look at the incident assault stream, illustrating how risk actors are deploying the Cash Message ransomware and what measures can fight attacker efforts at numerous factors alongside the MITRE ATT&CK chain. 

Make a remark of it 

As a part of its routine, the ransomware drops a ransom observe named “money_message.log” immediately into the basis listing of the C: drive.  

The ransom observe on the goal’s system learn as follows: 

Your recordsdata was encrypted by “Cash message” worthwhile group and might’t be accessed anymore. 

In the event you pay ransom, you’re going to get a decryptor to decrypt them. Don’t attempt to decrypt recordsdata your self – in that case they are going to be broken and unrecoverable. 

For additional negotiations open this <redacted>.onion/<redacted> 

utilizing tor browser 

In case you refuse to pay, we’ll put up the recordsdata we stole out of your inside community, in our weblog: 


Encrypted recordsdata can’t be decrypted with out our decryption software program. 


Assault Circulate Particulars 

Preliminary Entry 

Our investigation signifies that the attacker gained preliminary entry by way of the goal’s VPN, which was  utilizing single-factor authentication. That is an instance of MITRE’s T1078 – Valid Accounts method. 


Implementing multifactor authentication (MFA) for VPN connections is paramount to reinforce safety and thwart potential unauthorized entry. Moreover, steady monitoring of VPN logs and consumer exercise must be in place to promptly detect any suspicious login makes an attempt or anomalies. Upgrading to a extra sturdy and layered authentication method, equivalent to MFA, is important to bolster the primary line of protection in opposition to potential risk actors searching for to use single-factor vulnerabilities and achieve unauthorized VPN entry. 

Protection Evasion 

The risk actor deployed GPO Coverage to disable Home windows Defender real-time safety. That is an instance of MITRE’s T1562.001: Impair Defenses: Disable or Modify Tools sub-technique. 

[HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows Defender] DisableAntiSpyware: [REG_DWORD_LE] 1 
[HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows DefenderReal-time Protection] DisableRealtimeMonitoring: [REG_DWORD_LE] 1 


The primary line of protection obtainable to organizations is to make use of a safety agent that has sturdy tamper safety. When it comes to monitoring for this exercise, these are detection-ready occasion sources. Whereas it’s doable a system administrator would disable these protections (not less than quickly) throughout troubleshooting, given the chance of this exercise, it’s one thing that must be investigated promptly if a corresponding help ticket isn’t discovered. 

Lateral Motion 

The risk actor leveraged psexec to run a batch script with the intention of enabling the RDP port, subsequently utilizing Distant Desktop Protocol (RDP) to traverse the community. That is an instance of MITRE’s T1021.001: Remote Services: Remote Desktop Protocol sub-technique. RDP is a standard discovering in circumstances dealt with by Incident Response, as proven by our findings from IR circumstances dealt with throughout the first half of 2023. 

A pie chart showing percentages of RDP abuse seen in cases handled by Sophos X-Ops' IR team during the first half of 2023. Internal findings = 78%; internal and external = 17%; external-only = 1%. No RDP abuse was observed in 4% of cases.

Determine 1: RDP abuse detections in IR circumstances for the primary half of 2023 

The batch script contents are as follows:

reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 
Allow-NetFirewallRule -DisplayGroup 'Distant Desktop' 
netsh advfirewall firewall add rule title="Open Distant Desktop" protocol=TCP dir=in localport=3389 motion=permit 


Securing RDP entry may be tough for a lot of firms, however it’s a mission worthy of funding. The primary merchandise to examine off the field is to limit, by position, which accounts can entry different methods utilizing RDP. The overwhelming majority of customers don’t want this entry. Secondly, adopting a centralized soar server, which solely admins can entry with MFA and blocking on the community degree different system-to-system RDP is a powerful preventative management. Lastly, a detection must be in place to promptly overview anomalous RDP connections to deconflict them with authorised system administration exercise. 

Credential Entry 

The risk actor, utilizing (a part of the Impacket toolkit), retrieved the SAM registry hive. That is an instance of a method of executing MITRE’s T1003.002: OS Credential Dumping: Security Account Manager subtechnique. 

C:WINDOWSsystem32svchost.exe -k localService -p -s RemoteRegistry 


It’s essential for organizations to prioritize the safeguarding of delicate credentials. Implementing sturdy entry controls, using sturdy endpoint detection and response options, and monitoring for any suspicious exercise associated to SAM hive entry are important steps. Any unauthorized makes an attempt to entry or manipulate this essential system part must be promptly investigated, as they might point out a breach or malicious exercise that would compromise the safety of delicate credentials. 


A confirmed compromised account was used to entry delicate folders like Finance, Payroll, SalesReport and HR in FileServer. MITRE lists 37 sub- and sub-sub-techniques below TA0009: Collection. 


Usually by the point a risk actor is staging knowledge, it’s too late to have safety consequence. A superb method to forestall theft of information is to undertake least-privilege entry, which suggests guaranteeing solely the required individuals have entry, adopted by granular controls on exporting, sharing, or transferring the recordsdata. DLP options, whereas having a historical past of being tough to implement and preserve, are price evaluating for high-risk knowledge. 


The risk actor leveraged MEGAsync to exfiltrate the info. That is an instance of MITRE’s T1567.002: Exfiltration Over Web Service: Exfiltration to Cloud Storage. 

UserAssist entry: 87 Worth title: C:Customers<redacted>AppDataLocalTemp6MEGAsyncSetup32.exe  

Rely: 1  

Person ”<redacted> registered Process Scheduler job “MEGAMEGAsync Replace Process S-1-5-21-<redacted>" 


Organizations ought to concentrate on enhancing knowledge loss prevention measures and community monitoring. Implementing sturdy outbound visitors evaluation and content material inspection will help establish and block suspicious knowledge transfers. Moreover, carefully monitoring MEGAsync actions and detecting any uncommon or unauthorized knowledge transfers may be very important in mitigating knowledge breaches. Quickly examine and reply to any indicators of unauthorized exfiltration to forestall potential knowledge compromise and decrease the impression on knowledge confidentiality. 


The risk actor leveraged two ransomware binaries, one for the Home windows setting and one for the Linux setting. The Home windows model is known as home windows.exe, and is detected as Troj/Ransom-GWD by Sophos. That is an instance of MITRE’s T1486: Data Encrypted for Impact. 

  • The Cash Message encryptor is written in C++ and contains an embedded JSON configuration file which incorporates some key particulars like what folders to dam from encrypting, what extension to append, what companies and processes to terminate, and area login names and passwords doubtless used to encrypt different gadgets. 
  • The encryptor makes use of the ChaCha Quarter Spherical algorithm and ECDH encryption 
  • The ransomware creates the C:money_message.log ransom observe when full 
  • On endpoints protected with Sophos, the next detection is triggered: 

Malware detected: ‘Troj/Ransom-GWD’ at ‘C:Customers<redacted>AppDataLocalTemp6windows.exe’ 

The Linux variant is known as ‘esxi’, Upon execution it is going to delete all of the digital exhausting disks. That is an instance of MITRE’s T1561: Disk Wipe. 

 Instructions executed on ESXi host: 

cd /tmp/ 
chmod 777 esxi 


As talked about earlier, at this late stage within the assault, having full protection on all methods with a correctly configured XDR answer is significant to guard organizations from ransomware. Within the case of Sophos, it’s essential for patrons to have their CryptoGuard coverage activated, which is one thing help can information clients on. 


The Cash Message attackers’ path to exfiltration conforms to a reasonably typical MITRE ATT&CK chain, as now we have proven above. Although this explicit attacker tries to muddy the waters for defenders, good protection – particularly within the early phases – can present an efficient toolkit in opposition to unhealthy outcomes.