Quick Look at a Novel Technique Used by Darkbit Ransomware
I'm very aware that in infosec we tend to be like magpies, distracted by new and shiny objects while sometimes underestimating the impact of the boring tried and true techniques that hackers use day in and day out because they just work.
Having said that, I'm only human and when I see something I haven't seen before it piques my curiosity.
That was the case with this tweet by Jazi, a Fortinet threat intel researcher, talking about a Darkbit payload.
Before we get into the content of that tweet though let's have a quick look at Darkbit, as there are so many ransomware groups now, and the smaller ones can start to blur together as there are only so many adjectives that they seem to favour.
Darkbit are not a very active ransomware group, from what I can tell they have had one high profile victim, the Technion - Israel Institute of Technology. The group heavily implies that they are a disgruntled former tech worker, the further implication is that they may have worked or had dealings with Technion.
Darkbit also position themselves as being motivated politically or ideologically, as ransomware hacktivists as it were, although we must remember threat actors make a lot of spurious claims for reasons of their own.
Now that we've discussed Darkbit a little, let's get back to that tweet about PrintBrm.exe, which is a Windows native backup/recovery/migration tool for print queues that can be found at %Windir%\System32\spool\tools\printbrm.exe.
There are so many LOLBins that it is easy to lose track, but this is not one I was familiar with before. What's interesting about PrintBrm though is that it can be used to compress and decompress files. If you think about file collection for exfiltration on Windows systems you'll know there are a limited number of command-line utilities, especially native, that can interact with compressed files.
In this case Darkbit has placed a zip file with their next stage payload into an ISO and then used PrintBrm to treat that zip as a backup and unpack it into a temp directory.
PrintBrm.exe -r -f HR-Update.zip -d Temp\unzip
The flag "-r" equates to "Restore the configuration in the file to the server", "-f" is the "backup" file name (in this case "HR-Update.zip") and "-d" is used to "Unpack the backup file to the directory (with -r)". You can find a full break down on the command line arguments for PrintBrm here.
I would not expect to see PrintBrm used as part of normal activity in most Windows estates, if it was being used I imagine it would be as part of automated administrative activity or activity carried out directly by admins.
If I had to align this to ATT&CK I'd say T1027, Obfuscated Files or Information, it's a little bit clumsy mapping wise in my opinion but that's what we have.
I'm not going to leave you all without a chance to see what this all look like from EventID 4688:
Note that because PrintBrm is not normally in the Windows path, I had to specify the full path to the executable.
Splunk SPL is going to look something like:
index=winlogs EventCode=4688 New_Process_Name="*\\PrintBrm.
Happy hunting, etc.
