To the host files, the encryption appears to be a trusted VirtualBox process and thus will be ignored by many security products.

This allows the ransomware process running inside the VM to encrypt all files. The specially-crafted VM image is loaded to the VirtualBox VM, mapping all local drives as read/writable into the virtual machine. The technique has been adopted since by the Maze family of ransomware operators. Having achieved privilege escalation, the attacker sometimes deploys a VirtualBox virtual machine (VM) with a Windows XP image to evade detection: an early use of a virtual machine image in this manner to run the ransomware encryption attack. To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges. Next, the attacker performs second-stage reconnaissance.

The threat actor begin the attack by compromising the company’s network via RDP service, using brute force to guess weak passwords or with stolen credentials bought on the Dark Web.

Powershell crypto locker