Payouts King Takes Aim at the Ransomware Throne | ThreatLabz

Key Takeaways

• Payouts King is a newly identified ransomware group that emerged from former BlackBasta affiliates.
• Initial access relies heavily on social engineering, including spam bombing, vishing, and the misuse of Microsoft Teams and Quick Assist.
• The ransomware uses 4096-bit RSA and 256-bit AES CTR mode for file encryption, with partial encryption for files over 10MB.
• Advanced evasion techniques are employed, including custom CRC32 API hashing, stack strings, and direct system calls to terminate AV/EDR processes.
• File renaming bypasses standard MoveFile hooks by utilizing the SetFileInformationByHandle API.

Affected Systems

• Windows

Attack Chain

The attack begins with initial access brokers using spam bombing, phishing, and vishing to trick users into granting access via Microsoft Teams and Quick Assist. Once a foothold is established, the Payouts King ransomware is deployed. It establishes persistence and elevates privileges using scheduled tasks created via piped commands to cmd.exe. The ransomware then terminates AV/EDR processes using direct system calls, encrypts files using AES-256 and RSA-4096, renames them using SetFileInformationByHandle to evade detection, and finally deletes shadow copies and clears event logs to hinder recovery.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article provides detailed behavioral indicators, command-line parameters, and evasion techniques, but does not include ready-to-use detection rules.

Detection Engineering Assessment

EDR Visibility: Medium — The ransomware actively evades EDR by using direct system calls (Zw* functions) to terminate security processes and uses SetFileInformationByHandle instead of MoveFile to rename files, bypassing standard user-mode API hooks. Network Visibility: Low — The article does not detail specific C2 infrastructure or network indicators beyond the initial access phase involving Teams and Quick Assist. Detection Difficulty: Hard — The use of direct system calls, custom API hashing, and alternative file renaming APIs makes signature-based and standard behavioral detection difficult.

Required Log Sources

• Event ID 4688 (Process Creation)
• Event ID 4698 (A scheduled task was created)
• Event ID 1102 (The audit log was cleared)

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for schtasks.exe creating tasks named "\Mozilla\UpdateTask" or "\Mozilla\ElevateTask" running as SYSTEM.	Process Creation (Event ID 4688) or Scheduled Task Creation (Event ID 4698)	Persistence	Low
Monitor for vssadmin.exe executing with parameters "delete shadows /all /quiet".	Process Creation (Event ID 4688)	Impact	Low
Identify anomalous usage of Quick Assist (quickassist.exe) followed by unusual child processes or network connections.	Process Creation (Event ID 4688) and Network Connections	Initial Access	Medium

Control Gaps

• EDR user-mode API hooking (bypassed via direct syscalls)
• Standard file modification monitoring (bypassed via SetFileInformationByHandle)

Key Behavioral Indicators

• Creation of scheduled tasks under \Mozilla\
• Files appended with .ZWIAAW or .esVnyj extensions
• Presence of readme_locker.txt on the desktop

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Block execution of known Payouts King scheduled task names (\Mozilla\UpdateTask, \Mozilla\ElevateTask).
• Monitor and restrict the use of vssadmin.exe for shadow copy deletion.

Infrastructure Hardening

• Enforce Multi-Factor Authentication (MFA) across all remote access points.
• Restrict or monitor the use of legitimate remote support tools like Quick Assist.

User Protection

• Deploy EDR solutions capable of detecting direct system calls and kernel-level anomalies.
• Implement strict least privilege policies to prevent unauthorized scheduled task creation as SYSTEM.

Security Awareness

• Train employees to recognize spam bombing, vishing, and fake IT support scams.
• Educate users on the risks of granting access via Microsoft Teams or Quick Assist to unverified personnel.

MITRE ATT&CK Mapping

• T1566 - Phishing
• T1053.005 - Scheduled Task/Job: Scheduled Task
• T1562.001 - Impair Defenses: Disable or Modify Tools
• T1106 - Native API
• T1486 - Data Encrypted for Impact
• T1490 - Inhibit System Recovery
• T1070.001 - Indicator Removal: Clear Windows Event Logs

Additional IOCs

• Command Lines:
  • Purpose: Establish persistence via scheduled task | Tools: schtasks.exe | Stage: Persistence
  • Purpose: Elevate privileges via scheduled task | Tools: schtasks.exe | Stage: Privilege Escalation
  • Purpose: Delete Windows shadow copies to inhibit recovery | Tools: vssadmin.exe | Stage: Impact | vssadmin.exe delete shadows /all /quiet