clop

T1078Valid accounts

Have been reported to make use of compromised accounts to access victims via RDP.

T1190Exploit public-facing application

Arrives via any the following exploits: CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104, CVE-2021-35211.

T1566.001Phishing: Spear-phishing attachment

Arrives via phishing emails that have Get2 Loader, which will download the SDBot and FlawedAmmy RAT.

T1059Command and scripting interpreter

Uses various scripting interpreters like PowerShell, Windows command shell and Visual Basic (macro in documents).

T1106Native API

Uses native API to execute various commands/routines.

T1204User execution

User execution is needed to carry out the payload from the spear-phishing link/attachments.

T1543.003Create or modify system process: Windows service

Creates a service to execute the ransomware.

T1547Boot or logon autostart execution

Creates registry run entries to execute the ransomware as a service.

T1068Exploitation for privilege escalation

Makes use of CVE-2021-27102 to escalate privilege.

T1484.001Domain Policy modification: Group Policy modification

Uses stolen credentials to access the AD servers to gain administrator privilege and attack other machines within the network.

T1574Hijack execution flow

UAC bypass.

T1036.001Masquerading: invalid code signature

Makes use of the following digital signatures: DVERI, FADO, TOV.

T1055.001Process injection: DLL injection

To deliver other tools and payload, a tool has the capability to inject its downloaded payload.

T1070.001Indicator removal on host: clear Windows event logs

Clears the Event Viewer log files.

T1070.004Indicator removal on host: file deletion

Deletes traces of itself in the infected machine.

T1140Deobfuscate/Decode files or information

The tool used for exfiltration has a part of its malware trace removal, and it drops a base-64 encoded file.

T1202Indirect command execution

A startup script runs just before the system gets to the login screen via startup registry.

T1562.001Impair defenses: disable or modify tools

Disables security-related software by terminating them.

T1012Query registry

Queries certain registries as part of its routine.

T1018Remote system discovery

Makes use of tools for network scans.

T1057Process discovery

Discovers certain processes for process termination.

T1063Security software discovery

Discovers security software for reconnaissance and termination.

T1082System information discovery

Identifies keyboard layout and other system information.

T1083File and directory discovery

Searches for specific files and the directory related to its encryption.

T1021.002Remote services: SMB/Windows admin shares

Drops a copy of the payload to the compromised AD and then creates a service on the target machine to execute the copy of the payload.

T1570Lateral tool transfer

Can make use of RDP to transfer the ransomware or tools within the network.

T1005Data from local system

Might make use of RDP to manually search for valuable files or information.

T1567Exfiltration over web service

DEWMODE web shell extracts list of available files from a MySQL database on the FTA and lists these files and corresponding their metadata. These will then be downloaded using the DEWMODE web shell.

T1071Application Layer Protocol

Uses http/s to communicate to its C&C server.

T1486Data encrypted for impact

Uses a combination of Salsa20, AES, and ECDH to encrypt the files and key.

T1490Inhibit system recovery

Deletes shadow copies.