ransomhub

T1078Valid Accounts

T1078.003Valid Accounts: Local Accounts

T1190Exploit Public-Facing Application

T1566.001Phishing: Spearphishing Attachment

T1566.004Phishing: Spearphishing Voice

T1047Windows Management Instrumentation

The ransomware deletes shadow copies using the WMIC.exe utility.

T1059Command and Scripting Interpreter

T1059.001Command and Scripting Interpreter: PowerShell

T1059.003Command and Scripting Interpreter: Windows Command Shell

The ransomware utilizes cmd.exe to execute various Windows utilities to implement various other techniques.

T1059.006Command and Scripting Interpreter: Python

T1203Exploitation for Client Execution

T1098Account Manipulation

T1133External Remote Services

T1136Create Account

T1136.001Create Account: Local Account

T1136.002Create Account: Domain Account

T1547Boot or Logon Autostart Execution

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL

T1068Exploitation for Privilege Escalation

T1548.002Abuse Elevation Control Mechanism: Bypass UAC

T1027Obfuscated Files or Information

T1027.009Obfuscated Files or Information: Embedded Payloads

T1027.013Obfuscated Files or Information: Encrypted/Encoded File

T1036Masquerading

T1055.012Process Injection: Process Hollowing

T1070Indicator Removal

T1070.001Indicator Removal: Clear Windows Event Logs

The ransomware clears the victim machine's application, system, and security event logs using the wevtutil.exe utility.

T1112Modify Registry

T1134Access Token Manipulation

T1134.001Access Token Manipulation: Token Impersonation/Theft

T1222.001File and Directory Permissions Modification: Windows Permissions

T1480Execution Guardrails

T1484.001Domain or Tenant Policy Modification: Group Policy Modification

T1562Impair Defenses: Disable or Modify Tools

Threat actors use files such as: STONESTOP and POORTRY to load drivers for the purpose of disabling and deleting AV files.

T1562.001Impair Defenses: Disable or Modify Tools

T1564Hidden Artifacts

T1564.003Hidden Artifacts: Hidden Window

T1620Reflective DLL Injection

T1003OS Credential Dumping

T1003.001OS Credential Dumping: LSASS Memory

T1003.003OS Credential Dumping: NTDS

T1003.008OS Credential Dumping: /etc/passwd and /etc/shadow

T1110Brute Force

T1110.003Brute Force: Password Spraying

T1555.005Credentials from Password Stores: Password Managers

T1007System Service Discovery

T1016.001Internet Connection Discovery

T1018Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1057Process Discovery

T1082System Information Discovery

T1083File and Directory Discovery

T1087Account Discovery

T1087.001Account Discovery: Local Account

T1087.002Account Discovery: Domain Account

T1120Peripheral Device Discovery

T1135Network Share Discovery

T1482Domain Trust Discovery

T1021Remote Services

T1021.001Remote Services: Remote Desktop Protocol

T1021.002Remote Services: SMB/Windows Admin Shares

T1021.004Remote Services: SSH

T1210Exploitation of Remote Services

T1570Lateral Tool Transfer

Affiliates were identified using: psexec.exe, PsExec.exe, and smbexec.exe for lateral movement.

T1005Data from Local System

T1048Exfiltration Over Alternative Protocol

T1048.002Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol

T1048.003Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol

T1537Transfer Data to Cloud Account

T1567Exfiltration Over Web Service

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

T1071.001Application Layer Protocol: Web Protocols

T1102.002Web Service: Bidirectional Communication

T1219Remote Access Tools

T1486Data Encrypted for Impact

Files are encrypted using file replacement method.

T1489Service Stop

The Windows IIS service stop command is executed using iisreset.exe. Allows for encryption of web applications hosted on IIS servers as files linked to these applications are typically locked while IIS is running.

T1490Inhibit System Recovery

The ransomware deletes system shadow copies to inhibit system recovery.

T1529System Shutdown/Reboot

T1531Account Access Removal

T1561.001Disk Wipe: Disk Content Wipe

T1586Compromise Accounts