threeam

T1136Create Account

The threat actor using the 3AM ransomware performed account creation to ensure persistence.

T1543.003Service Execution

The threat actor used PsExec to take advantage of a Windows service to escalate from administrator privileges to SYSTEM.

T1548.002Bypass User Account Control

The threat actor may use Cobalt Strike for a series of known techniques to bypass Windows UAC.

T1070.001Clear Windows Event Logs

The executable clears Windows event logs after its execution.

T1562.004Disable or Modify System Firewall Settings

The threat actor uses commands to set the discovery policy of other hosts on the network, altering the Firewall policy.

T1018Remote System Discovery

Utilizes Advanced IP Scanner and MASSCAN to discover remote systems.

T1135Network Share Discovery

The threat actor executed reconnaissance commands like 'whoami, netstat, quser, net view, and net share' to enumerate other servers.

T1615Group Policy Discovery

The threat actor used commands like 'gpresult' to dump applied policy settings on the computer for a user (Group Policy).

T1048Exfiltration Over Alternative Protocol

The threat actor used the 'Wput' tool to exfiltrate files from the victim to their own server via FTP.

T1486Data Encrypted for Impact

The ransomware encrypts files and appends the '.threeamtime' extension after encryption.

T1490Inhibit System Recovery

The 3AM ransomware deletes volume shadow copies on the disk and backups through the commands presented in the analysis.